@kici-dev/orchestrator 0.4.0 → 0.6.0

package/dist/index.js

@@ -11,7 +11,7 @@ import { chmod, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
 import { Kysely, PostgresDialect, sql } from "kysely";
 import pg from "pg";
 import { z } from "zod";
-import { DEFAULT_APPROVAL_EXPIRY_HOURS, HoldScope, HoldType, TriggerSource, persistedHoldTypeSpellings } from "@kici-dev/engine";
+import { DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, ForkPolicy, HoldScope, HoldType, TriggerSource, approvalExpiryHoursOf, approvalExpirySecondsOf, persistedHoldTypeSpellings } from "@kici-dev/engine";
 import { platform, tmpdir } from "node:os";
 import { createInterface } from "node:readline";
 import { Octokit } from "@octokit/rest";
@@ -302,7 +302,7 @@ var S3CacheStorage = class {
 * restart — fine for the filesystem backend's E2E / single-host use case.
 */
 /** Default URL lifetime: 1 hour (matches S3 backend's PUT-URL lifetime). */
-const DEFAULT_SIGN_URL_TTL_MS = 3600 * 1e3;
+const DEFAULT_SIGN_URL_TTL_MS = 36e5;
 function computeSig(secret, method, key, expiresMs) {
 	const hmac = createHmac("sha256", secret);
 	hmac.update(`${method}:${key}:${expiresMs}`);
@@ -668,11 +668,13 @@ var SourceCache = class {
 /**
 * Dependency-specific cache layer wrapping CacheStorage.
 *
-* Stores and retrieves dependency tarballs keyed by lockfileHash + platform + arch.
-* Shared CacheStorage backend with SourceCache (same S3 bucket).
-* Refreshes TTL on reads (touch-on-read).
+* Stores dependency tarballs under their own content hash, with a small pointer
+* resolving lockfileHash + platform + arch to that hash. Shared CacheStorage
+* backend with SourceCache (same S3 bucket). Refreshes TTL on reads
+* (touch-on-read).
 *
-* Cache key format: deps/{platform}-{arch}/{lockfileHash}.tar.gz
+* Keys: `deps/{platform}-{arch}/{depsHash}.tar.gz` (immutable) and
+* `deps/{platform}-{arch}/{lockfileHash}.hash` (the pointer).
 */
 const logger$2 = createLogger({ prefix: "dep-cache" });
 /** Default max tarball size: 500MB */
@@ -680,11 +682,35 @@ const DEFAULT_MAX_TARBALL_BYTES = 524288e3;
 /** Default dependency-cache entry TTL: 30 days. */
 const DEFAULT_CACHE_TTL_DAYS = 30;
 const MS_PER_DAY = 864e5;
-/** Build cache key for dependency tarball: deps/{platform}-{arch}/{lockfileHash}.tar.gz */
-function depKey(lockfileHash, platform, arch) {
-	return `deps/${platform}-${arch}/${lockfileHash}.tar.gz`;
+/**
+* Cache key for a dependency tarball, addressed by the tarball's OWN content
+* hash: `deps/{platform}-{arch}/{depsHash}.tar.gz`.
+*
+* Content-addressing is what makes a mismatched pair unrepresentable. When the
+* tarball lived at a lockfile-derived name, it and its companion `.hash` were
+* two independently-written objects under keys that any two builds sharing a
+* lockfile + platform + arch also share — so concurrent builders could leave the
+* `.tar.gz` from one and the `.hash` from the other, and the reader failed
+* verification durably. Naming the object by its own hash means every pair a
+* reader can observe is self-consistent, and the bytes at a given key can never
+* change after a URL is signed for it.
+*/
+function depTarballKey(depsHash, platform, arch) {
+	return `deps/${platform}-${arch}/${depsHash}.tar.gz`;
 }
-var DepCache = class {
+/**
+* Cache key for the pointer that resolves a lockfile to the content hash of the
+* tarball built from it: `deps/{platform}-{arch}/{lockfileHash}.hash`.
+*
+* This is the one mutable object in the scheme. A concurrent write replaces a
+* pointer wholesale — there is no window in which it is half-written — so the
+* worst a racing pair of builders can do is leave whichever pointer landed last,
+* and both tarballs remain valid and fetchable.
+*/
+function depPointerKey(lockfileHash, platform, arch) {
+	return `deps/${platform}-${arch}/${lockfileHash}.hash`;
+}
+var DepCache = class DepCache {
 	storage;
 	maxTarballBytes;
 	cacheTtlDaysFallback;
@@ -706,10 +732,30 @@ var DepCache = class {
 		if (!this.clusterSettings) return void 0;
 		return await this.clusterSettings.getNumber("cache_ttl_days", this.cacheTtlDaysFallback) * MS_PER_DAY;
 	}
-	/** Check if a dep tarball exists in cache. */
+	/**
+	* Resolve a lockfile to the content hash of the tarball built from it, or
+	* null when no pointer exists. The single place the indirection is read.
+	*/
+	async resolvePointer(lockfileHash, platform, arch, ttlMsOverride) {
+		return (await this.storage.get(depPointerKey(lockfileHash, platform, arch), ttlMsOverride))?.toString("utf-8").trim() || null;
+	}
+	/**
+	* Check if a dep tarball exists in cache.
+	*
+	* Both halves must be present: a pointer whose tarball has aged out is a miss,
+	* not a hit, or the caller skips a rebuild and dispatches a URL that 404s.
+	*/
 	async has(lockfileHash, platform, arch) {
-		const key = depKey(lockfileHash, platform, arch);
-		const exists = await this.storage.has(key, await this.resolveTtlMsOverride());
+		const ttlMsOverride = await this.resolveTtlMsOverride();
+		const depsHash = await this.resolvePointer(lockfileHash, platform, arch, ttlMsOverride);
+		if (!depsHash) {
+			logger$2.debug(`has(${lockfileHash}): false (no pointer)`, {
+				platform,
+				arch
+			});
+			return false;
+		}
+		const exists = await this.storage.has(depTarballKey(depsHash, platform, arch), ttlMsOverride);
 		logger$2.debug(`has(${lockfileHash}): ${exists}`, {
 			platform,
 			arch
@@ -721,42 +767,40 @@ var DepCache = class {
 	* Refreshes TTL on hit.
 	*/
 	async getUrl(lockfileHash, platform, arch) {
-		const key = depKey(lockfileHash, platform, arch);
-		const url = await this.storage.getUrl(key, await this.resolveTtlMsOverride());
-		if (url) {
-			await this.storage.touch(key);
-			logger$2.debug(`getUrl(${lockfileHash}): hit`, {
-				platform,
-				arch
-			});
-		} else logger$2.debug(`getUrl(${lockfileHash}): miss`, {
-			platform,
-			arch
-		});
-		return url;
+		return (await this.getUrlAndHash(lockfileHash, platform, arch))?.url ?? null;
 	}
 	/**
-	* Get a pre-signed download URL and the tarball content hash (if available).
-	* Returns null on cache miss. Hash may be undefined for old entries stored
-	* before integrity tracking was added.
+	* Get a pre-signed download URL and the tarball content hash.
+	*
+	* Returns null on cache miss — including an entry with no pointer, which is
+	* unverifiable and so is deliberately not served.
 	*/
 	async getUrlAndHash(lockfileHash, platform, arch) {
-		const key = depKey(lockfileHash, platform, arch);
-		const url = await this.storage.getUrl(key, await this.resolveTtlMsOverride());
+		const ttlMsOverride = await this.resolveTtlMsOverride();
+		const pointerKey = depPointerKey(lockfileHash, platform, arch);
+		const hash = (await this.storage.get(pointerKey, ttlMsOverride))?.toString("utf-8").trim() || void 0;
+		if (!hash) {
+			logger$2.debug(`getUrlAndHash(${lockfileHash}): miss (no pointer)`, {
+				platform,
+				arch
+			});
+			return null;
+		}
+		const key = depTarballKey(hash, platform, arch);
+		const url = await this.storage.getUrl(key, ttlMsOverride);
 		if (!url) {
-			logger$2.debug(`getUrlAndHash(${lockfileHash}): miss`, {
+			logger$2.debug(`getUrlAndHash(${lockfileHash}): miss (dangling pointer)`, {
 				platform,
 				arch
 			});
 			return null;
 		}
 		await this.storage.touch(key);
-		const hashKey = `deps/${platform}-${arch}/${lockfileHash}.hash`;
-		const hash = (await this.storage.get(hashKey))?.toString("utf-8") || void 0;
+		await this.storage.touch(pointerKey);
 		logger$2.debug(`getUrlAndHash(${lockfileHash}): hit`, {
 			platform,
 			arch,
-			hasHash: !!hash
+			hasHash: true
 		});
 		return {
 			url,
@@ -766,9 +810,21 @@ var DepCache = class {
 	/**
 	* Get a pre-signed upload URL for direct agent-to-S3 upload.
 	*/
-	async getUploadUrl(lockfileHash, platform, arch) {
-		const key = depKey(lockfileHash, platform, arch);
-		return this.storage.getUploadUrl(key);
+	async getUploadUrl(depsHash, platform, arch) {
+		return this.storage.getUploadUrl(depTarballKey(depsHash, platform, arch));
+	}
+	/**
+	* Publish the pointer that makes an uploaded tarball discoverable by lockfile.
+	*
+	* Called only after the agent confirms its upload completed. Publishing before
+	* the bytes land would let a reader follow the pointer to a missing object.
+	*/
+	async publishPointer(lockfileHash, platform, arch, depsHash) {
+		await this.storage.put(depPointerKey(lockfileHash, platform, arch), depsHash);
+		logger$2.info(`publishPointer(${lockfileHash}) -> ${depsHash.slice(0, 12)}`, {
+			platform,
+			arch
+		});
 	}
 	/**
 	* Store a dep tarball in cache.
@@ -777,12 +833,14 @@ var DepCache = class {
 	async store(lockfileHash, platform, arch, tarballData) {
 		const maxTarballBytes = this.clusterSettings ? await this.clusterSettings.getNumber("cache_max_tarball_bytes", this.maxTarballBytes) : this.maxTarballBytes;
 		if (tarballData.length > maxTarballBytes) throw new Error(`Dep tarball exceeds max size: ${tarballData.length} bytes > ${maxTarballBytes} bytes limit`);
-		const key = depKey(lockfileHash, platform, arch);
-		await this.storage.put(key, tarballData);
+		const depsHash = DepCache.computeHash(tarballData);
+		await this.storage.put(depTarballKey(depsHash, platform, arch), tarballData);
+		await this.storage.put(depPointerKey(lockfileHash, platform, arch), depsHash);
 		logger$2.info(`store: ${tarballData.length} bytes`, {
 			lockfileHash,
 			platform,
-			arch
+			arch,
+			depsHash: depsHash.slice(0, 12)
 		});
 	}
 	/**
@@ -792,10 +850,11 @@ var DepCache = class {
 	static computeHash(data) {
 		return sha256(data);
 	}
-	/** Remove a dep tarball from cache. */
+	/** Remove a dep tarball and its pointer from cache. */
 	async remove(lockfileHash, platform, arch) {
-		const key = depKey(lockfileHash, platform, arch);
-		const removed = await this.storage.delete(key);
+		const depsHash = await this.resolvePointer(lockfileHash, platform, arch, await this.resolveTtlMsOverride());
+		await this.storage.delete(depPointerKey(lockfileHash, platform, arch));
+		const removed = depsHash ? await this.storage.delete(depTarballKey(depsHash, platform, arch)) : false;
 		logger$2.info(`remove(${lockfileHash}): ${removed ? "removed" : "not found"}`, {
 			platform,
 			arch
@@ -846,13 +905,13 @@ const logger$1 = createLogger({ prefix: "user-cache" });
 * per-org override in `org_settings.user_cache_quota_bytes`. The cluster-wide
 * value is itself operator-configurable via KICI_USER_CACHE_QUOTA_BYTES.
 */
-const DEFAULT_USER_CACHE_QUOTA_BYTES = 5 * 1024 * 1024 * 1024;
+const DEFAULT_USER_CACHE_QUOTA_BYTES = 5368709120;
 /**
 * Cluster-wide default entry TTL: 7 days. Fallback when an org has no per-org
 * override in `org_settings.user_cache_ttl_ms`. The cluster-wide value is
 * operator-configurable via KICI_USER_CACHE_TTL_MS.
 */
-const DEFAULT_USER_CACHE_TTL_MS = 10080 * 60 * 1e3;
+const DEFAULT_USER_CACHE_TTL_MS = 6048e5;
 /** Tarball suffix for committed cache entries. */
 const TAR_SUFFIX = ".tar.gz";
 /** Matches a stem ending in the fixed-width discriminator this module appends. */
@@ -1280,11 +1339,13 @@ function mapRow(row) {
 * @param data - Credential data to persist
 */
 async function writeCredentialFile(filePath, data) {
-	await mkdir(dirname(filePath), {
+	const dir = dirname(filePath);
+	await mkdir(dir, {
 		recursive: true,
 		mode: 448
 	});
-	await writeFile(filePath, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
+	const json = JSON.stringify(data, null, 2) + "\n";
+	await writeFile(filePath, json, { mode: 384 });
 	await chmod(filePath, 384);
 }
 /**
@@ -1312,10 +1373,11 @@ async function readCredentialFile(filePath) {
 * shared with the orchestrator.
 */
 async function createPeerCredentialStoreFromUrl(databaseUrl, opts) {
-	const db = new Kysely({ dialect: new PostgresDialect({ pool: new pg.Pool({
+	const pool = new pg.Pool({
 		connectionString: databaseUrl,
 		max: opts?.maxConnections ?? 3
-	}) }) });
+	});
+	const db = new Kysely({ dialect: new PostgresDialect({ pool }) });
 	return {
 		store: new PeerCredentialStore(db),
 		dispose: async () => {
@@ -1586,10 +1648,11 @@ var JoinTokenManager = class {
 * the real cluster DB.
 */
 function createJoinTokenManagerFromUrl(databaseUrl, opts) {
-	const db = new Kysely({ dialect: new PostgresDialect({ pool: new pg.Pool({
+	const pool = new pg.Pool({
 		connectionString: databaseUrl,
 		max: opts?.maxConnections ?? 3
-	}) }) });
+	});
+	const db = new Kysely({ dialect: new PostgresDialect({ pool }) });
 	return {
 		manager: new JoinTokenManager({ db }),
 		dispose: async () => {
@@ -1626,7 +1689,25 @@ function deriveKeys(secret) {
 }
 /**
 * Reason a run was held in the security queue. Persisted verbatim in
-* `held_runs.reason` and switched on by `buildSecurityHoldSummary`.
+* `held_runs.reason` and whose vocabulary `buildSecurityHoldSummary` switches
+* on.
+*
+* Each value names why a run sits in the queue. The enum stays whole because
+* compiling code still names all four: `buildSecurityHoldSummary` renders one
+* branch per value. Dropping a member breaks that, and breaks the parity test
+* that pins `SECURITY_HOLD_JOB_IDS`' three policy-reason keys to this enum's
+* options — the engine constant cannot import the enum, so that coupling lives
+* only in the orchestrator's test. Nothing validates `held_runs.reason` against
+* this enum, so a stored value is not rejected anywhere.
+*
+* - `fork_pr` — the org trust policy's fork switch held the run.
+* - `context_trust` — a context's minimum-trust gate held the run.
+* - `workflow_modification` — deprecated; no longer raised. Modifications to
+*   `.kici/` are surfaced on their own informational check and no longer feed
+*   a policy arm. Removed at v1.0.0.
+* - `unknown_contributor` — deprecated; no longer raised. The policy turns on
+*   whether the pull request came from a fork, not on who opened it. Removed
+*   at v1.0.0.
 */
 const SecurityHoldReason = z.enum([
 	"workflow_modification",
@@ -1640,9 +1721,19 @@ var HeldRunStore = class {
 	constructor(db) {
 		this.db = db;
 	}
-	/** Create a new held run with pending status. */
-	async create(orgId, data) {
-		return this.db.insertInto("held_runs").values({
+	/**
+	* Create a new held run with pending status.
+	*
+	* `exec` is the executor the INSERT runs through, defaulting to the store's
+	* own connection. A caller that writes something the row cannot exist without
+	* — the job's pending dispatch context, without which the hold can never be
+	* resumed — passes its enclosing transaction, so the two land or roll back
+	* together. Handed in rather than taken from an ambient scope: Kysely has no
+	* such scope, so a `this.db` insert inside a `db.transaction()` callback runs
+	* on a different connection and commits on its own.
+	*/
+	async create(orgId, data, exec = this.db) {
+		return exec.insertInto("held_runs").values({
 			org_id: orgId,
 			run_id: data.runId,
 			job_id: data.jobId,
@@ -1650,16 +1741,21 @@ var HeldRunStore = class {
 			hold_type: data.holdType,
 			queue_type: data.queueType ?? "context",
 			reason: data.reason,
-			expires_at: data.expiresAt
+			expires_at: data.expiresAt,
+			posted_pending_check: false,
+			...data.scope !== void 0 && { hold_scope: data.scope },
+			...data.triggerSource !== void 0 && { trigger_source: data.triggerSource }
 		}).returningAll().executeTakeFirstOrThrow();
 	}
 	/**
 	* Create a generalized approval hold (workflow/job/step scope, explicit or
 	* context trigger) carrying a normalized `ApprovalRequirement`. Returns
 	* the created row.
+	*
+	* `exec` carries the same meaning it does on {@link create}.
 	*/
-	async createHold(orgId, data) {
-		return this.db.insertInto("held_runs").values({
+	async createHold(orgId, data, exec = this.db) {
+		return exec.insertInto("held_runs").values({
 			org_id: orgId,
 			run_id: data.runId,
 			job_id: data.jobId,
@@ -1668,6 +1764,7 @@ var HeldRunStore = class {
 			queue_type: data.queueType ?? "context",
 			reason: data.requirement.reason,
 			expires_at: new Date(data.requirement.expiresAt),
+			posted_pending_check: false,
 			hold_scope: data.scope,
 			step_index: data.stepIndex ?? null,
 			trigger_source: data.triggerSource,
@@ -1675,6 +1772,40 @@ var HeldRunStore = class {
 			...data.payload !== void 0 && { payload: JSON.stringify(data.payload) }
 		}).returningAll().executeTakeFirstOrThrow();
 	}
+	/**
+	* Record that the pending `KiCI Security` check reached the provider, for
+	* every hold that gates it, so the settle that ends one knows it has a check
+	* to terminalize.
+	*
+	* Written AFTER the post returns, never before. The two orders fail
+	* differently and the failures are not equivalent: recording first and dying
+	* before the post leaves a row claiming a check the commit does not have, and
+	* the settle then CREATES one — a completed `KiCI Security` run appearing on a
+	* commit nothing ever held. Recording second leaves the opposite residue, a
+	* real pending check the settle declines to close, which is the same stuck
+	* check the fire-and-forget post could already produce. A fabricated failing
+	* check on a pull request is worse than a stuck one, so the write goes last.
+	*
+	* **One statement for all of them, not one per hold.** A commit's check run is
+	* shared by every hold on it, and the settle asks the contention query which
+	* of them still owns it. Marking them in a loop admits a PARTIAL mark: mark
+	* the reviewer hold, fail on the security hold, and the security row keeps
+	* `posted_pending_check: false` — so it is not counted as a contender, and
+	* approving the reviewer hold terminalizes the shared check `success` while
+	* the trust hold still gates the job. That is a fabricated PASSING check,
+	* which is the worse direction, reached without any process dying: a
+	* deadlock, a statement timeout or a lost connection between the two UPDATEs
+	* is enough. A single `WHERE id IN (…)` either marks every hold or none.
+	*
+	* The residual window is therefore one statement issued immediately after the
+	* provider call returns — narrow, and not only reachable by a process death,
+	* which is why the caller logs its failure rather than treating it as
+	* impossible.
+	*/
+	async markPendingCheckPosted(orgId, heldRunIds) {
+		if (heldRunIds.length === 0) return;
+		await this.db.updateTable("held_runs").set({ posted_pending_check: true }).where("id", "in", [...heldRunIds]).where("org_id", "=", orgId).execute();
+	}
 	/** INSERT one decision row using the given executor (root or transaction). */
 	insertDecisionRow(exec, heldRunId, data) {
 		const clausesSatisfied = data.clausesSatisfied != null ? JSON.stringify(data.clausesSatisfied) : null;
@@ -1839,33 +1970,63 @@ var HeldRunStore = class {
 		return this.db.selectFrom("held_runs").selectAll().where("status", "=", "pending").where("expires_at", "<", sql`now()`).execute();
 	}
 	/**
-	* Release overdue workflow timer holds. The install-gate wait action pauses
-	* the workflow as a held run; on timer expiry it must RESUME (not fail like
-	* a reviewer-hold expiry). Flips each overdue pending `hold_type` timer,
-	* `hold_scope='workflow'` row to `released` and returns a `ReleaseSignal`
-	* per row so the caller can resume the workflow. Runs BEFORE
-	* `expireOverdue()` so these rows leave the pending pool before the
-	* expire-and-fail sweep sees them.
+	* Release overdue timer holds at ANY scope. A wait action pauses its element
+	* as a held run; on timer expiry it must RESUME (not fail like a reviewer-hold
+	* expiry). Flips each overdue pending timer row to `released` and returns a
+	* `ReleaseSignal` per row, carrying the row's own scope so the caller can
+	* route it — `routeRelease` sends a workflow-scoped one to the install-gate
+	* rebuild and a job-scoped one to the job re-dispatch path.
 	*
-	* The filter matches every persisted spelling of the timer hold type, so a
-	* row an un-upgraded orchestrator wrote as `wait_timer` still resumes rather
-	* than falling through to the expire-and-fail sweep. `hold_scope` is what
-	* keeps job-scoped dispatch-gate timer holds out of this sweep.
+	* Runs BEFORE `expireOverdue()` so these rows leave the pending pool before
+	* the expire-and-fail sweep sees them. That ordering is load-bearing, not
+	* incidental: `expireOverdue` is not scope-filtered, so a released-but-not-yet-
+	* resumed row would otherwise be expired out from under its resume.
+	*
+	* The filter matches every persisted spelling of the timer hold type, so a row
+	* an un-upgraded orchestrator wrote as `wait_timer` still resumes rather than
+	* falling through to the expire-and-fail sweep. It deliberately does NOT
+	* filter on `hold_scope`: a job-scoped timer hold used to be excluded here,
+	* which left it with no release path at all — created, never released,
+	* eventually expired, its job never dispatched.
 	*/
 	async releaseDueWaitHolds() {
 		return (await this.db.updateTable("held_runs").set({
 			status: "released",
 			resolved_at: sql`now()`
-		}).where("status", "=", "pending").where("hold_type", "in", persistedHoldTypeSpellings(HoldType.enum.timer)).where("hold_scope", "=", HoldScope.enum.workflow).where("expires_at", "<", sql`now()`).returningAll().execute()).map((row) => ({
+		}).where("status", "=", "pending").where("hold_type", "in", persistedHoldTypeSpellings(HoldType.enum.timer)).where("expires_at", "<", sql`now()`).returningAll().execute()).map((row) => ({
 			holdId: row.id,
 			runId: row.run_id,
 			jobId: row.job_id,
-			scope: row.hold_scope ?? HoldScope.enum.workflow,
+			scope: row.hold_scope,
 			stepIndex: row.step_index,
 			triggerSource: row.trigger_source ?? TriggerSource.enum.context
 		}));
 	}
 	/**
+	* Every pending queued (concurrency) hold, with the org and concurrency group
+	* it belongs to — the input to the periodic release sweep, which needs to know
+	* WHICH groups have someone waiting before it looks up any limits.
+	*
+	* Returns the pair rather than full rows: the sweep only groups by it, and
+	* `listQueuedHoldsForContext` fetches the rows it actually releases.
+	*/
+	async listAllQueuedHolds() {
+		return await this.db.selectFrom("held_runs").innerJoin("execution_runs", "execution_runs.run_id", "held_runs.run_id").select(["held_runs.org_id as orgId", "execution_runs.context as concurrencyGroup"]).where("held_runs.status", "=", "pending").where("held_runs.hold_type", "in", persistedHoldTypeSpellings(HoldType.enum.concurrency)).execute();
+	}
+	/**
+	* List the pending queued (concurrency) holds for one context's concurrency
+	* group, oldest first.
+	*
+	* Joined to `execution_runs` and filtered by `customer_id` as well as
+	* `context`: a context NAME is not unique across tenants, so without the org
+	* predicate one org's completing job could release another org's queued hold.
+	* Oldest-first is the release order — a queue that released newest-first would
+	* starve whoever waited longest.
+	*/
+	async listQueuedHoldsForContext(orgId, concurrencyGroup) {
+		return this.db.selectFrom("held_runs").innerJoin("execution_runs", "execution_runs.run_id", "held_runs.run_id").selectAll("held_runs").where("held_runs.org_id", "=", orgId).where("held_runs.status", "=", "pending").where("held_runs.hold_type", "in", persistedHoldTypeSpellings(HoldType.enum.concurrency)).where("execution_runs.context", "=", concurrencyGroup).where("execution_runs.customer_id", "=", orgId).orderBy("held_runs.created_at", "asc").execute();
+	}
+	/**
 	* Expire overdue pending runs. Called by the stale detector.
 	* Sets status to 'expired' and resolved_at to now() for all
 	* pending runs past their expires_at.
@@ -1887,10 +2048,11 @@ var HeldRunStore = class {
 * PR-scoped hold selection against the real deployed orchestrator DB.
 */
 function createHeldRunStoreFromUrl(databaseUrl, opts) {
-	const db = new Kysely({ dialect: new PostgresDialect({ pool: new pg.Pool({
+	const pool = new pg.Pool({
 		connectionString: databaseUrl,
 		max: opts?.maxConnections ?? 3
-	}) }) });
+	});
+	const db = new Kysely({ dialect: new PostgresDialect({ pool }) });
 	return {
 		store: new HeldRunStore(db),
 		dispose: async () => {
@@ -1898,6 +2060,23 @@ function createHeldRunStoreFromUrl(databaseUrl, opts) {
 		}
 	};
 }
+z.enum(["policy", "legacy"]);
+/** The fork switch applied when no policy row is stored. */
+const DEFAULT_FORK_POLICY = ForkPolicy.enum.ignore;
+Object.freeze({
+	forkPolicy: DEFAULT_FORK_POLICY,
+	unknownContributorPolicy: "hold",
+	workflowChangePolicy: "hold",
+	approvalExpiryHours: DEFAULT_APPROVAL_EXPIRY_HOURS,
+	approvalExpirySeconds: DEFAULT_APPROVAL_EXPIRY_SECONDS
+});
+Object.freeze({
+	forkPolicy: ForkPolicy.enum.hold,
+	unknownContributorPolicy: "hold",
+	workflowChangePolicy: "hold",
+	approvalExpiryHours: DEFAULT_APPROVAL_EXPIRY_HOURS,
+	approvalExpirySeconds: DEFAULT_APPROVAL_EXPIRY_SECONDS
+});
 //#endregion
 //#region src/security/trust-policy-store.ts
 /**
@@ -1914,14 +2093,42 @@ const TrustPolicySource = z.enum(["platform", "local"]);
 /**
 * The strictest documented defaults. Used to fill gaps on a local merge; the
 * fail-closed policy an unknown org resolves to lives in `trust-policy-gate.ts`.
+*
+* `forkPolicy` reads that module's `DEFAULT_FORK_POLICY` so a partial local
+* merge and an absent row settle on the same fork switch.
 */
 const DEFAULT_TRUST_POLICY = {
-	forkPolicy: "hold",
+	forkPolicy: DEFAULT_FORK_POLICY,
 	unknownContributorPolicy: "hold",
 	workflowChangePolicy: "hold",
-	approvalExpiryHours: DEFAULT_APPROVAL_EXPIRY_HOURS
+	approvalExpiryHours: DEFAULT_APPROVAL_EXPIRY_HOURS,
+	approvalExpirySeconds: DEFAULT_APPROVAL_EXPIRY_SECONDS
 };
 /**
+* Resolve a local patch's approval-expiry window against what is already stored.
+*
+* One value is being set, spelled two ways, so the pair is merged as a unit and
+* always re-derived from the winning seconds value:
+*
+* - a patch naming `approvalExpirySeconds` sets the window, and the hours field
+*   is recomputed from it — a stale hours value left behind would be the coarse
+*   view of a window that is no longer stored;
+* - a patch naming only `approvalExpiryHours` sets the window too, and the
+*   seconds field is recomputed from it — keeping the old seconds value would
+*   let it out-rank the operator's explicit hours and silently discard the
+*   write;
+* - a patch naming both takes the seconds value, because it is the more
+*   specific of the two (`approvalExpirySecondsOf`);
+* - a patch naming neither leaves the stored window untouched.
+*/
+function mergedExpiry(patch, existing) {
+	const seconds = (patch.approvalExpirySeconds != null || patch.approvalExpiryHours != null ? approvalExpirySecondsOf(patch) : null) ?? existing?.approvalExpirySeconds ?? DEFAULT_TRUST_POLICY.approvalExpirySeconds ?? DEFAULT_APPROVAL_EXPIRY_SECONDS;
+	return {
+		approvalExpiryHours: approvalExpiryHoursOf(seconds),
+		approvalExpirySeconds: seconds
+	};
+}
+/**
 * Namespace for the per-org advisory lock taken by `upsertLocal`, so the key
 * cannot collide with another feature's advisory lock in the same database.
 */
@@ -1940,6 +2147,10 @@ var TrustPolicyStore = class {
 			unknownContributorPolicy: row.unknown_contributor_policy,
 			workflowChangePolicy: row.workflow_change_policy,
 			approvalExpiryHours: Number(row.approval_expiry_hours),
+			approvalExpirySeconds: approvalExpirySecondsOf({
+				approvalExpiryHours: Number(row.approval_expiry_hours),
+				approvalExpirySeconds: row.approval_expiry_seconds == null ? null : Number(row.approval_expiry_seconds)
+			}),
 			source: row.source,
 			updatedAt: row.updated_at
 		};
@@ -1982,7 +2193,7 @@ var TrustPolicyStore = class {
 				forkPolicy: patch.forkPolicy ?? existing?.forkPolicy ?? DEFAULT_TRUST_POLICY.forkPolicy,
 				unknownContributorPolicy: patch.unknownContributorPolicy ?? existing?.unknownContributorPolicy ?? DEFAULT_TRUST_POLICY.unknownContributorPolicy,
 				workflowChangePolicy: patch.workflowChangePolicy ?? existing?.workflowChangePolicy ?? DEFAULT_TRUST_POLICY.workflowChangePolicy,
-				approvalExpiryHours: patch.approvalExpiryHours ?? existing?.approvalExpiryHours ?? DEFAULT_TRUST_POLICY.approvalExpiryHours
+				...mergedExpiry(patch, existing)
 			};
 			await this.write(orgId, merged, TrustPolicySource.enum.local, trx);
 			await onWrite?.(trx, merged);
@@ -1990,11 +2201,13 @@ var TrustPolicyStore = class {
 		});
 	}
 	async write(orgId, policy, source, executor = this.db) {
+		const seconds = approvalExpirySecondsOf(policy);
 		const columns = {
 			fork_policy: policy.forkPolicy,
 			unknown_contributor_policy: policy.unknownContributorPolicy,
 			workflow_change_policy: policy.workflowChangePolicy,
-			approval_expiry_hours: policy.approvalExpiryHours,
+			approval_expiry_hours: approvalExpiryHoursOf(seconds),
+			approval_expiry_seconds: seconds,
 			source,
 			updated_at: sql`now()`
 		};
@@ -2011,10 +2224,11 @@ var TrustPolicyStore = class {
 * orchestrator DB rather than held in process memory.
 */
 function createTrustPolicyStoreFromUrl(databaseUrl, opts) {
-	const db = new Kysely({ dialect: new PostgresDialect({ pool: new pg.Pool({
+	const pool = new pg.Pool({
 		connectionString: databaseUrl,
 		max: opts?.maxConnections ?? 3
-	}) }) });
+	});
+	const db = new Kysely({ dialect: new PostgresDialect({ pool }) });
 	return {
 		store: new TrustPolicyStore(db),
 		dispose: async () => {
@@ -2062,10 +2276,34 @@ function firstCauseMessage(err) {
 	}
 	return "";
 }
+/**
+* True when a rejected `fetch` failed at the transport layer, as opposed to
+* failing while the request was still being built.
+*
+* `fetch` uses a `TypeError` for both, so they are easy to conflate — but only
+* a transport failure means the orchestrator was actually dialled. Measured
+* against Node 24's undici:
+*
+*   closed port    → TypeError('fetch failed')                       cause: Error(ECONNREFUSED)
+*   invalid header → TypeError('Headers.append: … invalid header …') cause: undefined
+*   invalid URL    → TypeError('Failed to parse URL from …')         cause: Error(ERR_INVALID_URL)
+*
+* The discriminator is therefore the message, NOT the presence of a `cause`:
+* the invalid-URL case carries one. undici uses exactly `fetch failed` for a
+* transport failure and a descriptive message for everything it rejects before
+* opening a connection.
+*/
+function isTransportFailure(err) {
+	return err instanceof TypeError && err.message === "fetch failed";
+}
 async function fetchAdminApi(url, init, baseUrl) {
 	try {
 		return await fetch(url, init);
 	} catch (err) {
+		if (!isTransportFailure(err)) {
+			const detail = (err instanceof Error ? err.message : String(err)).replace(/\.$/, "");
+			throw new Error(`the admin API request to ${baseUrl} could not be built: ${detail}. The orchestrator was NOT contacted — this is a malformed request, not a connectivity problem. A token or URL carrying a newline or stray whitespace is the usual cause; check KICI_ADMIN_TOKEN / --token and KICI_ADMIN_URL / --url.`, { cause: err });
+		}
 		const detail = firstCauseMessage(err);
 		const cause = detail ? ` (${detail})` : "";
 		throw new Error(`cannot reach the orchestrator admin API at ${baseUrl}${cause}. Set KICI_ADMIN_URL to the orchestrator's HTTP address, or pass --base-url where the subcommand accepts it. Note KICI_ORCHESTRATOR_URL is NOT read by this CLI; if other subcommands appear to work, they are using the --database-url / KICI_DATABASE_URL direct-DB path rather than HTTP.`, { cause: err });
@@ -2765,7 +3003,8 @@ function openBrowserBestEffort(url) {
 		exec(override.replace("{url}", url), () => {});
 		return;
 	}
-	exec(platform() === "darwin" ? `open ${JSON.stringify(url)}` : platform() === "win32" ? `start "" ${JSON.stringify(url)}` : `xdg-open ${JSON.stringify(url)}`, () => {});
+	const cmd = platform() === "darwin" ? `open ${JSON.stringify(url)}` : platform() === "win32" ? `start "" ${JSON.stringify(url)}` : `xdg-open ${JSON.stringify(url)}`;
+	exec(cmd, () => {});
 }
 //#endregion
 //#region src/cli/commands/source-manifest.ts
@@ -2784,9 +3023,9 @@ function openBrowserBestEffort(url) {
 /** Static marketing-site page the CLI points at in headless paste-code mode. */
 const STATIC_CALLBACK_URL = "https://kici.dev/gh-manifest-callback";
 /** How long to wait for the operator to click "Create" on GitHub. */
-const CREATE_TIMEOUT_MS = 5 * 6e4;
+const CREATE_TIMEOUT_MS = 3e5;
 /** How long to wait for the operator to install the App on at least one repo. */
-const INSTALL_TIMEOUT_MS = 5 * 6e4;
+const INSTALL_TIMEOUT_MS = 3e5;
 const INSTALL_POLL_MS = 3e3;
 function defaultReadLine(prompt) {
 	const rl = createInterface({
@@ -2801,7 +3040,8 @@ function defaultReadLine(prompt) {
 	});
 }
 function defaultWriteRecoveryFile(appId, pem) {
-	const file = join(mkdtempSync(join(tmpdir(), "kici-gh-app-")), `app-${appId}.private-key.pem`);
+	const dir = mkdtempSync(join(tmpdir(), "kici-gh-app-"));
+	const file = join(dir, `app-${appId}.private-key.pem`);
 	writeFileSync(file, pem, { mode: 384 });
 	return file;
 }