@kici-dev/orchestrator 0.4.0 → 0.6.0

package/dist/db/migrations/127_org_trust_policy_approval_expiry_seconds.d.ts

@@ -0,0 +1,26 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `org_trust_policy.approval_expiry_seconds` (nullable INTEGER).
+ *
+ * The authoritative security-hold window, at the granularity the existing
+ * `approval_expiry_hours` cannot express. Nullable rather than NOT NULL with a
+ * default, and deliberately NOT backfilled: NULL means "no seconds value was
+ * ever written", and every reader falls back to `approval_expiry_hours * 3600`
+ * for such a row. A backfill would have to guess, and a NOT NULL default would
+ * make a row written by an older build — which does not know the column —
+ * silently claim the default window instead of the hours the operator set.
+ *
+ * The same shape `contexts.hold_expiry_seconds` already uses for the same
+ * reason: "null = unset, the default window applies".
+ *
+ * `approval_expiry_hours` is kept. It is not dead — it is still the only window
+ * an older peer can read, and it is still what a partial write supplies — so
+ * dropping it would be a destructive schema change against a protected surface
+ * and would break a rollback outright (the column is NOT NULL with no default).
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has
+ * the column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=127_org_trust_policy_approval_expiry_seconds.d.ts.map

package/dist/db/migrations/128_execution_runs_global_eval_round.d.ts

@@ -0,0 +1,23 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `execution_runs.is_global_eval_round boolean NOT NULL DEFAULT false` —
+ * the structural marker for a run row that records a global evaluation round
+ * rather than a workflow.
+ *
+ * The re-run path must recognise such a run: re-running it re-executes the
+ * evaluation, not a workflow. The only discriminator available to it otherwise
+ * is the round job's `__globaleval__` name prefix, which a customer workflow
+ * may carry — a name a customer chooses cannot decide which code path a re-run
+ * takes. A column stamped where the round failure is recorded is
+ * collision-proof.
+ *
+ * `NOT NULL DEFAULT false` because the question has exactly two answers: every
+ * pre-existing row is an ordinary run, and there is no third "unknown" reading
+ * a null would carry.
+ *
+ * Idempotent: the add is guarded on existence and the drop uses IF EXISTS, so a
+ * re-run is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=128_execution_runs_global_eval_round.d.ts.map

package/dist/db/migrations/129_execution_runs_dispatch_routing_key.d.ts

@@ -0,0 +1,24 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `execution_runs.dispatch_routing_key TEXT NULL` — the source whose
+ * credentials a run's `provider_context` actually holds.
+ *
+ * `routing_key` records the source the event ARRIVED on. For a cross-provider
+ * global workflow those are two different sources: the lock file resolves
+ * through another source's bundle, and `provider_context` is written from that
+ * source's credentials. Anything that pairs the inbound routing key with the
+ * stored context therefore hands one source's credentials to another source's
+ * API client — the re-run of a failed evaluation round did exactly that, and
+ * the resulting fetch either fails or reads the wrong tree.
+ *
+ * Nullable, with no default: NULL means "the same source the event arrived on",
+ * which is true of every run except a cross-provider dispatch and of every row
+ * written before this column existed. A default would have to name a routing
+ * key, and there is no cluster-wide one to name.
+ *
+ * Idempotent: the add is guarded on existence and the drop uses IF EXISTS, so a
+ * re-run is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=129_execution_runs_dispatch_routing_key.d.ts.map

package/dist/db/migrations/130_scaler_provision_outcomes.d.ts

@@ -0,0 +1,32 @@
+import { type Kysely } from 'kysely';
+/**
+ * Durable per-provision outcome, keyed by agent id.
+ *
+ * `scaler_spawning_agents` is deleted the moment a provision is torn down, so
+ * its absence cannot tell "this provision was never adopted" from "this
+ * provision was adopted and has since been torn down". The stale-spawn prune
+ * has to separate exactly those two, because the first is a real external
+ * provisioning failure every coordinator must back off on, and the second is a
+ * healthy provision that must not be reported at all.
+ *
+ * This table carries the positive signal the spawn row cannot: the adoption is
+ * written in the same transaction that stamps `adopted_by`, and it outlives the
+ * spawn row's delete. Deliberately a separate table rather than a column on
+ * `scaler_spawning_agents`: that row's delete is what the per-coordinator
+ * provisioning backoff depends on, so it is left exactly as it is.
+ *
+ * `adopted_*` and `condemned_*` are independent. A provision that was adopted
+ * and later condemned by the reaper carries BOTH, and the condemn write never
+ * touches the adoption columns — losing the adoption fact would restore the
+ * misattribution this table exists to remove.
+ *
+ * Rows are purged by the leader-gated reaper once the spawn row is gone and the
+ * retention floor has passed; see `ScalerStateStore.purgeProvisionOutcomes`.
+ *
+ * Idempotent: both statements are guarded by IF NOT EXISTS, so a re-run is a
+ * no-op — including a re-run over a database that has the table but not the
+ * index, which an existence probe over the table alone would skip.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=130_scaler_provision_outcomes.d.ts.map