@kici-dev/orchestrator 0.4.0 → 0.6.0

package/dist/webhook/ingest-accept.d.ts

@@ -0,0 +1,70 @@
+import type { WebhookInfo } from './handler.js';
+import { WebhookIngestOutcome } from '../pipeline/process-webhook.js';
+/**
+ * Seams the accept path needs. Each is a narrow function rather than the
+ * concrete collaborator so the sequencing below can be driven in a unit test
+ * without a database, an admission controller, or a pipeline.
+ */
+export interface IngestAcceptDeps {
+    /**
+     * Reserve an admission slot. Resolves to a release function when admitted, to
+     * `null` when the controller shed, or to `undefined` when no controller is
+     * wired (tests / minimal wirings — no gate).
+     */
+    admit: () => Promise<(() => void) | null | undefined>;
+    /**
+     * Advisory duplicate probe. Non-claiming: the atomic claim stays inside the
+     * pipeline, where it has always been. See {@link acceptWebhookDelivery}.
+     */
+    isKnownDelivery: (deliveryId: string) => Promise<boolean>;
+    /** Durably store the delivery; resolves to the row id, or null at the cap. */
+    enqueue: (info: WebhookInfo) => Promise<number | null>;
+    /** Take the row's claim (`buffered` → `replaying`). False when someone else has it. */
+    claimRow: (rowId: number) => Promise<boolean>;
+    /** Mark the row done so the drain pass sweeps it. */
+    markProcessed: (rowId: number) => Promise<void>;
+    /** Hand the claim back on failure so the drain pass retries the delivery. */
+    releaseClaim: (rowId: number, reason: string) => Promise<boolean>;
+    /** Run the match-and-dispatch pipeline. */
+    runPipeline: (info: WebhookInfo) => Promise<WebhookIngestOutcome>;
+    /**
+     * Schedule the post-acknowledgement work. Defaults to a detached microtask;
+     * a test passes a collector so it can await the work deterministically.
+     */
+    schedule?: (work: () => Promise<void>) => void;
+}
+/**
+ * Accept an inbound delivery and run its pipeline afterwards.
+ *
+ * The acknowledgement a caller receives means **the delivery is durably
+ * queued**, not that it was matched or dispatched. That is the whole point: a
+ * provider's delivery attempt times out in seconds (GitHub's is 10), while one
+ * matched workflow's build phase alone may legitimately take ten minutes, so a
+ * response that waited for the pipeline turned a slow build into a failed
+ * delivery for work that usually succeeded.
+ *
+ * Ordering is load-bearing and each step earns its place:
+ *
+ * 1. **Admit.** A shed delivery never reaches the queue, so admission stays the
+ *    first gate and a saturated orchestrator still answers 429 immediately.
+ * 2. **Probe for a duplicate.** Advisory only — a redelivery the orchestrator
+ *    already knows about is reported as one without a row being written. The
+ *    *authoritative* claim is still the pipeline's atomic
+ *    `INSERT … ON CONFLICT`, so a genuine cross-instance race is arbitrated
+ *    exactly where it always was; the loser simply learns after acknowledging.
+ * 3. **Enqueue durably.** Nothing is acknowledged before this row exists. At the
+ *    row cap the delivery is shed rather than acknowledged — answering 202 for
+ *    a delivery we did not store would turn a hang into silent data loss, which
+ *    is strictly worse than the hang this change removes.
+ * 4. **Claim the row**, then acknowledge, then run the pipeline detached. The
+ *    claim is what stops the drain pass re-injecting a delivery already in
+ *    flight; releasing it on failure is what makes the row a retry rather than
+ *    a tombstone. The admission slot is held across the pipeline, so in-flight
+ *    pipeline concurrency stays bounded exactly as it was when the response
+ *    waited for it.
+ *
+ * Returns `queued` on the acknowledge path, or `duplicate` / `shed` for the two
+ * pre-queue exits.
+ */
+export declare function acceptWebhookDelivery(info: WebhookInfo, deps: IngestAcceptDeps): Promise<WebhookIngestOutcome>;
+//# sourceMappingURL=ingest-accept.d.ts.map

package/dist/webhook/ingest-overflow-buffer.d.ts

@@ -7,10 +7,22 @@ export interface IngestOverflowBufferDeps {
     maxRows: number;
 }
 /**
- * Capture side of the durable overflow buffer. On a shed, the ingest path calls
- * {@link IngestOverflowBuffer.capture} additively (the 429 still stands). At the
- * row cap, capture drops the delivery from the buffer (never unbounded rows) —
- * the lossy fallback a retrying sender still covers.
+ * Capture side of the durable ingest queue. Two feeders write rows here.
+ *
+ * The **accept** path (HTTP direct ingress) enqueues every admitted delivery
+ * before the route answers 202: the row is what makes "durably queued" true, so
+ * a worker that dies mid-pipeline leaves recoverable work behind rather than a
+ * delivery the sender believes was accepted.
+ *
+ * The **shed** path enqueues additively when the admission controller rejects a
+ * delivery (the 429 still stands), so capacity recovering is enough to get the
+ * delivery processed without the sender redelivering.
+ *
+ * At the row cap, an enqueue fails rather than growing the table without bound.
+ * The two feeders differ in what that means: a shed delivery is dropped (the
+ * lossy fallback a retrying sender still covers), while the accept path must
+ * NOT answer 202 for a delivery it did not store — it sheds instead, so the
+ * sender learns the delivery was refused.
  */
 export declare class IngestOverflowBuffer {
     private readonly db;
@@ -18,10 +30,29 @@ export declare class IngestOverflowBuffer {
     constructor(deps: IngestOverflowBufferDeps);
     /** Current buffered-row depth. */
     currentDepth(): Promise<number>;
+    /**
+     * Persist a delivery as `buffered` and return its row id, or null when the
+     * buffer is at cap. Callers that must not acknowledge an unstored delivery
+     * check for null; the shed path treats null as a drop.
+     */
+    enqueue(d: OverflowDelivery): Promise<number | null>;
     /**
      * Persist a shed delivery. Returns true when a `buffered` row was inserted,
      * false when the buffer is at cap (delivery dropped, `cap_full` metric bumped).
      */
     capture(d: OverflowDelivery): Promise<boolean>;
+    /**
+     * Claim a specific row for processing: `buffered` → `replaying`, stamping the
+     * claim clock. Returns false when someone else already owns it — a drain pass
+     * on another instance, or a reclaim that ran while this caller was scheduling.
+     * The conditional update is the arbiter, so two workers can never both own a
+     * row and dispatch its delivery twice.
+     */
+    claimRow(id: number): Promise<boolean>;
+    /**
+     * Mark a claimed row done. The row is swept by the drain pass rather than
+     * deleted here, so the sweep stays the single deletion site.
+     */
+    markProcessed(id: number): Promise<void>;
 }
 //# sourceMappingURL=ingest-overflow-buffer.d.ts.map

package/dist/webhook/ingest-overflow-replayer.d.ts

@@ -1,5 +1,6 @@
 import type { Kysely } from 'kysely';
 import type { Database } from '../db/types.js';
+import type { ClusterSettingsReader } from '../cluster/cluster-settings-reader.js';
 import { WebhookIngestOutcome } from '../pipeline/process-webhook.js';
 import { type OverflowDelivery } from './ingest-overflow-types.js';
 export type ReinjectFn = (d: OverflowDelivery) => Promise<WebhookIngestOutcome>;
@@ -11,14 +12,29 @@ export interface IngestOverflowReplayerDeps {
     intervalMs: number;
     batchSize: number;
     maxAttempts: number;
+    /**
+     * How long a `replaying` claim may stand before it is reclaimed. Resolved per
+     * pass so a fleet-wide `cluster_settings` override takes effect without a
+     * restart; the number passed here is the configured cluster default.
+     */
+    claimTimeoutMs: number;
+    /** Fleet-wide override reader for {@link IngestOverflowReplayerDeps.claimTimeoutMs}. */
+    clusterSettings?: ClusterSettingsReader;
 }
 /**
- * Background drain for the durable overflow buffer. A pass runs only while the
- * admission controller is NOT shedding (replaying into a still-overloaded
- * orchestrator just re-sheds), claims the oldest `buffered` rows FIFO up to a
- * bounded batch, and re-injects each through the admission-gated ingest path.
- * A re-shed or error reverts the row to `buffered` (never lost); past the
- * max-attempts ceiling it goes `failed`. Successful rows are swept.
+ * Background drain for the durable ingest queue. Each pass first reclaims rows
+ * whose `replaying` claim went stale — a worker killed mid-pipeline releases
+ * nothing, so without this its delivery would sit claimed forever and the
+ * durable row it acknowledged would never be worth anything. It then claims the
+ * oldest `buffered` rows FIFO up to a bounded batch and re-injects each through
+ * the admission-gated ingest path. A re-shed or error reverts the row to
+ * `buffered` (never lost); past the max-attempts ceiling it goes `failed`.
+ * Successful rows are swept.
+ *
+ * Re-injection runs only while the admission controller is NOT shedding
+ * (replaying into a still-overloaded orchestrator just re-sheds). Reclaiming is
+ * not gated that way: a stranded claim is stranded regardless of load, and the
+ * row it frees simply waits in `buffered` until capacity returns.
  */
 export declare class IngestOverflowReplayer {
     private readonly db;
@@ -26,6 +42,8 @@ export declare class IngestOverflowReplayer {
     private readonly intervalMs;
     private readonly batchSize;
     private readonly maxAttempts;
+    private readonly claimTimeoutMs;
+    private readonly clusterSettings;
     private reinjectDirect;
     private reinjectRelay;
     private timer;
@@ -38,10 +56,36 @@ export declare class IngestOverflowReplayer {
     stop(): void;
     /** One drain pass. Test-drivable. */
     runPass(): Promise<void>;
+    /**
+     * Revert `replaying` rows whose claim went stale to `buffered`, counting the
+     * abandoned attempt so a row that keeps stranding eventually goes `failed`
+     * instead of looping forever.
+     *
+     * A row claimed before the claim clock shipped has a null `claimed_at`; it is
+     * aged off `captured_at` instead, which is a safe over-estimate of how long
+     * it has been claimed.
+     */
+    private reclaimStaleClaims;
+    /**
+     * Release a claim: revert the row to `buffered` so the drain retries it, or
+     * mark it `failed` once the attempt ceiling is hit. Returns false when the
+     * row is gone or is no longer `replaying` — another worker owns it now, so
+     * this caller must not touch it.
+     *
+     * Public because the accept path's background worker holds a claim it did not
+     * take through {@link claimBatch} and must release it the same way on failure.
+     */
+    releaseClaim(id: number, reason: string): Promise<boolean>;
     /** Select the oldest buffered rows and claim each via a conditional update. */
     private claimBatch;
     private toDelivery;
     private replayOne;
+    /**
+     * Move a claimed row back to `buffered` (or to `failed` at the attempt
+     * ceiling). Every update is conditional on the row still being `replaying`,
+     * so a caller whose claim was reclaimed underneath it cannot yank a row a
+     * different worker now owns. Returns whether this call moved the row.
+     */
     private revertOrFail;
     private sweepReplayed;
     private refreshDepthGauge;

package/dist/worker/in-memory-job-queue.d.ts

@@ -35,7 +35,7 @@ export declare class InMemoryJobQueue {
      * label in the gate set. Empty (default) is a no-op for static / non-scaler
      * agents — the gate trivially passes.
      */
-    dequeueForLabels(agentLabels: string[], agentMandatoryLabels?: string[]): Promise<QueuedJob | null>;
+    dequeueForLabels(agentLabels: string[], agentMandatoryLabels?: string[], _agentId?: string, canServe?: (job: QueuedJob) => boolean): Promise<QueuedJob | null>;
     /**
      * Dequeue a specific pending job by id, validating that the agent's labels
      * still satisfy the job's runsOn / excludeLabels and the agent's

package/dist/ws/agent-handler.d.ts

@@ -13,7 +13,11 @@
  * 2. pendingRegistration (10s): After auth.success, agent must send agent.register.
  * 3. registered: Agent is fully connected and can exchange messages.
  *
- * When agentAuthMode === 'none', the auth phase is skipped (legacy behavior).
+ * When agentAuthMode === 'none', the auth phase is skipped and the connection
+ * starts in pendingRegistration. An agent that happens to carry a token still
+ * opens with auth.request — nothing on the wire tells it the mode — so that
+ * frame is accepted there and answered with auth.success without reading the
+ * token, and the agent then registers as normal.
  */
 import type { WSEvents } from 'hono/ws';
 import { LogStream } from '@kici-dev/engine';
@@ -31,6 +35,7 @@ import type { DispatchCacheRefTracker } from '../cache/dispatch-cache-ref-tracke
 import type { PendingBuildTracker } from '../cache/pending-builds.js';
 import type { PendingInitTracker } from '../cache/pending-inits.js';
 import type { PendingDynamicTracker } from '../cache/pending-dynamics.js';
+import type { PendingGlobalEvalTracker } from '../cache/pending-global-evals.js';
 import type { CacheStorage } from '../storage/types.js';
 import type { AgentMetricsAggregator } from '../metrics/agent-metrics-aggregator.js';
 import { type AgentApiRegistry } from './agent-api-registry.js';
@@ -123,12 +128,16 @@ export interface AgentWsHandlerDeps {
      *   AgentRegistry so subsequent label matches (queue drain + eager
      *   dispatch) apply the same gate the scaler-side selector applied.
      *
-     * Returns `null` for static agents not managed by any scaler.
+     * Resolves to `null` for static agents not managed by any scaler.
+     *
+     * Asynchronous because the agent may reach an instance that did not spawn
+     * it: that instance adopts the agent from the shared spawn record, which is
+     * a database round trip.
      */
-    onScalerAgentRegistered?: (agentId: string, labels: string[]) => {
+    onScalerAgentRegistered?: (agentId: string, labels: string[]) => Promise<{
         boundJobId?: string;
         mandatoryLabels: string[];
-    } | null;
+    } | null>;
     /** Optional callback when an agent disconnects (for scaler lifecycle). */
     onScalerAgentDisconnected?: (agentId: string) => void;
     /** Optional callback when an agent completes a job (for scaler lifecycle). */
@@ -169,6 +178,22 @@ export interface AgentWsHandlerDeps {
         deliveryId?: string;
         error?: string;
     }>;
+    /**
+     * Optional callback: a provisioning workflow's agent exchanges a single-use
+     * claim code (from a `kici.scaler.scale-up` event) for freshly minted
+     * ephemeral agent credentials. Delegates to the event scaler backend's claim
+     * store. Returns the credentials or an author-actionable error; the token is
+     * carried only in the response, never logged.
+     */
+    onClaimCredentials?: (agentId: string, claimCode: string) => Promise<{
+        credentials?: {
+            agentToken: string;
+            agentId: string;
+            orchestratorUrl: string;
+            labels: string[];
+        };
+        error?: string;
+    }>;
     /** Optional callback when agent sends a run.event for infrastructure lifecycle tracking. */
     onRunEvent?: (agentId: string, msg: {
         runId: string;
@@ -267,6 +292,8 @@ export interface AgentWsHandlerDeps {
     pendingInits?: PendingInitTracker;
     /** Optional pending dynamic tracker for cleanup on agent disconnect. */
     pendingDynamics?: PendingDynamicTracker;
+    /** Optional pending global-eval-round tracker for cleanup on agent disconnect. */
+    pendingGlobalEvals?: PendingGlobalEvalTracker;
     /** Optional callback when agent sends encrypted secret outputs on job success. */
     onSecretOutputs?: (runId: string, jobId: string, secretOutputs: Record<string, {
         agentPublicKey: string;

package/dist/ws/dashboard-context-handler.d.ts

@@ -13,11 +13,12 @@
 import { type Kysely } from 'kysely';
 import type { HeldRunStore, ReleaseSignal } from '../contexts/held-runs.js';
 import type { TeamMembershipLookup } from '../approvals/approval-resolver.js';
+import { type ApplyDecisionDeps } from '../approvals/apply-decision.js';
 import type { DashboardPlatformToOrchMessage } from '@kici-dev/engine';
 import type { ContextStore } from '../contexts/context-store.js';
 import type { VariableStore } from '../contexts/variable-store.js';
 import type { BindingStore } from '../contexts/binding-store.js';
-import type { Database } from '../db/types.js';
+import type { Database, HeldRun } from '../db/types.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
 import { type ScopedSecretStore } from '../secrets/scope-routing.js';
 import type { ResolvedDashboardEncryptionKey } from '../secrets/dashboard-encryption-key.js';
@@ -74,10 +75,22 @@ export interface ApprovalHandlerDeps {
     resumeStep?: (signal: ReleaseSignal) => Promise<void>;
     /** Notify a waiting agent that a step hold was rejected (step scope). */
     rejectStep?: (heldRunId: string, reason?: string) => Promise<void> | void;
-    /** Resume a released workflow install-gate hold (workflow scope). */
+    /** Resume a released workflow-scoped hold (install gate or trust policy). */
     resumeWorkflow?: (signal: ReleaseSignal) => Promise<void>;
-    /** Cancel a rejected workflow install-gate hold (workflow scope). */
-    rejectWorkflow?: (runId: string) => Promise<void>;
+    /**
+     * Cancel a rejected workflow-scoped hold (install gate, trust policy, or an
+     * SDK workflow-level `requireApproval`), recording the rejecter's own reason
+     * as the run's cancellation reason. The hold row tells those apart, and the
+     * resolved boolean says whether a terminal `KiCI Security` check was written
+     * — see `onWorkflowReject` on `ApplyDecisionDeps`.
+     */
+    rejectWorkflow?: (hold: HeldRun, reason?: string) => Promise<boolean>;
+    /**
+     * Terminalize the `KiCI Security` check of any hold this handler ends that
+     * `rejectWorkflow` did not report on — see `settleSecurityCheck` on
+     * `ApplyDecisionDeps`.
+     */
+    settleSecurityCheck?: ApplyDecisionDeps['settleSecurityCheck'];
 }
 /**
  * Handler for all dashboard context and held run WS messages.
@@ -162,6 +175,12 @@ export declare class DashboardContextHandler {
     /**
      * Resolve the actor's Keycloak sub for approval attribution. Only `user` and
      * `platform_operator` actors carry a `sub`; others fall back to a stable id.
+     *
+     * The `service:` namespace comes from {@link adminActorSub} rather than a
+     * literal here: `applyDecision`'s self-approval gate compares this value
+     * against {@link triggererSubjectFor}'s output, so the two renderings of one
+     * principal have to be produced by the same code or the gate compares strings
+     * that can never be equal.
      */
     private actorSub;
     /** Read org_settings.allow_self_approval (default true). */
@@ -170,6 +189,11 @@ export declare class DashboardContextHandler {
      * Route an approve/reject through the shared `applyDecision` applier:
      * eligibility check, real attribution, multi-clause accumulation, and the
      * resume-after-approval re-dispatch. Sends the matching response message.
+     *
+     * The response goes out as soon as the decision is durable, not when its
+     * consequence finishes — see `ApplyDecisionResult.consequence`. The audit
+     * entry is attached to that consequence instead, so there is still exactly one
+     * per decision and it still carries the real outcome.
      */
     private applyApprovalDecision;
     private handleHeldRunApprove;

package/dist/ws/dashboard-global-workflows-handler.d.ts

@@ -2,10 +2,12 @@
  * Dashboard global-workflows handler for the orchestrator.
  *
  * Responds to `dashboard.global-workflows.*` WS messages from Platform by
- * reading or upserting the `org_settings` row keyed by `customer_id`. The
- * row holds the org-level global-workflow policy: master enable, plus the
- * three repo-pattern lists (allow / deny / elevate). Each list entry is a
- * `{routingKey?, pattern}` object that may optionally pin to one source.
+ * reading or upserting the `org_settings` row keyed by `customer_id`. The row
+ * holds the three per-org repo-pattern lists (allow / deny / elevate); each
+ * entry is a `{routingKey?, pattern}` object that may optionally pin to one
+ * source. The master enable switch is fleet-wide
+ * (`cluster_settings.global_workflows_enabled`) and read-only here — projected
+ * onto the response as `enabled`, never written from this handler.
  *
  * The handler binds a single `customerId` at construction time (via the
  * sources / generic_webhook_sources lookup at server startup) and updates
@@ -15,12 +17,17 @@ import { type Kysely } from 'kysely';
 import type { GlobalWorkflowsGetRequest, GlobalWorkflowsUpdateRequest, GlobalWorkflowSettings, RepoPatternEntry } from '@kici-dev/engine/protocol/dashboard-global-workflows';
 import type { Database, OrgSettings } from '../db/types.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
+import type { ClusterSettingsReader } from '../cluster/cluster-settings-reader.js';
 interface DashboardGlobalWorkflowsHandlerDeps {
     /** Customer / org identifier — primary key on org_settings. */
     customerId: string;
     /** Send a response message back to Platform over the WS connection. */
     send: (msg: unknown) => void;
     db: Kysely<Database>;
+    /** Reads the fleet-wide master switch for the read-only `enabled` projection. */
+    clusterSettings: ClusterSettingsReader;
+    /** Applies when the cluster column is NULL — `config.globalWorkflowsEnabled`. */
+    globalWorkflowsEnabledDefault: boolean;
     /** Access log writer — records one row per read / mutation with actor attribution. */
     accessLog?: AccessLogWriter;
 }
@@ -53,11 +60,30 @@ export declare class DashboardGlobalWorkflowsHandler {
     private handleGet;
     private handleUpdate;
     private readRow;
+    /**
+     * The effective fleet-wide master switch, for the read-only projection the
+     * dashboard renders as a status badge.
+     *
+     * Uses the shared 10s-cached reader — unlike the admin route, which reads
+     * uncached because an operator does set-then-show. A dashboard badge that is
+     * up to 10s stale is fine; a second uncached read on every dashboard poll is
+     * not.
+     *
+     * An unreadable row resolves to the configured default here rather than
+     * failing closed. This value only decides what the UI displays; the actual
+     * gate is `GlobalWorkflowPolicy`, which does fail closed.
+     */
+    private effectiveEnabled;
     private upsertRow;
+    /**
+     * Same envelope as `sendError`, for a request the client got wrong. Logged at
+     * warn level: bad input is not a server fault, and error-level rows here would
+     * pollute the error dashboards an operator watches.
+     */
+    private sendClientError;
     private sendError;
 }
 interface NormalizedPatch {
-    enabled: boolean;
     allowedRepos: RepoPatternEntry[] | null;
     deniedRepos: RepoPatternEntry[] | null;
     elevatedRepos: RepoPatternEntry[] | null;
@@ -69,10 +95,11 @@ interface NormalizedPatch {
  */
 export declare function buildPatch(existing: OrgSettings | undefined, msg: GlobalWorkflowsUpdateRequest): NormalizedPatch;
 /**
- * Project a row into the public settings shape. Returns a defaulted "disabled"
- * settings object when the row does not yet exist, so callers always get a
- * renderable state.
+ * Project a row into the public settings shape. `enabled` is the effective
+ * fleet-wide master switch, supplied by the caller (read-only here). When the
+ * row does not yet exist, the three per-org lists project as null so callers
+ * always get a renderable state.
  */
-export declare function rowToSettings(customerId: string, row: OrgSettings | undefined): GlobalWorkflowSettings;
+export declare function rowToSettings(customerId: string, row: OrgSettings | undefined, enabled: boolean): GlobalWorkflowSettings;
 export {};
 //# sourceMappingURL=dashboard-global-workflows-handler.d.ts.map

package/dist/ws/execution-status-frame.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Build the `execution.status` frame the orchestrator forwards to the Platform.
+ *
+ * Extracted from `server.ts`'s `onExecutionStatusChange` hook so the projection
+ * from an {@link ExecutionContext} onto the wire message is a pure function with
+ * its own tests. The hook itself stays a thin adapter: it supplies the message
+ * id and the clock and hands the result to the Platform client.
+ *
+ * Every field here is conditional on the context actually carrying it. That is
+ * load-bearing for `workflowRepoIdentifier` in particular: the tracker records
+ * it only when the repository that DEFINES the workflow differs from the
+ * repository the run acted on, so the frame must stay silent for a per-repository
+ * run or "present" stops marking a cross-repository global run downstream.
+ */
+import type { ExecutionContext } from '../reporting/execution-tracker.js';
+import type { ExecutionRunStatus, ExecutionStatus, InitFailure } from '@kici-dev/engine';
+export interface ExecutionStatusFrameArgs {
+    messageId: string;
+    runId: string;
+    status: ExecutionRunStatus;
+    context: ExecutionContext;
+    jobCount: number;
+    startedAt: number;
+    timestamp: number;
+    completedAt?: number;
+    durationMs?: number;
+    failureReason?: string;
+    logBytes?: number;
+    initFailure?: InitFailure;
+}
+export declare function buildExecutionStatusFrame(args: ExecutionStatusFrameArgs): ExecutionStatus;
+//# sourceMappingURL=execution-status-frame.d.ts.map

package/dist/ws/failure-messages.d.ts

@@ -25,5 +25,7 @@ export declare const AgentWsInternalFailure: Readonly<{
     readonly eventEmitFailed: 'the orchestrator hit an internal error while emitting this event';
     /** An agent private-API handler threw for a reason other than its two deliberate rejections. */
     readonly agentApiFailed: 'the orchestrator hit an internal error while handling this API request';
+    /** The event-scaler claim store threw while minting ephemeral credentials. */
+    readonly scalerClaimFailed: 'the orchestrator hit an internal error while claiming scaler credentials';
 }>;
 //# sourceMappingURL=failure-messages.d.ts.map

package/dist/ws/git-credential-relay.d.ts

@@ -0,0 +1,39 @@
+/**
+ * `agent.api` handler for GIT_CREDENTIAL_REQUEST_METHOD.
+ *
+ * The agent's credential helper calls this on every git network operation, so
+ * this path is hot and must stay cheap: validate, authorize, delegate.
+ *
+ * Authorization has two layers. Job ownership comes first — an agent may only
+ * request credentials for a job it was dispatched, resolved from server truth
+ * via the dispatcher, never from the params. Then the repository fence, which
+ * applies to WRITE only: a read with the source credential may reach any
+ * repository inside the App installation's own selection (GitHub enforces that
+ * selection when the mint names the repository), so cloning a sibling repo
+ * needs no credential in workflow code. A write must additionally stay inside
+ * the organisation that owns the job's source repository.
+ *
+ * A workflow-supplied credential needs no fence of its own: it names secrets
+ * the job can already read with `ctx.secrets.get()`, so brokering it grants no
+ * capability the workflow did not already have — the secret ACL is the
+ * authorization.
+ */
+import type { GitCredentialBroker } from '../git/credential-broker.js';
+/** Per-job facts the handler needs. Resolved from server truth, never from params. */
+export interface JobCredentialContext {
+    orgId: string;
+    /** The repository this job was dispatched for. */
+    sourceRepo: string;
+}
+export interface GitCredentialHandlerDeps {
+    broker: GitCredentialBroker;
+    /** The dispatcher's job-ownership resolver — the same one the OIDC relay uses. */
+    dispatcher: {
+        resolveOwnedJob(agentId: string, jobId: string): {
+            runId: string;
+        } | undefined;
+    };
+    jobContext: (runId: string, jobId: string) => Promise<JobCredentialContext | null>;
+}
+export declare function buildGitCredentialHandler(deps: GitCredentialHandlerDeps): (agentId: string, rawParams: Record<string, unknown>) => Promise<unknown>;
+//# sourceMappingURL=git-credential-relay.d.ts.map

package/dist/ws/oidc-token-relay.d.ts

@@ -60,19 +60,14 @@ export interface OidcTokenHandlerDeps {
     };
     platformClient: MintPlatformClient;
     orchestratorId: string;
-    /** Test-only fault-injection master switch (config.testMode). */
-    testMode: boolean;
     /**
-     * Test-only: force-defer the *initial* agent mint for any job requesting this
-     * OIDC audience (config.testMintDeferAudience). Ignored unless `testMode`.
+     * Test-only fault-injection predicate over the requested OIDC `audience`,
+     * supplied only by the build-time test double. Returning `true` short-circuits
+     * the *initial* mint to a transient defer BEFORE the real Platform relay is
+     * contacted — it can only defer/reject, never forge or weaken a signature.
+     * Undefined (the shipped default) means no fault injection.
      */
-    testMintDeferAudience?: string;
-    /**
-     * Test-only: force the *initial* agent mint to defer for this OIDC audience
-     * (config.testMintRejectAudience) so a pending row is created, which the
-     * retrier then terminally rejects. Ignored unless `testMode`.
-     */
-    testMintRejectAudience?: string;
+    initialMintFault?: (audience: string) => boolean;
 }
 /**
  * Build the agent.api handler for `OIDC_TOKEN_REQUEST_METHOD`. Validates the