@kici-dev/orchestrator 0.4.0 → 0.6.0

package/dist/contexts/held-runs.d.ts

@@ -3,10 +3,12 @@
  *
  * Manages the lifecycle: pending -> approved/rejected/expired.
  */
-import { Kysely } from 'kysely';
+import { Kysely, type Transaction } from 'kysely';
 import { z } from 'zod';
 import { type ApprovalRequirement, type ApproverClause, type StepApprovalPayload, ApprovalDecision, HoldScope, TriggerSource } from '@kici-dev/engine';
 import type { Database, HeldRun, HeldRunApproval } from '../db/types.js';
+/** A Kysely root handle or an in-flight transaction — query builders accept either. */
+type Executor = Kysely<Database> | Transaction<Database>;
 /** Status values for held runs (held_runs table). */
 export declare enum HeldRunStatus {
     Pending = "pending",
@@ -17,7 +19,25 @@ export declare enum HeldRunStatus {
 }
 /**
  * Reason a run was held in the security queue. Persisted verbatim in
- * `held_runs.reason` and switched on by `buildSecurityHoldSummary`.
+ * `held_runs.reason` and whose vocabulary `buildSecurityHoldSummary` switches
+ * on.
+ *
+ * Each value names why a run sits in the queue. The enum stays whole because
+ * compiling code still names all four: `buildSecurityHoldSummary` renders one
+ * branch per value. Dropping a member breaks that, and breaks the parity test
+ * that pins `SECURITY_HOLD_JOB_IDS`' three policy-reason keys to this enum's
+ * options — the engine constant cannot import the enum, so that coupling lives
+ * only in the orchestrator's test. Nothing validates `held_runs.reason` against
+ * this enum, so a stored value is not rejected anywhere.
+ *
+ * - `fork_pr` — the org trust policy's fork switch held the run.
+ * - `context_trust` — a context's minimum-trust gate held the run.
+ * - `workflow_modification` — deprecated; no longer raised. Modifications to
+ *   `.kici/` are surfaced on their own informational check and no longer feed
+ *   a policy arm. Removed at v1.0.0.
+ * - `unknown_contributor` — deprecated; no longer raised. The policy turns on
+ *   whether the pull request came from a fork, not on who opened it. Removed
+ *   at v1.0.0.
  */
 export declare const SecurityHoldReason: z.ZodEnum<{
     context_trust: "context_trust";
@@ -37,6 +57,20 @@ export interface CreateHeldRunData {
     expiresAt: Date;
     /** Queue type: 'context' (default) or 'security'. */
     queueType?: 'context' | 'security';
+    /**
+     * Granularity of the held element. Omit to leave the column at its `'job'`
+     * default. The org trust policy's PR-wide hold passes `'workflow'`: it fires
+     * before any job is materialized and resumes by rebuilding the whole workflow
+     * dispatch, so `routeRelease` must send it to the workflow resume path.
+     */
+    scope?: HoldScope;
+    /**
+     * What triggered the hold. Omit to leave the column at its `'context'`
+     * default. Written explicitly by the trust-policy hold so its release signal
+     * carries the pair `routeRelease` discriminates on rather than relying on a
+     * column default to supply half of it.
+     */
+    triggerSource?: TriggerSource;
 }
 /**
  * Data required to create a generalized approval hold. Unlike the legacy
@@ -109,14 +143,57 @@ export interface ListHeldRunsOptions {
 export declare class HeldRunStore {
     private readonly db;
     constructor(db: Kysely<Database>);
-    /** Create a new held run with pending status. */
-    create(orgId: string, data: CreateHeldRunData): Promise<HeldRun>;
+    /**
+     * Create a new held run with pending status.
+     *
+     * `exec` is the executor the INSERT runs through, defaulting to the store's
+     * own connection. A caller that writes something the row cannot exist without
+     * — the job's pending dispatch context, without which the hold can never be
+     * resumed — passes its enclosing transaction, so the two land or roll back
+     * together. Handed in rather than taken from an ambient scope: Kysely has no
+     * such scope, so a `this.db` insert inside a `db.transaction()` callback runs
+     * on a different connection and commits on its own.
+     */
+    create(orgId: string, data: CreateHeldRunData, exec?: Executor): Promise<HeldRun>;
     /**
      * Create a generalized approval hold (workflow/job/step scope, explicit or
      * context trigger) carrying a normalized `ApprovalRequirement`. Returns
      * the created row.
+     *
+     * `exec` carries the same meaning it does on {@link create}.
+     */
+    createHold(orgId: string, data: CreateHoldData, exec?: Executor): Promise<HeldRun>;
+    /**
+     * Record that the pending `KiCI Security` check reached the provider, for
+     * every hold that gates it, so the settle that ends one knows it has a check
+     * to terminalize.
+     *
+     * Written AFTER the post returns, never before. The two orders fail
+     * differently and the failures are not equivalent: recording first and dying
+     * before the post leaves a row claiming a check the commit does not have, and
+     * the settle then CREATES one — a completed `KiCI Security` run appearing on a
+     * commit nothing ever held. Recording second leaves the opposite residue, a
+     * real pending check the settle declines to close, which is the same stuck
+     * check the fire-and-forget post could already produce. A fabricated failing
+     * check on a pull request is worse than a stuck one, so the write goes last.
+     *
+     * **One statement for all of them, not one per hold.** A commit's check run is
+     * shared by every hold on it, and the settle asks the contention query which
+     * of them still owns it. Marking them in a loop admits a PARTIAL mark: mark
+     * the reviewer hold, fail on the security hold, and the security row keeps
+     * `posted_pending_check: false` — so it is not counted as a contender, and
+     * approving the reviewer hold terminalizes the shared check `success` while
+     * the trust hold still gates the job. That is a fabricated PASSING check,
+     * which is the worse direction, reached without any process dying: a
+     * deadlock, a statement timeout or a lost connection between the two UPDATEs
+     * is enough. A single `WHERE id IN (…)` either marks every hold or none.
+     *
+     * The residual window is therefore one statement issued immediately after the
+     * provider call returns — narrow, and not only reachable by a process death,
+     * which is why the caller logs its failure rather than treating it as
+     * impossible.
      */
-    createHold(orgId: string, data: CreateHoldData): Promise<HeldRun>;
+    markPendingCheckPosted(orgId: string, heldRunIds: readonly string[]): Promise<void>;
     /** INSERT one decision row using the given executor (root or transaction). */
     private insertDecisionRow;
     /** Flip a pending hold to 'approved' using the given executor. Undefined if not pending. */
@@ -190,20 +267,49 @@ export declare class HeldRunStore {
      */
     listOverdue(): Promise<HeldRun[]>;
     /**
-     * Release overdue workflow timer holds. The install-gate wait action pauses
-     * the workflow as a held run; on timer expiry it must RESUME (not fail like
-     * a reviewer-hold expiry). Flips each overdue pending `hold_type` timer,
-     * `hold_scope='workflow'` row to `released` and returns a `ReleaseSignal`
-     * per row so the caller can resume the workflow. Runs BEFORE
-     * `expireOverdue()` so these rows leave the pending pool before the
-     * expire-and-fail sweep sees them.
+     * Release overdue timer holds at ANY scope. A wait action pauses its element
+     * as a held run; on timer expiry it must RESUME (not fail like a reviewer-hold
+     * expiry). Flips each overdue pending timer row to `released` and returns a
+     * `ReleaseSignal` per row, carrying the row's own scope so the caller can
+     * route it — `routeRelease` sends a workflow-scoped one to the install-gate
+     * rebuild and a job-scoped one to the job re-dispatch path.
+     *
+     * Runs BEFORE `expireOverdue()` so these rows leave the pending pool before
+     * the expire-and-fail sweep sees them. That ordering is load-bearing, not
+     * incidental: `expireOverdue` is not scope-filtered, so a released-but-not-yet-
+     * resumed row would otherwise be expired out from under its resume.
      *
-     * The filter matches every persisted spelling of the timer hold type, so a
-     * row an un-upgraded orchestrator wrote as `wait_timer` still resumes rather
-     * than falling through to the expire-and-fail sweep. `hold_scope` is what
-     * keeps job-scoped dispatch-gate timer holds out of this sweep.
+     * The filter matches every persisted spelling of the timer hold type, so a row
+     * an un-upgraded orchestrator wrote as `wait_timer` still resumes rather than
+     * falling through to the expire-and-fail sweep. It deliberately does NOT
+     * filter on `hold_scope`: a job-scoped timer hold used to be excluded here,
+     * which left it with no release path at all — created, never released,
+     * eventually expired, its job never dispatched.
      */
     releaseDueWaitHolds(): Promise<ReleaseSignal[]>;
+    /**
+     * Every pending queued (concurrency) hold, with the org and concurrency group
+     * it belongs to — the input to the periodic release sweep, which needs to know
+     * WHICH groups have someone waiting before it looks up any limits.
+     *
+     * Returns the pair rather than full rows: the sweep only groups by it, and
+     * `listQueuedHoldsForContext` fetches the rows it actually releases.
+     */
+    listAllQueuedHolds(): Promise<Array<{
+        orgId: string | null;
+        concurrencyGroup: string | null;
+    }>>;
+    /**
+     * List the pending queued (concurrency) holds for one context's concurrency
+     * group, oldest first.
+     *
+     * Joined to `execution_runs` and filtered by `customer_id` as well as
+     * `context`: a context NAME is not unique across tenants, so without the org
+     * predicate one org's completing job could release another org's queued hold.
+     * Oldest-first is the release order — a queue that released newest-first would
+     * starve whoever waited longest.
+     */
+    listQueuedHoldsForContext(orgId: string, concurrencyGroup: string): Promise<HeldRun[]>;
     /**
      * Expire overdue pending runs. Called by the stale detector.
      * Sets status to 'expired' and resolved_at to now() for all
@@ -224,4 +330,5 @@ export declare function createHeldRunStoreFromUrl(databaseUrl: string, opts?: {
     store: HeldRunStore;
     dispose: () => Promise<void>;
 };
+export {};
 //# sourceMappingURL=held-runs.d.ts.map

package/dist/contexts/protection/aggregate.d.ts

@@ -26,8 +26,9 @@ export declare function evaluateMultiContextGates(envs: ReadonlyArray<{
 }>, ctx: JobDispatchContext): ContextGateRejection[];
 /**
  * Aggregate hold/wait/queue parameters across all bound contexts, most
- * restrictive wins: trust = max tier, reviewers = sorted dedup union, wait timer
- * = max, hold expiry = min, concurrency limit = min (tightest). The concurrency
+ * restrictive wins: trust = strictest declared floor (see `TRUST_RANK` — a
+ * wording choice, not a verdict), reviewers = sorted dedup union, wait timer =
+ * max, hold expiry = min, concurrency limit = min (tightest). The concurrency
  * strategy follows the primary (first) context.
  */
 export declare function aggregateProtectionParams(envs: ReadonlyArray<Context>): EffectiveProtection;

package/dist/contexts/protection/branch-gate.d.ts

@@ -1,5 +1,20 @@
 import type { Context, ProtectionGateResult } from '@kici-dev/engine';
 import type { JobDispatchContext } from './pipeline.js';
+/**
+ * The reason phrase for a branch-restricted context bound by an
+ * internally-triggered run that carries NO branch. Shared with the multi-context
+ * aggregator so the two reject paths cannot describe the same cause
+ * differently, and context-free because each caller names the context itself.
+ *
+ * An internally-triggered run usually does have a branch: a scheduled run
+ * presents its registration's default branch, and every other internal trigger
+ * inherits the branch of the run that emitted its event. Those runs are matched
+ * against the restriction patterns like any other. This phrase covers only the
+ * runs where neither source produced one — a registration whose default branch
+ * has never been captured, or an emitting run that is gone — so it names the
+ * remedy for that case rather than telling an operator to drop the restriction.
+ */
+export declare const INTERNAL_TRIGGER_NO_BRANCH_DETAIL: string;
 /** Evaluate branch restrictions, trigger type filters, and repo patterns. */
 export declare function evaluateBranchGate(env: Context, ctx: JobDispatchContext): ProtectionGateResult;
 //# sourceMappingURL=branch-gate.d.ts.map

package/dist/contexts/protection/concurrency-gate.d.ts

@@ -1,4 +1,10 @@
 import type { Context, ProtectionGateResult } from '@kici-dev/engine';
-/** Evaluate concurrency limits for the context. */
-export declare function evaluateConcurrencyGate(env: Context, currentRunningCount: number, _concurrencyGroup: string): ProtectionGateResult;
+/**
+ * Evaluate concurrency limits for the context.
+ *
+ * Takes only the two fields it reads rather than a whole `Context`, so the
+ * ready-dispatch re-gate can call it with the limit and strategy it resolved
+ * from a run's bound context row. Every full `Context` still satisfies it.
+ */
+export declare function evaluateConcurrencyGate(env: Pick<Context, 'concurrencyLimit' | 'concurrencyStrategy'>, currentRunningCount: number, _concurrencyGroup: string): ProtectionGateResult;
 //# sourceMappingURL=concurrency-gate.d.ts.map

package/dist/contexts/protection/pipeline.d.ts

@@ -12,6 +12,24 @@ export interface JobDispatchContext {
     repository: string;
     runId: string;
     jobId: string;
+    /**
+     * True when the run was triggered by the orchestrator itself (a schedule
+     * fire, a workflow/job completion, a failure batch, a `kiciEvent()`, an
+     * invoke-gate summon) rather than by a provider webhook.
+     *
+     * Such a run usually DOES carry a branch, and `branch` is then matched
+     * against the restriction patterns like any other run's: a schedule fire
+     * presents its registration's default branch, and every other internal
+     * trigger inherits the branch of the run that emitted its event.
+     *
+     * The flag matters only when `branch` is EMPTY — a failure batch or a scaler
+     * event (many runs behind it, or none), a registration whose default branch
+     * has never been captured, an emitting run that is gone. The branch gate then
+     * rejects naming that cause, instead of quoting the empty value as a branch
+     * name an operator could add to the restriction list. It never weakens the
+     * gate: a run with no branch cannot satisfy a restriction, `*` included.
+     */
+    internallyTriggered?: boolean;
 }
 /** Evaluate all protection rules for a context. */
 export declare function evaluateProtectionRules(env: Context, ctx: JobDispatchContext, currentRunningCount: number, concurrencyGroup: string, trustTier?: TrustTier): Promise<ProtectionGateResult>;

package/dist/contexts/release-queued-holds.d.ts

@@ -0,0 +1,35 @@
+import type { Kysely } from 'kysely';
+import type { Database } from '../db/types.js';
+import type { HeldRunStore, ReleaseSignal } from './held-runs.js';
+export interface ReleaseQueuedHoldsArgs {
+    db: Kysely<Database>;
+    heldRunStore: Pick<HeldRunStore, 'listQueuedHoldsForContext' | 'release'>;
+    orgId: string;
+    /** The context's concurrency group — `execution_runs.context`. */
+    concurrencyGroup: string;
+    /** The context's configured limit; `null`/`undefined` means unlimited. */
+    concurrencyLimit: number | null | undefined;
+    /** Resume a released hold by re-dispatching its job. */
+    onJobRelease: (signal: ReleaseSignal) => Promise<void>;
+}
+/**
+ * Count the jobs OCCUPYING a slot in a concurrency group, scoped to one org.
+ *
+ * A job occupies its slot from the moment it is dispatched until it reaches a
+ * terminal status — not merely while its status is `running`. Counting only
+ * `running` missed every job that had been dispatched but had not yet reported
+ * back, so the sweep read a full group as empty and released queued holds while
+ * their slots were still taken. That is a real over-admission, not a cosmetic
+ * one: the release path re-checks the limit precisely so the bound holds
+ * whenever the sweep happens to run, and an undercount defeats that re-check.
+ *
+ * The `customer_id` predicate is not optional: a context name shared across
+ * tenants would otherwise leak concurrency between them.
+ */
+export declare function countOccupyingJobs(db: Kysely<Database>, orgId: string, concurrencyGroup: string): Promise<number>;
+/**
+ * Release up to `limit - running` queued holds for a group, oldest first.
+ * Returns how many actually resumed.
+ */
+export declare function releaseQueuedHolds(args: ReleaseQueuedHoldsArgs): Promise<number>;
+//# sourceMappingURL=release-queued-holds.d.ts.map

package/dist/dashboard/attestation-filters.d.ts

@@ -50,7 +50,9 @@ export declare function baseAttestationsQuery(db: Kysely<Database>): import("kys
     join_tokens: import("../db/types.js").JoinTokenTable;
     kici_events: import("../db/types.js").KiciEventTable;
     orchestrator_signing_keys: import("../db/types.js").OrchestratorSigningKeysTable;
+    org_plan_headroom: import("../db/types.js").OrgPlanHeadroomTable;
     org_settings: import("../db/types.js").OrgSettingsTable;
+    org_trust_directory: import("../db/types.js").OrgTrustDirectoryTable;
     org_trust_policy: import("../db/types.js").OrgTrustPolicyTable;
     pending_attestations: import("../db/types.js").PendingAttestationsTable;
     pending_job_contexts: import("../db/types.js").PendingJobContextsTable;
@@ -62,6 +64,8 @@ export declare function baseAttestationsQuery(db: Kysely<Database>): import("kys
     run_ephemeral_keys: import("../db/types.js").RunEphemeralKeysTable;
     run_secret_outputs: import("../db/types.js").RunSecretOutputsTable;
     scaler_agent_jobs: import("../db/types.js").ScalerAgentJobsTable;
+    scaler_pending_claims: import("../db/types.js").ScalerPendingClaimsTable;
+    scaler_provision_outcomes: import("../db/types.js").ScalerProvisionOutcomesTable;
     scaler_reservations: import("../db/types.js").ScalerReservationsTable;
     scaler_spawning_agents: import("../db/types.js").ScalerSpawningAgentsTable;
     scoped_secrets: import("../db/types.js").ScopedSecretsTable;
@@ -121,7 +125,9 @@ export declare function basePendingAttestationsQuery(db: Kysely<Database>): impo
     join_tokens: import("../db/types.js").JoinTokenTable;
     kici_events: import("../db/types.js").KiciEventTable;
     orchestrator_signing_keys: import("../db/types.js").OrchestratorSigningKeysTable;
+    org_plan_headroom: import("../db/types.js").OrgPlanHeadroomTable;
     org_settings: import("../db/types.js").OrgSettingsTable;
+    org_trust_directory: import("../db/types.js").OrgTrustDirectoryTable;
     org_trust_policy: import("../db/types.js").OrgTrustPolicyTable;
     pending_attestations: import("../db/types.js").PendingAttestationsTable;
     pending_job_contexts: import("../db/types.js").PendingJobContextsTable;
@@ -133,6 +139,8 @@ export declare function basePendingAttestationsQuery(db: Kysely<Database>): impo
     run_ephemeral_keys: import("../db/types.js").RunEphemeralKeysTable;
     run_secret_outputs: import("../db/types.js").RunSecretOutputsTable;
     scaler_agent_jobs: import("../db/types.js").ScalerAgentJobsTable;
+    scaler_pending_claims: import("../db/types.js").ScalerPendingClaimsTable;
+    scaler_provision_outcomes: import("../db/types.js").ScalerProvisionOutcomesTable;
     scaler_reservations: import("../db/types.js").ScalerReservationsTable;
     scaler_spawning_agents: import("../db/types.js").ScalerSpawningAgentsTable;
     scoped_secrets: import("../db/types.js").ScopedSecretsTable;

package/dist/dashboard/handler.d.ts

@@ -1,16 +1,3 @@
-/**
- * Dashboard handler for the orchestrator.
- *
- * Responds to dashboard.* and run.* WS messages from Platform by querying the local
- * execution_jobs and execution_steps tables and reading logs from LogStorage.
- *
- * Supported messages:
- * - dashboard.run.detail: returns jobs with nested steps for a run
- * - dashboard.step.logs: returns log lines for a specific step
- * - dashboard.payload: returns the original webhook payload for a run
- * - run.rerun.request: re-runs a completed workflow run
- * - run.cancel.request: cancels a running workflow run
- */
 import { type Kysely } from 'kysely';
 import { type ColdStore } from '@kici-dev/shared';
 import type { DashboardRunDetailRequest, DashboardRunsListRequest, DashboardRunsListResponse, DashboardRunsFiltersRequest, DashboardRunsFiltersResponse, DashboardSourcesListRequest, DashboardSourcesListResponse, DashboardStepLogsRequest, DashboardAttestationsListRequest, DashboardAttestationsListAllRequest, DashboardAttestationGetRequest, DashboardAttestationRetryRequest, DashboardPayloadRequest, DashboardOrchLogsRequest, DashboardEventLogListRequest, DashboardEventLogActivityRequest, DashboardEventLogDetailRequest, DashboardEventLogPayloadStreamRequest, DashboardAccessLogListRequest, DashboardEventDlqListRequest, DashboardEventDlqCountRequest, DashboardEventDlqRetryRequest, DashboardEventDlqDiscardRequest, RunRerunRequest, RunCancelRequest, ManualScheduleRequest, DashboardRunStructuredRequest, DashboardArtifactsListRequest } from '@kici-dev/engine';
@@ -125,16 +112,12 @@ interface DashboardHandlerDeps {
      */
     eventStore?: EventStore | null;
     /**
-     * **Test-only.** Master switch for fault-injection knobs. When false the
-     * handler ignores every test-only knob below even if it is set.
+     * **Test-only fault injection**, supplied only by the build-time test double:
+     * `handleRerunRequest` awaits this hook before invoking `onRerun`, so an HA
+     * E2E can force a slow first coordinator and trigger a relay failover.
+     * Undefined (the shipped default) means no delay.
      */
-    testMode?: boolean;
-    /**
-     * **Test-only.** When set (and `testMode` is true), `handleRerunRequest`
-     * sleeps this many ms before invoking `onRerun`, so an HA E2E can force a
-     * slow first coordinator and trigger a relay failover. Ignored in production.
-     */
-    testRerunDelayMs?: number;
+    beforeRerun?: () => Promise<void>;
 }
 export declare class DashboardHandler {
     private readonly db;
@@ -153,8 +136,7 @@ export declare class DashboardHandler {
     private readonly eventStore;
     private readonly retryAttestations;
     private readonly provenanceSigningIssuer;
-    private readonly testMode;
-    private readonly testRerunDelayMs;
+    private readonly beforeRerun;
     constructor(deps: DashboardHandlerDeps);
     /**
      * Update the bound orgId + routingKey. Called from server.ts after resolving

package/dist/db/migrations/109_cluster_settings_cache_knobs.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=109_cluster_settings_cache_knobs.d.ts.map

package/dist/db/migrations/110_cluster_settings_global_eval_knobs.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=110_cluster_settings_global_eval_knobs.d.ts.map

package/dist/db/migrations/111_cluster_settings_global_eval_wait.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=111_cluster_settings_global_eval_wait.d.ts.map

package/dist/db/migrations/112_execution_runs_workflow_repo.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=112_execution_runs_workflow_repo.d.ts.map

package/dist/db/migrations/113_execution_runs_workflow_repo_index.d.ts

@@ -0,0 +1,30 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add the partial index `idx_execution_runs_workflow_repo` on
+ * `execution_runs (workflow_repo_identifier) WHERE workflow_repo_identifier IS NOT NULL`.
+ *
+ * Matching a workflow registration to its runs keys on the repository that
+ * DEFINES the workflow — `workflow_repo_identifier ?? repo_identifier` — which
+ * the orchestrator expresses as
+ * `workflow_repo_identifier IN (…) OR (workflow_repo_identifier IS NULL AND repo_identifier IN (…))`
+ * (`registration/registration-run-match.ts`). The second arm rides
+ * `idx_execution_runs_repo` from migration 001; the first arm had no index at
+ * all, because migration 112 added the column without one. A planner cannot
+ * use an index for only half a disjunction, so the whole predicate degraded to
+ * a sequential scan over a table that grows with every run — on
+ * `dashboard.registrations.list`, which runs its grouped MAX on every list
+ * request.
+ *
+ * With both arms indexed the planner can BitmapOr them.
+ *
+ * Partial by design, and the partiality is what makes it cheap: the column is
+ * non-null only for a cross-repository organization-wide run, a small minority
+ * of rows, so the index stays a fraction of the table's size and skips every
+ * per-repository run. It also matches the predicate exactly — the first arm
+ * can never match a NULL row, since `NULL IN (…)` is never true.
+ *
+ * Idempotent: `IF NOT EXISTS` makes a re-run a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=113_execution_runs_workflow_repo_index.d.ts.map

package/dist/db/migrations/114_ingest_queue_claim.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=114_ingest_queue_claim.d.ts.map

package/dist/db/migrations/115_global_workflows_cluster_switch.d.ts

@@ -0,0 +1,9 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+/**
+ * Restores the org column with its original NOT NULL DEFAULT false. A rollback
+ * cannot recover the per-org values the up-migration dropped — they are gone —
+ * so every org comes back at the opt-in default.
+ */
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=115_global_workflows_cluster_switch.d.ts.map

package/dist/db/migrations/116_org_plan_headroom.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<any>): Promise<void>;
+export declare function down(db: Kysely<any>): Promise<void>;
+//# sourceMappingURL=116_org_plan_headroom.d.ts.map

package/dist/db/migrations/117_invoke_gate_proxy_jobs.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=117_invoke_gate_proxy_jobs.d.ts.map

package/dist/db/migrations/118_invoke_gate_scheduling.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=118_invoke_gate_scheduling.d.ts.map

package/dist/db/migrations/119_scaler_ha_ownership.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=119_scaler_ha_ownership.d.ts.map

package/dist/db/migrations/120_cluster_settings_scaler_reaper.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=120_cluster_settings_scaler_reaper.d.ts.map

package/dist/db/migrations/121_org_settings_allow_untrusted_dockerfile_builds.d.ts

@@ -0,0 +1,19 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `org_settings.allow_untrusted_dockerfile_builds boolean NOT NULL DEFAULT false`.
+ *
+ * A job may build its container image from a Dockerfile in the repository. That
+ * build runs arbitrary `RUN` commands on the agent host's daemon, OUTSIDE the
+ * hardened posture the job's own steps get (`CapDrop: ALL`, no-new-privileges,
+ * pids/memory/CPU caps) — a build cannot be capability-restricted the way a
+ * container run can.
+ *
+ * So the default is deny for an untrusted ref (a fork PR, an unresolved
+ * contributor — the same classification the cache write scope uses). An operator
+ * who wants fork PRs building their own images turns it on per org, deliberately.
+ *
+ * Idempotent: a re-run on a DB that already has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=121_org_settings_allow_untrusted_dockerfile_builds.d.ts.map

package/dist/db/migrations/122_host_roster_scaler_managed.d.ts

@@ -0,0 +1,25 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `host_roster.scaler_managed boolean NOT NULL DEFAULT false`.
+ *
+ * `runsOnAll` fans a job out across the declared fleet. Every registering agent
+ * upserts a roster row, auto-scaler-spawned ones included, so a pre-spawned
+ * warm agent was a valid fan-out target — and a child pinned to it runs at the
+ * pool's fixed shape rather than its own. This column records the one fact that
+ * separates the two populations: whether a scaler backend spawned the agent.
+ *
+ * It is written from the scaler manager's registration lookup (a spawn record
+ * exists for the agent id), NOT from `lifecycle_class`. `lifecycle_class`
+ * snapshots the auth TOKEN's type and is `ephemeral` for every agent when the
+ * auth mode is `none`, so it cannot distinguish a fleet host from a scaler
+ * agent in that mode.
+ *
+ * DEFAULT false is load-bearing: a row written before this migration must read
+ * as not-scaler-managed so an existing fleet host stays a fan-out target
+ * immediately, without waiting to re-register.
+ *
+ * Idempotent: a re-run on a DB that already has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=122_host_roster_scaler_managed.d.ts.map

package/dist/db/migrations/123_workflow_registrations_default_branch.d.ts

@@ -0,0 +1,24 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `workflow_registrations.default_branch text` (nullable).
+ *
+ * A `__schedule_fire` run executes the default branch's lock file, so the
+ * default branch IS that run's branch — which is what a branch-restricted
+ * context needs in order to accept it. The value is already computed at
+ * registration time from the webhook payload (the default-branch-push check),
+ * it was simply never persisted, so a scheduled run had no branch to present.
+ *
+ * NULLABLE with no default, deliberately. The default branch is knowable only
+ * from a webhook payload, so there is nothing to backfill a pre-existing row
+ * with: a registration written before this migration reads NULL until its
+ * repo's next default-branch push re-registers it. The dispatch path reads NULL
+ * as "no branch" and the context branch gate then rejects with its honest
+ * named-cause verdict — a DEFAULT would instead invent a branch the
+ * registration never proved, which is exactly the confusion this whole column
+ * exists to end.
+ *
+ * Idempotent: a re-run on a DB that already has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=123_workflow_registrations_default_branch.d.ts.map

package/dist/db/migrations/124_cluster_settings_provision_backoff.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=124_cluster_settings_provision_backoff.d.ts.map

package/dist/db/migrations/125_org_trust_directory.d.ts

@@ -0,0 +1,30 @@
+import { type Kysely } from 'kysely';
+/**
+ * Create `org_trust_directory` — the orchestrator's cache of the Platform-owned
+ * approval directory pushed alongside the policy on `trust_policy.update`:
+ * identity links, per-member CI trust levels, and team memberships.
+ *
+ * A sibling of `org_trust_policy` rather than more columns on it: the policy is
+ * four scalar switches, while these three are structured documents the Platform
+ * replaces wholesale on every push — `identity_links` and `team_memberships`
+ * are arrays, `member_ci_trust` is a user-id-keyed map — so they are stored as
+ * JSONB.
+ *
+ * Persisting rather than holding them only in memory is what lets
+ * `/kici approve` authorize a commenter after a restart. Without a cached
+ * directory the orchestrator cannot map a comment author onto a KiCI user at
+ * all until the Platform's next push lands, so every approval is refused in the
+ * meantime.
+ *
+ * Wherever a Platform is attached it is the only writer of this row. An
+ * independent orchestrator has no Platform, so there the operator writes it
+ * through `kici-admin trust-policy directory-set`. The two are mutually
+ * exclusive — the admin route refuses the local write on any Platform-attached
+ * orchestrator — so a deployment still only ever has one writer, and there is
+ * no counterpart to `org_trust_policy.source` to record which it was.
+ *
+ * Idempotent: guarded by IF NOT EXISTS, so a re-run is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=125_org_trust_directory.d.ts.map

package/dist/db/migrations/126_held_runs_posted_pending_check.d.ts

@@ -0,0 +1,28 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `held_runs.posted_pending_check boolean` — whether this hold's pending
+ * `KiCI Security` check actually reached the provider.
+ *
+ * `postCheckStatus` CREATES the named check run when it finds none, so
+ * terminalizing a check the hold never posted does not close anything: it puts
+ * a completed `KiCI Security` run on a commit that had none. Whether a hold
+ * posted one was derived from the row's SHAPE, which answers what the code
+ * INTENDED — a post that the provider refused, or that no check poster was in
+ * reach to attempt, leaves a shape that says "posted" and a commit that has
+ * nothing. The column records what happened instead of what was meant.
+ *
+ * Nullable, with no default, and the three values are distinct:
+ *
+ * - `true` — the post returned successfully. The hold owns the check.
+ * - `false` — no post was attempted, or one was attempted and failed. Nothing
+ *   to terminalize; a settle would fabricate.
+ * - `null` — the row predates this column, so nothing recorded either way. The
+ *   shape derivation still answers for it. A `false` DEFAULT would instead
+ *   declare every hold pending at deploy time un-posted and strand the checks
+ *   they really do have.
+ *
+ * Idempotent: a re-run on a DB that already has the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=126_held_runs_posted_pending_check.d.ts.map