@kici-dev/orchestrator 0.20.1 → 0.21.0

package/dist/server.js

@@ -5,7 +5,7 @@ __cjs_dirname(__filename);
 import "node:module";
 import "@kici-dev/shared/load-service-env-file";
 import { AgentDeliveryMode, AgentPlatform, BaseColdStore, ChunkLru, ChunkRequestWaiter, CommandError, PgTableAdapterBase, RingBuffer, addLogsToArchive, applyProxyKeepAliveTimeouts, chunkBuffer, closeDatabase, computeBackoffDelay, computeMigrationsHash, createDb, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, createPool, createS3Client, decrypt, decryptJson, depCacheKeyOf, deriveKey, encodeKeySegment, encrypt, enrichRequestContext, formatDuration, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, isPgUniqueViolation, logger, parseDatabaseUrl, redactConfig, requestContext, retryOnBrokenConnection, serializeError, setServiceName, setupGracefulShutdown, shQuote, sha256, stderrTail, stopHttpServer, storeMigrationContentHash, toCommandError, toErrorMessage, trackOpenSockets, validateRequiredTools } from "@kici-dev/shared";
-import { ACTOR_AGENT_SUFFIX, AGENT_API_REQUEST_TIMEOUT_MS, AGENT_FEATURE_LABELS, ALLOWED_SYSTEM_VARS, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CLUSTER_MEMBERSHIP_MAX_WORKERS, CONTAINER_BUILD_RUNTIME_LABEL, CacheRefScope, CheckMode, CheckRunConclusion, CheckStepOutcome, CiTrustLevel, ConcurrencyStrategy, ContextDeleteErrorCode, ContextGateRejectReason, ContextType, DASHBOARD_REQUEST_TYPE_SET, DEFAULT_APPROVAL_EXPIRY_SECONDS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEFERRED_PATHS_SUMMARY_SUFFIX, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentModeSchema, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostWriteRefusal, ForkPolicy, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, ID_TOKEN_CLAIM_NAMES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, INVALID_JOIN_REQUEST_MESSAGE, InitFailureCategory, InventorySelectorSchema, JOB_IMAGE_RUNTIME_LABEL, JOIN_PROTOCOL_UPGRADE_TOKEN, JOIN_PROTOCOL_V1_REMOVED_MESSAGE, JobRejectReason, JoinErrorCode, JoinRequestKind, KICI_AGENT_ENV_PREFIX, KICI_EVENT_NAME_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, LogStream, MAX_APPROVAL_EXPIRY_SECONDS, MIN_APPROVAL_EXPIRY_SECONDS, MIN_PROTOCOL_VERSION, MinimumTrustSchema, NackCode, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OWN_INGRESS_MODES, OrchLogPhase, OrchRole, OrchestratorMode, PEER_MUTUAL_AUTH_REQUIRED_REASON, PLATFORM_CONNECTED_MODES, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PayloadOmittedReason, PeerAuthMode, PeerAuthScheme, PeerForgetOutcome, RELAY_INGRESS_MODES, RegisterableTriggerType, RunFailureClass, RuntimeFact, SCALER_EVENT_NAMES, SCHEMA_VERSION, SECURITY_HOLD_JOB_IDS, SSH_TRANSPORT_CAPABILITY, ScaleDownReason, ScaleDownReason as ScaleDownReason$1, ScalerBackendType, ScalerEventType, ScalerEventType as ScalerEventType$1, ScalerOrphansAction, ScalerReloadOutcome, ScalerScaleDownPayload, ScalerScaleUpPayload, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, SetupStepType, SourceOrigin, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TEST_RUN_LOG_CURSOR_START, TRIGGER_EVENT_TYPES, TimeoutReason, TraceCheck, TriggerSource, TrustTierSchema, UnavailablePathsTrace, VariantKind, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentLabelOf, agentToOrchestratorMessageSchema, agentTypeLabel, appendChecks, approvalTimeoutSecondsSchema, artifactInvalidNameError, assertValidScopeName, assertValidSecretKey, attestationVerifyStatusSchema, buildEventClaims, buildIdTokenSubject, buildJoinRefusal, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, canonicalizeCapability, canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels, canonicalizeMatcher, checkArtifactName, clampInitFailure, clampStatusFreeText, classifyJoinRequest, coerceDispatchInputs, collectDiscriminatorTypes, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createWorkflowDecision, dashboardArtifactsListResponseSchema, dashboardAttestationGetResponseSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListResponseSchema, dashboardRunDetailApiResponseSchema, dashboardStepLogsApiResponseSchema, deriveOsArchLabels, diffRangeKindSchema, executionStatusSchema, fanoutEnvelopeFields, flattenActor, formatLabelMatcher, getAccessLogColdDays, getRepoGlobMatcher, getSecretAuditLogColdDays, githubIngressPath, githubWebhookPath, globalEvalRoundResultSchema, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, installGateJobId, invalidFramePaths, isFailureStatus, isJoinRequestFrame, isKnownCapability, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, isPullRequestFamilyTriggerEvent, isSecurityHoldJobId, isSelfReportedLabel, jobStatusForwardSchema, joinRequestSchema, logPullPlatformToOrchSchema, matchAllWorkflows, matchScopePattern, matchWorkflowsForEvent, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, mergeOrderedMaps, minAccessLogWarmDays, minSecretAuditLogWarmDays, partitionMatchers, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, reservedEventNamePrefix, resolveDiffRange, resolveRoleLabels, resolveScheduleInputs, resolveSecretsWithProvenance, resourceRequestNestedSchema, runtimeLabel, scalerAgentLabels, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve, sleep, stateReplaySchema, stepStatusForwardSchema, stringifyActor, testRelayTriggerRequestSchema, testRelayUploadsInitRequestSchema, toIsoString, truncateDecisionsToByteBudget, truncateReasonText, trustPolicyUpdateSchema, trustedContributorHoldReason, validateScopeName, validateSecretKey, wrapUntrusted } from "@kici-dev/engine";
+import { ACTOR_AGENT_SUFFIX, AGENT_API_REQUEST_TIMEOUT_MS, AGENT_FEATURE_LABELS, ALLOWED_SYSTEM_VARS, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, AgentFailureCategory, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CLUSTER_MEMBERSHIP_MAX_WORKERS, CONTAINER_BUILD_RUNTIME_LABEL, CacheRefScope, CheckMode, CheckRunConclusion, CheckStepOutcome, CiTrustLevel, ConcurrencyStrategy, ContextDeleteErrorCode, ContextGateRejectReason, ContextType, DASHBOARD_REQUEST_TYPE_SET, DEFAULT_APPROVAL_EXPIRY_SECONDS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEFERRED_PATHS_SUMMARY_SUFFIX, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentModeSchema, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostWriteRefusal, ForkPolicy, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, ID_TOKEN_CLAIM_NAMES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INIT_STEP_TYPE_PREFIX, INSTALL_JOB_ID_PREFIX, INVALID_JOIN_REQUEST_MESSAGE, InitFailureCategory, InventorySelectorSchema, JOB_IMAGE_RUNTIME_LABEL, JOIN_PROTOCOL_UPGRADE_TOKEN, JOIN_PROTOCOL_V1_REMOVED_MESSAGE, JobRejectReason, JoinErrorCode, JoinRequestKind, KICI_AGENT_ENV_PREFIX, KICI_EVENT_NAME_PREFIX, KNOWN_ROLES, LabelMatcher, LockFileParseError, LogStream, MAX_APPROVAL_EXPIRY_SECONDS, MIN_APPROVAL_EXPIRY_SECONDS, MIN_PROTOCOL_VERSION, MinimumTrustSchema, NackCode, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, OWN_INGRESS_MODES, OrchLogPhase, OrchRole, OrchestratorMode, PEER_MUTUAL_AUTH_REQUIRED_REASON, PLATFORM_CONNECTED_MODES, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PayloadOmittedReason, PeerAuthMode, PeerAuthScheme, PeerForgetOutcome, RELAY_INGRESS_MODES, RegisterableTriggerType, RunFailureClass, RuntimeFact, SCALER_EVENT_NAMES, SCHEMA_VERSION, SECURITY_HOLD_JOB_IDS, SSH_TRANSPORT_CAPABILITY, ScaleDownReason, ScaleDownReason as ScaleDownReason$1, ScalerBackendType, ScalerEventType, ScalerEventType as ScalerEventType$1, ScalerOrphansAction, ScalerReloadOutcome, ScalerScaleDownPayload, ScalerScaleUpPayload, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, SetupStepType, SourceOrigin, SourceSubtype, StepPhase, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TEST_RUN_LOG_CURSOR_START, TRIGGER_EVENT_TYPES, TimeoutReason, TraceCheck, TriggerSource, TrustTierSchema, UnavailablePathsTrace, VariantKind, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentLabelOf, agentToOrchestratorMessageSchema, agentTypeLabel, appendChecks, approvalTimeoutSecondsSchema, artifactInvalidNameError, assertValidScopeName, assertValidSecretKey, attestationVerifyStatusSchema, buildEventClaims, buildIdTokenSubject, buildJoinRefusal, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, canonicalizeCapability, canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels, canonicalizeMatcher, checkArtifactName, clampInitFailure, clampStatusFreeText, classifyJoinRequest, coerceDispatchInputs, collectDiscriminatorTypes, compareStepsByPhase, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createWorkflowDecision, dashboardArtifactsListResponseSchema, dashboardAttestationGetResponseSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListResponseSchema, dashboardRunDetailApiResponseSchema, dashboardStepLogsApiResponseSchema, deriveOsArchLabels, diffRangeKindSchema, executionStatusSchema, fanoutEnvelopeFields, flattenActor, formatLabelMatcher, getAccessLogColdDays, getRepoGlobMatcher, getSecretAuditLogColdDays, githubIngressPath, githubWebhookPath, globalEvalRoundResultSchema, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, initStepIndex, installGateJobId, invalidFramePaths, isFailureStatus, isJoinRequestFrame, isKnownCapability, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, isPullRequestFamilyTriggerEvent, isRunId, isSecurityHoldJobId, isSelfReportedLabel, jobStatusForwardSchema, joinRequestSchema, logPullPlatformToOrchSchema, matchAllWorkflows, matchScopePattern, matchWorkflowsForEvent, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixEnvelopeFields, mergeOrderedMaps, minAccessLogWarmDays, minSecretAuditLogWarmDays, parseRunIdRef, partitionMatchers, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, reservedEventNamePrefix, resolveDiffRange, resolveRoleLabels, resolveScheduleInputs, resolveSecretsWithProvenance, resourceRequestNestedSchema, runIdPrefixRange, runtimeLabel, scalerAgentLabels, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve, sleep, stateReplaySchema, stepPhase, stepStatusForwardSchema, stepTypeOf, stringifyActor, testRelayTriggerRequestSchema, testRelayUploadsInitRequestSchema, toIsoString, truncateDecisionsToByteBudget, truncateReasonText, trustPolicyUpdateSchema, trustedContributorHoldReason, validateScopeName, validateSecretKey, wrapUntrusted } from "@kici-dev/engine";
 import * as fs$2 from "node:fs";
 import fs, { chmodSync, closeSync, createReadStream, createWriteStream, fsyncSync, mkdirSync, mkdtempSync, openSync, promises, readFileSync, renameSync, rmSync, statSync, unwatchFile, watchFile, writeFileSync, writeSync } from "node:fs";
 import { z } from "zod";
@@ -8056,7 +8056,7 @@ var init_execution_tracker = __esmMin((() => {
 			const run = this.runs.get(runId);
 			const prefix = `needs-pending-${jobName}-`;
 			if (run) {
-				for (const key of run.jobs.keys()) if (key.startsWith(prefix)) return key;
+				for (const [key, job] of run.jobs) if (key.startsWith(prefix) && job.name === jobName) return key;
 			}
 			return (await this.db.selectFrom("execution_jobs").select("job_id").where("run_id", "=", runId).where("job_name", "=", jobName).where("job_id", "like", `${prefix}%`).executeTakeFirst())?.job_id;
 		}
@@ -9130,6 +9130,10 @@ var init_execution_tracker = __esmMin((() => {
 		async recordInitFailureRun(args) {
 			const now = /* @__PURE__ */ new Date();
 			const customerId = await this.resolveCustomerId(args.routingKey);
+			const testRunColumns = args.testRun ? {
+				is_test_run: true,
+				fixture_id: args.testRun.fixtureId
+			} : {};
 			const crossRepoWorkflowRepo = crossRepoWorkflowRepoOf(args);
 			if (!guardedWriteApplied(await this.db.insertInto("execution_runs").values({
 				run_id: args.runId,
@@ -9151,7 +9155,8 @@ var init_execution_tracker = __esmMin((() => {
 				init_failure: JSON.stringify(args.initFailure),
 				...inheritedChainDepth(args.chainDepth),
 				...rerunLineageColumns(args.rerunLineage),
-				...crossRepoWorkflowRepo && { workflow_repo_identifier: crossRepoWorkflowRepo }
+				...crossRepoWorkflowRepo && { workflow_repo_identifier: crossRepoWorkflowRepo },
+				...testRunColumns
 			}).onConflict((oc) => oc.column("run_id").doUpdateSet({
 				completed_at: now,
 				duration_ms: sql`extract(epoch from (${now} - execution_runs.started_at)) * 1000`,
@@ -9160,7 +9165,8 @@ var init_execution_tracker = __esmMin((() => {
 				failure_class: RunFailureClass.enum.never_started,
 				init_failure: JSON.stringify(args.initFailure),
 				...inheritedChainDepth(args.chainDepth),
-				...crossRepoWorkflowRepo && { workflow_repo_identifier: crossRepoWorkflowRepo }
+				...crossRepoWorkflowRepo && { workflow_repo_identifier: crossRepoWorkflowRepo },
+				...testRunColumns
 			}).where("execution_runs.status", "not in", [...TERMINAL_RUN_STATES])).executeTakeFirst())) {
 				logger$171.debug("Init-failure record skipped: run already terminal in DB", { runId: args.runId });
 				return;
@@ -9265,6 +9271,10 @@ var init_execution_tracker = __esmMin((() => {
 		*/
 		async recordRunHeld(args) {
 			const now = /* @__PURE__ */ new Date();
+			const testRunColumns = args.testRun ? {
+				is_test_run: true,
+				fixture_id: args.testRun.fixtureId
+			} : {};
 			const customerId = await this.resolveCustomerId(args.routingKey);
 			const crossRepoProvenance = crossRepoProvenanceOf(args.repoIdentifier, {
 				identifier: args.workflowRepoIdentifier,
@@ -9292,11 +9302,13 @@ var init_execution_tracker = __esmMin((() => {
 				...rerunLineageColumns(args.rerunLineage),
 				...crossRepoProvenance && workflowProvenanceColumns(crossRepoProvenance),
 				...args.isGlobalEvalRound === true && { is_global_eval_round: true },
-				...args.dispatchRoutingKey != null && args.dispatchRoutingKey !== args.routingKey && { dispatch_routing_key: args.dispatchRoutingKey }
+				...args.dispatchRoutingKey != null && args.dispatchRoutingKey !== args.routingKey && { dispatch_routing_key: args.dispatchRoutingKey },
+				...testRunColumns
 			}).onConflict((oc) => oc.column("run_id").doUpdateSet({
 				status: ExecutionRunStatus.enum.held,
 				...args.contextName && { context: args.contextName },
 				...args.prNumber != null && { pr_number: args.prNumber },
+				...testRunColumns,
 				...inheritedChainDepth(args.chainDepth),
 				...crossRepoProvenance && {
 					workflow_repo_identifier: crossRepoProvenance.identifier,
@@ -9562,7 +9574,8 @@ var init_execution_tracker = __esmMin((() => {
 				log_path: logPath,
 				routing_key: this.runs.get(runId)?.routingKey ?? null
 			};
-			if (data?.stepType && typeof data.stepType === "string") values.step_type = data.stepType;
+			const stepType = stepTypeOf(data);
+			if (stepType) values.step_type = stepType;
 			if (state === ExecutionStepStatus.enum.running) values.started_at = now;
 			if (TERMINAL_JOB_STATES.has(state)) {
 				values.completed_at = now;
@@ -14920,6 +14933,17 @@ var init_reduced_privilege_note = __esmMin((() => {
 * - Size safety: 65535 byte limit with progressive truncation
 */
 /**
+* Record one step's progress: replace the entry for its index, or add it in display
+* order. Pseudo-steps have high indices (init at 1_000_000 + n), so the list is keyed
+* by index rather than position; a positional list would pad every gap up to it.
+*/
+function applyStepProgress(steps, entry) {
+	return [...steps.map((s, position) => ({
+		...s,
+		stepIndex: s.stepIndex ?? position
+	})).filter((s) => s.stepIndex !== entry.stepIndex), entry].sort(compareStepsByPhase);
+}
+/**
 * Cut `summary` to fit the API's cap, whatever a caller wrapped around it. The last line of
 * defence: `reservedBytes` keeps a summary readable by dropping log tiers first.
 */
@@ -15904,27 +15928,13 @@ var init_check_run_reporter = __esmMin((() => {
 			if (!checkRunId) return;
 			if (this.terminalSent.has(key)) return;
 			this.trackRunKey(opts.runId, key);
-			let steps = this.stepProgress.get(key);
-			if (!steps) {
-				steps = [];
-				this.stepProgress.set(key, steps);
-			}
-			if (opts.stepIndex < steps.length) steps[opts.stepIndex] = {
+			const steps = applyStepProgress(this.stepProgress.get(key) ?? [], {
 				name: opts.stepName,
 				status: opts.state,
-				durationMs: opts.durationMs
-			};
-			else {
-				while (steps.length < opts.stepIndex) steps.push({
-					name: `Step ${steps.length}`,
-					status: "pending"
-				});
-				steps.push({
-					name: opts.stepName,
-					status: opts.state,
-					durationMs: opts.durationMs
-				});
-			}
+				durationMs: opts.durationMs,
+				stepIndex: opts.stepIndex,
+				...opts.stepType && { stepType: opts.stepType }
+			});
 			await this.persistStepProgress(key, steps, opts.runId);
 			if (opts.state === ExecutionStepStatus.enum.running && !this.inProgressSent.get(key)) {
 				await this.persistInProgressSent(key, opts.runId);
@@ -48284,7 +48294,9 @@ function createAdminQueueExecutionRoutes(deps) {
 	});
 	app.get("/executions/:runId", async (c) => {
 		deps.rbac.requirePermission(c.get("role"), "secret.read");
-		const runId = c.req.param("runId");
+		const rawRunId = c.req.param("runId");
+		if (!isRunId(rawRunId)) return c.json({ error: `Invalid run id '${rawRunId}': a run id is a full UUID.` }, 400);
+		const runId = rawRunId.toLowerCase();
 		const runRow = await sql`
         SELECT id, run_id, workflow_name, status, provider, repo_identifier,
                ref, sha, routing_key, context, trust_tier, created_at,
@@ -49220,6 +49232,10 @@ var init_decorating_secret_resolver = __esmMin((() => {
 *   decorating secret resolver), and the fixture's `secrets` context mapping
 *   resolves into namespaced secrets;
 * - direct workflow execution (bypass trigger matching) is supported.
+*
+* Like a webhook, it creates one run per matched workflow. A caller that
+* follows a single run (no `acceptsMultipleRuns`) gets one shared run instead,
+* and only when the workflows' job names cannot collide in it.
 */
 /**
 * Repo identity for an inline-lock (local working tree) run. Derived from the
@@ -49438,9 +49454,90 @@ function buildTestDispatchContext(shared, workflow, decision, runId) {
 		...Object.keys(shared.runWideFlatSecrets).length > 0 && { runWideFlatSecrets: shared.runWideFlatSecrets }
 	};
 }
+/** The static job names a workflow defines; null when it has a dynamic job, whose names are unknown until it runs. */
+function staticJobNames(workflow) {
+	const names = [];
+	for (const job of workflow.jobs) {
+		if (job._type !== "static") return null;
+		names.push(job.name);
+	}
+	return names;
+}
+/**
+* The job names two or more matched workflows define, sorted. Null when a
+* matched workflow has a dynamic job, so the names cannot be compared before
+* the run.
+*/
+function sharedJobNames(fullLockFile, matchedDecisions) {
+	const owners = /* @__PURE__ */ new Map();
+	for (const decision of matchedDecisions) {
+		const workflow = fullLockFile.workflows.find((w) => w.name === decision.workflowName);
+		if (!workflow) continue;
+		const names = staticJobNames(workflow);
+		if (names === null) return null;
+		for (const name of new Set(names)) owners.set(name, (owners.get(name) ?? 0) + 1);
+	}
+	return [...owners.entries()].filter(([, count]) => count > 1).map(([name]) => name).sort();
+}
+/**
+* Split the matched workflows into runs: one run per workflow, as every other
+* run producer does.
+*
+* A caller that does not set `acceptsMultipleRuns` follows only `runId`. For
+* it, several matched workflows share one run when their job names cannot
+* collide (a run keys its needs edges, pending contexts and logs by job name),
+* and the trigger is refused when they can.
+*/
+function planTestRuns(input, fullLockFile, matchedDecisions, firstRunId) {
+	if (input.acceptsMultipleRuns || matchedDecisions.length === 1) return matchedDecisions.map((decision, i) => ({
+		runId: i === 0 ? firstRunId : randomUUID(),
+		decisions: [decision]
+	}));
+	const shared = sharedJobNames(fullLockFile, matchedDecisions);
+	if (shared === null || shared.length > 0) return { rejected: `This fixture matches several workflows (${matchedDecisions.map((d) => d.workflowName).join(", ")}) and ${shared === null ? "one of them defines dynamic jobs, whose names cannot be checked before the run" : `they share job names (${shared.join(", ")})`}. This kici version follows a single run, so upgrade kici to run each workflow as its own run, or pass --workflow <name> to run one workflow.` };
+	return [{
+		runId: firstRunId,
+		decisions: matchedDecisions
+	}];
+}
+/**
+* Dispatch one planned run. A run of several workflows (the shared run of a
+* caller without `acceptsMultipleRuns`) is held open from its first
+* registration until its last workflow has registered: a workflow whose jobs
+* all end before the next one registers would otherwise complete the run, and
+* the next workflow would start it over.
+*/
+async function dispatchPlannedRun(shared, deps, planned) {
+	const { runId, decisions } = planned;
+	const out = {
+		jobIds: [],
+		deferredJobCount: 0,
+		warnings: []
+	};
+	let runHeld = false;
+	const holdRunOpen = () => {
+		if (!runHeld && decisions.length > 1) runHeld = deps.executionTracker?.holdRunForPendingJobs(runId) ?? false;
+	};
+	try {
+		for (const decision of decisions) {
+			const workflow = shared.fullLockFile.workflows.find((w) => w.name === decision.workflowName);
+			if (!workflow) continue;
+			const ctx = buildTestDispatchContext(shared, workflow, decision, runId);
+			ctx.onRunRegistered = holdRunOpen;
+			const result = await dispatchMatchedWorkflow(ctx);
+			out.jobIds.push(...result.dispatchedJobIds);
+			out.deferredJobCount += result.deferredJobCount ?? 0;
+			if (result.envWarnings?.length) out.warnings.push(...result.envWarnings);
+		}
+	} finally {
+		if (runHeld) await deps.executionTracker?.releasePendingJobsHold(runId);
+	}
+	return out;
+}
 /**
 * Process a test trigger through the shared dispatch core: one
-* `WorkflowDispatchContext` per matched workflow, into `dispatchMatchedWorkflow`.
+* `WorkflowDispatchContext` per matched workflow, into `dispatchMatchedWorkflow`,
+* each under its own run id.
 */
 async function processTestTrigger(input, deps) {
 	const runId = randomUUID();
@@ -49476,6 +49573,13 @@ async function processTestTrigger(input, deps) {
 		jobIds: []
 	};
 	const matchedDecisions = matchResult;
+	const plan = planTestRuns(input, fullLockFile, matchedDecisions, runId);
+	if (!Array.isArray(plan)) return {
+		runId,
+		status: "rejected",
+		reason: plan.rejected,
+		jobIds: []
+	};
 	const resolvedOrgId = deps.db ? await resolveOrgId(deps.db, input.routingKey) : "__default__";
 	const dispatchInputsResult = resolveDispatchInputs(input, fullLockFile, matchedDecisions);
 	if ("rejected" in dispatchInputsResult) return {
@@ -49491,13 +49595,13 @@ async function processTestTrigger(input, deps) {
 		reason: namespacedResult.rejected,
 		jobIds: []
 	};
-	await storeFixturePayload(input, deps, runId);
+	for (const planned of plan) await storeFixturePayload(input, deps, planned.runId);
 	const cliSecrets = decryptCliSecrets(input);
 	const testDeps = deps.secretResolver ? {
 		...deps,
 		secretResolver: new DecoratingSecretResolver(deps.secretResolver, cliSecrets)
 	} : deps;
-	deps.executionTracker?.markTestRun(runId);
+	for (const planned of plan) deps.executionTracker?.markTestRun(planned.runId);
 	const provider = inlineProvider ?? input.routingKey.split(":")[0] ?? "local";
 	const shared = {
 		input,
@@ -49523,34 +49627,31 @@ async function processTestTrigger(input, deps) {
 	const jobIds = [];
 	const warnings = [];
 	let deferredJobCount = 0;
-	let runHeld = false;
-	const holdRunOpen = () => {
-		if (!runHeld && matchedDecisions.length > 1) runHeld = deps.executionTracker?.holdRunForPendingJobs(runId) ?? false;
-	};
-	try {
-		for (const decision of matchedDecisions) {
-			const workflow = fullLockFile.workflows.find((w) => w.name === decision.workflowName);
-			if (!workflow) continue;
-			const ctx = buildTestDispatchContext(shared, workflow, decision, runId);
-			ctx.onRunRegistered = holdRunOpen;
-			const result = await dispatchMatchedWorkflow(ctx);
-			jobIds.push(...result.dispatchedJobIds);
-			deferredJobCount += result.deferredJobCount ?? 0;
-			if (result.envWarnings?.length) warnings.push(...result.envWarnings);
-		}
-	} finally {
-		if (runHeld) await deps.executionTracker?.releasePendingJobsHold(runId);
-	}
+	const runs = [];
+	for (const planned of plan) {
+		const dispatched = await dispatchPlannedRun(shared, deps, planned);
+		jobIds.push(...dispatched.jobIds);
+		deferredJobCount += dispatched.deferredJobCount;
+		warnings.push(...dispatched.warnings);
+		if (planned.decisions.length === 1) runs.push({
+			runId: planned.runId,
+			workflowName: planned.decisions[0].workflowName,
+			jobIds: dispatched.jobIds
+		});
+	}
+	const runsField = runs.length === plan.length ? { runs } : {};
 	if (jobIds.length === 0 && deferredJobCount === 0) return {
 		runId,
 		status: "rejected",
 		reason: "No jobs dispatched (all matched workflows had no static jobs or dispatch was rejected)",
-		jobIds: []
+		jobIds: [],
+		...runsField
 	};
 	return {
 		runId,
 		status: "accepted",
 		jobIds,
+		...runsField,
 		...warnings.length > 0 && { warnings }
 	};
 }
@@ -49632,17 +49733,19 @@ async function handleTestTrigger(msg, deps) {
 		checkMode: msg.checkMode,
 		target: msg.target,
 		dispatchInputs: msg.dispatchInputs,
+		...msg.acceptsMultipleRuns && { acceptsMultipleRuns: true },
 		requestId: msg.requestId,
 		actor: msg.actor
 	}, deps);
-	runDetached(logger$93, "Access log write", () => deps.accessLog?.record({
+	const runIds = result.runs?.length ? result.runs.map((r) => r.runId) : [result.runId];
+	for (const runId of runIds) runDetached(logger$93, "Access log write", () => deps.accessLog?.record({
 		orgId: deps.orgId ?? null,
 		routingKey: deps.routingKey ?? msg.routingKey,
 		actor: msg.actor,
 		action: "run.trigger",
 		target: {
 			type: "run",
-			id: result.runId
+			id: runId
 		},
 		requestId: msg.requestId,
 		source: deps.accessLogSource ?? AccessLogSource.enum.platform_proxy,
@@ -49650,10 +49753,11 @@ async function handleTestTrigger(msg, deps) {
 		...result.reason ? { errorMessage: result.reason } : {}
 	}), {
 		requestId: msg.requestId,
-		runId: result.runId
+		runId
 	});
 	return {
 		runId: result.runId,
+		...result.runs && { runs: result.runs },
 		status: result.status,
 		...result.reason ? { reason: result.reason } : {},
 		jobIds: result.jobIds,
@@ -49688,7 +49792,8 @@ async function handleTestRunStatus(msg, deps) {
 	const run = await deps.db.selectFrom("execution_runs").select([
 		"run_id",
 		"status",
-		"is_test_run"
+		"is_test_run",
+		"failure_reason"
 	]).where("run_id", "=", msg.runId).executeTakeFirst();
 	if (!run || !run.is_test_run) return { error: "Run not found" };
 	const jobs = await deps.db.selectFrom("execution_jobs").select([
@@ -49708,6 +49813,7 @@ async function handleTestRunStatus(msg, deps) {
 			errorMessage: j.error_message ?? null,
 			durationMs: j.duration_ms ?? null
 		})),
+		failureReason: run.failure_reason ?? null,
 		done: TERMINAL_RUN_STATES.has(run.status)
 	};
 }
@@ -49784,14 +49890,18 @@ async function collectRunLogLines(runId, logStorage) {
 async function readFromFileOffsets(runId, logStorage, offsets, terminal) {
 	const next = { ...offsets };
 	const lines = [];
+	const lineJobNames = [];
 	if (logStorage) for (const file of await listRunLogFiles(runId, logStorage)) {
 		const fileLines = splitLogLines((await logStorage.read(file.path)).data, terminal);
 		const from = Math.min(offsets[file.key] ?? 0, fileLines.length);
-		lines.push(...fileLines.slice(from));
+		const fresh = fileLines.slice(from);
+		lines.push(...fresh);
+		for (let i = 0; i < fresh.length; i++) lineJobNames.push(file.jobName);
 		next[file.key] = Math.max(offsets[file.key] ?? 0, fileLines.length);
 	}
 	return {
 		lines,
+		lineJobNames,
 		nextCursor: Object.values(next).reduce((sum, n) => sum + n, 0),
 		done: terminal,
 		nextLogCursor: encodeRunLogCursor(next)
@@ -52270,26 +52380,47 @@ var init_admin_registrations = __esmMin((() => {
 *
 * Sorting `execution_steps` by `step_index` alone puts a pseudo-step where its index landed,
 * not where it ran. That suits the cache pseudo-steps (indices above the real steps, mostly
-* bracketing the work), but a job's image build runs strictly FIRST.
+* bracketing the work), but a job's image build and its init commands run strictly FIRST.
 *
 * The index cannot express this: `step.status` rejects a negative index (an agent sending one
 * to an older orchestrator is disconnected mid-job), and the check-run reporter
 * (`steps[stepIndex]`) and the dashboard (log fetching gated on `stepIndex >= 0`) treat a
-* negative index as absent. So the ordering is expressed by TYPE, here, once.
+* negative index as absent. So the ordering is expressed by TYPE, as the engine's
+* `StepPhase`, here, once.
 */
 /**
-* Sort key placing setup pseudo-steps (run before the job's real steps) first. Apply BEFORE
-* the `step_index` sort:
+* Sort key placing steps by `StepPhase`: setup pseudo-steps, then init commands, then the
+* job's steps. Apply BEFORE the `step_index` sort:
 *
 * ```ts
 * qb.orderBy(setupStepsFirst()).orderBy('step_index', 'asc')
 * ```
 *
 * Untyped steps and every real step share one key, so `step_index` alone orders each group.
+* The init pattern matches `initStepIndex`: the prefix followed by digits only.
 */
 function setupStepsFirst() {
 	const setupTypes = SetupStepType.options;
-	return sql`case when step_type in (${sql.join(setupTypes.map((t) => sql.lit(t)))}) then 0 else 1 end`;
+	const initPattern = `^${INIT_STEP_TYPE_PREFIX}[0-9]+$`;
+	return sql`case when step_type in (${sql.join(setupTypes.map((t) => sql.lit(t)))}) then ${sql.lit(StepPhase.options.indexOf(StepPhase.enum.setup))} when step_type ~ ${sql.lit(initPattern)} then ${sql.lit(StepPhase.options.indexOf(StepPhase.enum.init))} else ${sql.lit(StepPhase.options.indexOf(StepPhase.enum.steps))} end`;
+}
+/** In-memory equivalent over DB rows, kept beside the SQL so the two agree on the phases. */
+function compareStepsForDisplay(a, b) {
+	return compareStepsByPhase({
+		stepType: a.step_type,
+		stepIndex: a.step_index
+	}, {
+		stepType: b.step_type,
+		stepIndex: b.step_index
+	});
+}
+/** {@link compareStepsForDisplay} over untyped rows, such as cold-store rows read back from S3. */
+function compareStepRowsForDisplay(a, b) {
+	const typed = (r) => ({
+		step_type: typeof r.step_type === "string" ? r.step_type : null,
+		step_index: Number(r.step_index ?? 0)
+	});
+	return compareStepsForDisplay(typed(a), typed(b));
 }
 var init_step_display_order = __esmMin((() => {}));
 //#endregion
@@ -52792,6 +52923,19 @@ function parseCountFlag(raw) {
 function spansWorkflow(workflowName) {
 	return (eb) => eb.or([eb("execution_runs.workflow_name", "=", workflowName), eb.exists(eb.selectFrom("execution_jobs").select("execution_jobs.job_id").whereRef("execution_jobs.run_id", "=", "execution_runs.run_id").where("execution_jobs.workflow_name", "=", workflowName))]);
 }
+/**
+* `?runIdPrefix=`: the run ids that start with the given characters, as a UUID range
+* the primary-key index answers. A full run id is its own one-id range.
+*/
+function parseRunIdPrefixQuery(raw) {
+	if (raw === void 0 || raw === "") return void 0;
+	const ref = parseRunIdRef(raw);
+	if (ref.kind === "invalid") return { error: `Invalid "runIdPrefix" '${raw}': ${ref.reason}` };
+	return ref.kind === "uuid" ? {
+		low: ref.runId,
+		high: ref.runId
+	} : runIdPrefixRange(ref.hex);
+}
 /** Run routes, mounted at /api/v1/admin/runs. */
 function createAdminRunRoutes(deps) {
 	const app = createAdminApp(logger$85);
@@ -52801,12 +52945,16 @@ function createAdminRunRoutes(deps) {
 	});
 	app.use("/api/v1/admin/runs", authMiddleware);
 	app.use("/api/v1/admin/runs/*", authMiddleware);
+	app.use("/api/v1/admin/runs/:runId", requireFullRunId);
+	app.use("/api/v1/admin/runs/:runId/*", requireFullRunId);
 	app.get("/api/v1/admin/runs", async (c) => {
 		deps.rbac.requirePermission(c.get("role"), "run.read");
 		const statuses = parseStatus(c.req.query("status"));
 		const workflowName = c.req.query("workflowName");
 		const repo = c.req.query("repo");
 		const deliveryId = c.req.query("deliveryId");
+		const runIdPrefix = parseRunIdPrefixQuery(c.req.query("runIdPrefix"));
+		if (runIdPrefix && "error" in runIdPrefix) return c.json({ error: runIdPrefix.error }, 400);
 		const sinceParsed = parseSince(c.req.query("since"));
 		if (!sinceParsed.ok) return c.json({ error: "Invalid \"since\" query parameter: expected ISO-8601 timestamp" }, 400);
 		const since = sinceParsed.value;
@@ -52823,6 +52971,7 @@ function createAdminRunRoutes(deps) {
 		if (workflowName) countQuery = countQuery.where(spansWorkflow(workflowName));
 		if (repo) countQuery = countQuery.where("repo_identifier", "=", repo);
 		if (deliveryId) countQuery = countQuery.where("delivery_id", "=", deliveryId);
+		if (runIdPrefix) countQuery = countQuery.where("run_id", ">=", runIdPrefix.low).where("run_id", "<=", runIdPrefix.high);
 		if (since) countQuery = countQuery.where("created_at", ">", since);
 		if (tokenRoutingKey) countQuery = countQuery.where("routing_key", "=", tokenRoutingKey);
 		if (countOnly) {
@@ -52858,6 +53007,7 @@ function createAdminRunRoutes(deps) {
 		if (workflowName) query = query.where(spansWorkflow(workflowName));
 		if (repo) query = query.where("repo_identifier", "=", repo);
 		if (deliveryId) query = query.where("delivery_id", "=", deliveryId);
+		if (runIdPrefix) query = query.where("run_id", ">=", runIdPrefix.low).where("run_id", "<=", runIdPrefix.high);
 		if (since) query = query.where("created_at", ">", since);
 		if (tokenRoutingKey) query = query.where("routing_key", "=", tokenRoutingKey);
 		const [runs, countResult] = await Promise.all([query.orderBy("created_at", "desc").limit(limit).offset(offset).execute(), countQuery.executeTakeFirstOrThrow()]);
@@ -52889,7 +53039,7 @@ function createAdminRunRoutes(deps) {
 	});
 	app.get("/api/v1/admin/runs/:runId", async (c) => {
 		deps.rbac.requirePermission(c.get("role"), "run.read");
-		const runId = c.req.param("runId");
+		const runId = c.req.param("runId").toLowerCase();
 		const run = await deps.db.selectFrom("execution_runs").select([
 			"run_id",
 			"workflow_name",
@@ -52953,7 +53103,7 @@ function createAdminRunRoutes(deps) {
 	});
 	app.get("/api/v1/admin/runs/:runId/jobs", async (c) => {
 		deps.rbac.requirePermission(c.get("role"), "run.read");
-		const runId = c.req.param("runId");
+		const runId = c.req.param("runId").toLowerCase();
 		const includeSteps = parseCountFlag(c.req.query("includeSteps"));
 		const runExists = await deps.db.selectFrom("execution_runs").select([
 			"run_id",
@@ -53005,6 +53155,7 @@ function createAdminRunRoutes(deps) {
 					jobSteps = [];
 					stepsByJob.set(step.job_id, jobSteps);
 				}
+				const initIndex = initStepIndex(step.step_type);
 				jobSteps.push({
 					stepIndex: step.step_index,
 					stepName: step.step_name,
@@ -53014,7 +53165,9 @@ function createAdminRunRoutes(deps) {
 					durationMs: step.duration_ms,
 					exitCode: step.exit_code,
 					errorMessage: step.error_message,
-					stepType: step.step_type
+					stepType: step.step_type,
+					phase: stepPhase(step.step_type),
+					...initIndex !== void 0 && { initIndex }
 				});
 			}
 		}
@@ -53041,7 +53194,7 @@ function createAdminRunRoutes(deps) {
 	});
 	app.get("/api/v1/admin/runs/:runId/structured", async (c) => {
 		deps.rbac.requirePermission(c.get("role"), "run.read");
-		const runId = c.req.param("runId");
+		const runId = c.req.param("runId").toLowerCase();
 		const detail = await aggregateRunDetail(deps.db, runId);
 		if (!detail) return c.json({ error: `Run ${runId} not found` }, 404);
 		const denied = enforceRoutingKeyScope(c, detail.routingKey);
@@ -53050,7 +53203,7 @@ function createAdminRunRoutes(deps) {
 	});
 	app.get("/api/v1/admin/runs/:runId/jobs/:jobId/steps/:stepIndex/logs", async (c) => {
 		deps.rbac.requirePermission(c.get("role"), "run.read");
-		const runId = c.req.param("runId");
+		const runId = c.req.param("runId").toLowerCase();
 		const jobId = c.req.param("jobId");
 		const stepIndex = parseInt(c.req.param("stepIndex"), 10);
 		if (Number.isNaN(stepIndex)) return c.json({ error: "Invalid stepIndex" }, 400);
@@ -53076,7 +53229,7 @@ function createAdminRunRoutes(deps) {
 	});
 	app.get("/api/v1/admin/runs/:runId/ephemeral-key", async (c) => {
 		deps.rbac.requirePermission(c.get("role"), "run.read");
-		const runId = c.req.param("runId");
+		const runId = c.req.param("runId").toLowerCase();
 		const runExists = await deps.db.selectFrom("execution_runs").select(["run_id", "routing_key"]).where("run_id", "=", runId).executeTakeFirst();
 		if (!runExists) return c.json({ error: `Run ${runId} not found` }, 404);
 		const denied = enforceRoutingKeyScope(c, runExists.routing_key);
@@ -53094,7 +53247,7 @@ function createAdminRunRoutes(deps) {
 	app.get("/api/v1/admin/runs/:runId/secret-outputs", async (c) => {
 		const role = c.get("role");
 		deps.rbac.requirePermission(role, "run.read");
-		const runId = c.req.param("runId");
+		const runId = c.req.param("runId").toLowerCase();
 		const outputKeyFilter = c.req.query("outputKey");
 		const reveal = parseCountFlag(c.req.query("reveal"));
 		if (reveal) {
@@ -53165,7 +53318,7 @@ function createAdminRunRoutes(deps) {
 	});
 	return app;
 }
-var logger$85, RUN_STATUSES;
+var logger$85, RUN_STATUSES, requireFullRunId;
 var init_admin_runs = __esmMin((() => {
 	init_step_display_order();
 	init_secret_output_crypto();
@@ -53179,6 +53332,11 @@ var init_admin_runs = __esmMin((() => {
 	init_admin_env();
 	logger$85 = createLogger({ prefix: "admin-runs" });
 	RUN_STATUSES = new Set(CANONICAL_STATUSES);
+	requireFullRunId = async (c, next) => {
+		const runId = c.req.param("runId") ?? "";
+		if (!isRunId(runId)) return c.json({ error: `Invalid run id '${runId}': a run id is a full UUID. List runs (or filter with ?runIdPrefix=) to find it.` }, 400);
+		return next();
+	};
 }));
 //#endregion
 //#region src/cold-store/load-event-log-range.ts
@@ -54276,14 +54434,14 @@ function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => {
 			return {
-				version: "0.20.1",
-				buildDate: "2026-10-17T14:01:06.224Z",
-				sdkVersion: "0.20.1",
+				version: "0.21.0",
+				buildDate: "2026-10-18T02:27:04.078Z",
+				sdkVersion: "0.21.0",
 				sdkBundleHash: "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d",
-				sharedVersion: "0.20.1",
+				sharedVersion: "0.21.0",
 				sharedBundleHash: "23378ace59973f47203be3ff171bb7d5e66702eaa335927b390f94b9771a1f8b",
-				engineVersion: "0.20.1",
-				engineBundleHash: "406208ee50766cd0d4ce3ab1fd5dec4501d5117a74acd294b25736d9bd6e89bd"
+				engineVersion: "0.21.0",
+				engineBundleHash: "d9dfe7c806a7fdbd64da7ef48455a139c1d8db8510964ab79e233efdc3f171ba"
 			};
 		},
 		readinessCheck: deps.db ? async () => {
@@ -54315,7 +54473,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.20.1",
+			orchestratorVersion: "0.21.0",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -59081,6 +59239,7 @@ function createApp(deps) {
 						jobName: deps.executionTracker.getJobName(msg.runId, msg.jobId) ?? msg.jobId,
 						stepIndex: msg.stepIndex,
 						stepName: msg.stepName,
+						stepType: stepTypeOf(msg.data),
 						state: msg.state,
 						durationMs: msg.data?.durationMs ?? void 0,
 						installationId: execContext.installationId,
@@ -59303,7 +59462,7 @@ function createApp(deps) {
 	app.use("*", (c, next) => c.req.path.startsWith("/api/v1/cache/blob/") ? next() : webhookBodyLimit(c, next));
 	if (deps.fsCache) registerBlobRoutes(app, deps.fsCache);
 	app.post("/api/v1/admin/runs/:runId/cancel", async (c) => {
-		const runId = c.req.param("runId");
+		const runId = c.req.param("runId").toLowerCase();
 		if (!runId) return c.json({ error: "Missing runId" }, 400);
 		if (!deps.adminDeps) return c.json({ error: "Admin API not available" }, 503);
 		const auth = await resolveBearerAuth(c, {
@@ -59338,6 +59497,11 @@ function createApp(deps) {
 			recordAccess("denied", `role "${tokenInfo.role}" lacks run.cancel`);
 			return c.json({ error: "Permission denied: run.cancel required" }, 403);
 		}
+		if (!isRunId(runId)) {
+			const error = `Invalid run id '${runId}': a run id is a full UUID.`;
+			recordAccess("allowed", error);
+			return c.json({ error }, 400);
+		}
 		try {
 			let force = false;
 			try {
@@ -59811,7 +59975,7 @@ var init_app = __esmMin((() => {
 	init_agent_metrics_aggregator();
 	init_run_detached();
 	logger$66 = createLogger({ prefix: "app" });
-	ORCHESTRATOR_VERSION$2 = "0.20.1";
+	ORCHESTRATOR_VERSION$2 = "0.21.0";
 	SourceLocationStore = class {
 		cache = /* @__PURE__ */ new Map();
 		key(workflowName, jobName) {
@@ -68902,7 +69066,7 @@ var init_peer_client = __esmMin((() => {
 		PeerDialOrigin["Discovered"] = "discovered";
 		return PeerDialOrigin;
 	}({});
-	SOFTWARE_VERSION$1 = "0.20.1";
+	SOFTWARE_VERSION$1 = "0.21.0";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -71373,7 +71537,7 @@ var init_peer_handler = __esmMin((() => {
 	init_join_token();
 	init_run_detached();
 	logger$46 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.20.1";
+	SOFTWARE_VERSION = "0.21.0";
 	ADVERTISED_PEER_AUTH_SCHEMES = [PeerAuthScheme.enum["mutual-v2"]];
 	MAX_TOKEN_CANDIDATES = 8;
 	RATE_LIMIT_MAX = 5;
@@ -87804,7 +87968,8 @@ async function recordInitFailureFromSkip(args) {
 		},
 		triggerEvent: dispatchTriggerEvent(ctx),
 		commitMessage: extractCommitMessage(setup.info.event, setup.info.payload),
-		...preDispatchRunProvenance(ctx)
+		...preDispatchRunProvenance(ctx),
+		...ctx.testRun && { testRun: ctx.testRun }
 	});
 	await completeChecksForUndispatchedRun({
 		ctx,
@@ -87855,7 +88020,8 @@ async function holdWorkflowForInstallGate(args) {
 		commitMessage: extractCommitMessage(setup.info.event, setup.info.payload),
 		workflowSha: ctx.global?.workflowSha ?? null,
 		workflowBranch: ctx.global?.workflowBranch ?? null,
-		...preDispatchRunProvenance(ctx)
+		...preDispatchRunProvenance(ctx),
+		...ctx.testRun && { testRun: ctx.testRun }
 	});
 	if (deps.heldRunStore) await deps.heldRunStore.createHold(ctx.resolvedOrgId, {
 		runId,
@@ -87931,7 +88097,8 @@ async function holdRunForSecurityPolicy(args) {
 		prNumber: event.prNumber ?? null,
 		workflowSha: ctx.global?.workflowSha ?? null,
 		workflowBranch: ctx.global?.workflowBranch ?? null,
-		...preDispatchRunProvenance(ctx)
+		...preDispatchRunProvenance(ctx),
+		...ctx.testRun && { testRun: ctx.testRun }
 	});
 	let heldRow;
 	if (deps.heldRunStore) {
@@ -95022,7 +95189,7 @@ var init_handler = __esmMin((() => {
 				outputs: typeof r.outputs === "string" ? r.outputs : null,
 				init_failure: r.init_failure ?? null
 			}));
-			stepRows.sort((a, b) => Number(a.step_index ?? 0) - Number(b.step_index ?? 0));
+			stepRows.sort(compareStepRowsForDisplay);
 			out.steps = stepRows.map((r) => ({
 				job_id: String(r.job_id ?? ""),
 				step_index: Number(r.step_index ?? 0),
@@ -100577,13 +100744,13 @@ var init_worker_core = __esmMin((() => {
 	init_app_on_error();
 	init_run_detached();
 	init_peer_job_cancel();
-	ORCHESTRATOR_VERSION$1 = "0.20.1";
-	WORKER_SDK_VERSION = "0.20.1";
+	ORCHESTRATOR_VERSION$1 = "0.21.0";
+	WORKER_SDK_VERSION = "0.21.0";
 	WORKER_SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
-	WORKER_SHARED_VERSION = "0.20.1";
+	WORKER_SHARED_VERSION = "0.21.0";
 	WORKER_SHARED_BUNDLE_HASH = "23378ace59973f47203be3ff171bb7d5e66702eaa335927b390f94b9771a1f8b";
-	WORKER_ENGINE_VERSION = "0.20.1";
-	WORKER_ENGINE_BUNDLE_HASH = "406208ee50766cd0d4ce3ab1fd5dec4501d5117a74acd294b25736d9bd6e89bd";
+	WORKER_ENGINE_VERSION = "0.21.0";
+	WORKER_ENGINE_BUNDLE_HASH = "d9dfe7c806a7fdbd64da7ef48455a139c1d8db8510964ab79e233efdc3f171ba";
 	logger$2 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
 }));
@@ -100610,13 +100777,13 @@ init_run_detached();
 init_dashboard_access();
 init_peer_job_cancel();
 init_orphan_requests();
-const ORCHESTRATOR_VERSION = "0.20.1";
-const SDK_VERSION = "0.20.1";
+const ORCHESTRATOR_VERSION = "0.21.0";
+const SDK_VERSION = "0.21.0";
 const SDK_BUNDLE_HASH = "b012bd8bace3df9e574252bf290c652bc39766da617acf51729a08586756266d";
-const SHARED_VERSION = "0.20.1";
+const SHARED_VERSION = "0.21.0";
 const SHARED_BUNDLE_HASH = "23378ace59973f47203be3ff171bb7d5e66702eaa335927b390f94b9771a1f8b";
-const ENGINE_VERSION = "0.20.1";
-const ENGINE_BUNDLE_HASH = "406208ee50766cd0d4ce3ab1fd5dec4501d5117a74acd294b25736d9bd6e89bd";
+const ENGINE_VERSION = "0.21.0";
+const ENGINE_BUNDLE_HASH = "d9dfe7c806a7fdbd64da7ef48455a139c1d8db8510964ab79e233efdc3f171ba";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT