@kici-dev/orchestrator 0.5.0 → 0.6.1

package/dist/pipeline/processor.d.ts

@@ -36,15 +36,14 @@ import type { AgentRegistry } from '../agent/registry.js';
 import type { HostRosterStore } from '../agent/host-roster.js';
 import type { RunCoordinator } from '../cluster/coordinator.js';
 import type { ClusterSettingsReader } from '../cluster/cluster-settings-reader.js';
-import type { TeamMembershipLookup } from '../approvals/team-membership-lookup.js';
 import type { LogStorage } from '../reporting/log-storage.js';
 import type { LogWriter } from '../reporting/log-writer.js';
 import type { SecretResolverApi } from '../secrets/secret-resolver.js';
-import type { ContributorCache } from '../security/contributor-cache.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
 import type { LockFile as FullLockFile, LockWorkflow, SimulatedEvent, WebhookNormalizer } from '@kici-dev/engine';
 import { LockFileParseError } from '@kici-dev/engine';
 import type { EventRouter } from '../events/event-router.js';
+import type { InvokeGateDeps, InvokeGateParams } from './invoke-gate.js';
 import type { RegistrationStore } from '../registration/registration-store.js';
 import type { RegistrationIndex } from '../registration/registration-index.js';
 import type { CronScheduler } from '../cron/cron-scheduler.js';
@@ -54,10 +53,12 @@ import { EventLogSource } from '@kici-dev/engine';
 import type { LockJob } from '@kici-dev/engine';
 import type { ContextStore } from '../contexts/context-store.js';
 import type { VariableStore } from '../contexts/variable-store.js';
-import type { TrustResolver, IdentityLink, PermissionLevel } from '../security/trust-resolver.js';
+import type { IdentityLink, PermissionLevel } from '../security/identity-link.js';
 import { type HeldRunStore } from '../contexts/held-runs.js';
+import { type Context as EngineContext } from '@kici-dev/engine';
 import type { OrchestratorMode, WorkflowDecision } from '@kici-dev/engine';
 import type { TrustPolicyStore } from '../security/trust-policy-store.js';
+import type { TrustDirectoryStore } from '../security/trust-directory-store.js';
 /**
  * Pending dispatch context for jobs gated by the needs scheduler.
  * Keyed by `${runId}:${jobName}`. Populated at processWebhook time for all
@@ -69,6 +70,12 @@ import type { TrustPolicyStore } from '../security/trust-policy-store.js';
 interface PendingJobContext {
     jobInput: QueuedJobInput;
     runsOnLabels: string[];
+    /**
+     * When set, this pending job is an invoke gate: on release it summons the
+     * source repo's subscribers (`runInvokeGate`) instead of dispatching `jobInput`
+     * to an agent.
+     */
+    invoke?: InvokeGateParams;
 }
 /**
  * Register an eval gate and return a promise that resolves when the scheduler
@@ -242,8 +249,21 @@ export declare function extractInboundRepoIdentifier(payload: unknown): string |
 export declare function extractCommitMessage(event: string, payload: unknown): string | undefined;
 /**
  * Build a human-readable summary for a security hold check.
+ *
+ * `tier` is the resolved trust tier, or undefined when trust never resolved;
+ * the summary displays `unknown` for the latter. The caller passes the resolved
+ * value rather than forging `unknown` for an absent one, so this summary and
+ * `buildReducedPrivilegeNote` (`../security/reduced-privilege-note.ts`) cannot
+ * disagree about which case a run is in.
+ *
+ * Carries no reduced-privilege note of its own: the note is appended by the
+ * call site, because the two summaries this builds are read on checks with
+ * different fates. The trust-policy HOLD stores a resume context, so
+ * `/kici approve` replays its dispatch and its call site
+ * (`holdRunForSecurityPolicy`) appends the note; the trust-policy REJECTION
+ * never runs, so `buildSecurityRejectionSummary`'s call site appends nothing.
  */
-export declare function buildSecurityHoldSummary(reason: string, tier: string, contributorUsername?: string): string;
+export declare function buildSecurityHoldSummary(reason: string, tier: string | undefined, contributorUsername?: string): string;
 /**
  * Build the failure check-run description for a run the org trust policy
  * REJECTED.
@@ -252,8 +272,13 @@ export declare function buildSecurityHoldSummary(reason: string, tier: string, c
  * `held_runs` row, so telling the contributor to seek "approval from a user
  * with ci_trust:write or higher" points at a queue the run will never appear
  * in. Only an org policy change can unblock it.
+ *
+ * Carries no reduced-privilege note for the same reason: the summary's own next
+ * line says the run cannot be approved, so a posture note beside it would read
+ * as "it ran with reduced privileges and that is why it failed" for a run that
+ * never dispatched at all.
  */
-export declare function buildSecurityRejectionSummary(reason: string, message: string, tier: string, contributorUsername?: string): string;
+export declare function buildSecurityRejectionSummary(reason: string, message: string, tier: string | undefined, contributorUsername?: string): string;
 /**
  * Build the pending check-run description for a job/workflow approval hold,
  * naming the clauses an approver must satisfy. `{team:X}` renders as
@@ -265,6 +290,19 @@ export declare function summarizeApprovalClauses(clauses: ReadonlyArray<{
 } | {
     user: string;
 }>): string;
+/**
+ * The line appended to an approval hold's check description when a security
+ * trust hold gates the SAME job.
+ *
+ * Both holds must be answered before the job runs, and the check run carries one
+ * description. Without this line the check names only the approval clauses — so
+ * the named approver approves, nothing runs, and the text does not change: a
+ * contributor is left with a satisfied requirement, no statement of what is
+ * still outstanding, and no idea that a different permission clears it. Naming
+ * the second gate and how it is released is the minimum that makes the check
+ * honest.
+ */
+export declare const SECURITY_HOLD_ALSO_GATES_NOTE: string;
 /**
  * Dependencies for the processing pipeline.
  * All injected for testability. Fully provider-agnostic.
@@ -356,6 +394,12 @@ export interface ProcessingDeps {
     } | undefined>) => void;
     /** Event router for registering lock file event subscriptions. Optional -- if not set, event routing is inactive. */
     eventRouter?: EventRouter;
+    /**
+     * Invoke-gate dependencies (summon callback + chain-depth bound). Optional --
+     * when absent an invoke gate cannot summon (it fails loudly rather than
+     * silently reaching an agent). Built at the composition root.
+     */
+    invokeGateDeps?: InvokeGateDeps;
     /** Registration store for persisting workflow registrations. Optional -- if not set, registration is skipped. */
     registrationStore?: RegistrationStore;
     /** Registration index for in-memory lookup. Optional -- if not set, registration is skipped. */
@@ -381,8 +425,6 @@ export interface ProcessingDeps {
     variableStore?: VariableStore;
     /** Held run store for persisting protection rule holds. Optional -- if not set, holds are not persisted. */
     heldRunStore?: HeldRunStore;
-    /** Trust resolver for determining contributor trust tiers. Optional -- if not set, trust resolution is skipped. */
-    trustResolver?: TrustResolver;
     /**
      * Cache of the Platform-owned org trust policy. Read per PR event by the
      * trust-policy gate. Optional so existing tests and independent deployments
@@ -397,16 +439,26 @@ export interface ProcessingDeps {
      * so a hand-built deps object never accidentally opens the gate.
      */
     orchestratorMode?: OrchestratorMode;
-    /** Identity links pushed from Platform for trust resolution. Optional -- defaults to empty. */
+    /** Identity links pushed from Platform, read by the comment-approval path. Optional -- defaults to empty. */
     identityLinks?: IdentityLink[];
     /** ci_trust permission levels per user ID from Platform push. Optional -- defaults to empty. */
     orgMemberPermissions?: Map<string, PermissionLevel>;
     /**
-     * Team-membership lookup pushed from the Platform (team name → member set).
-     * Consumed by the approval resolver to satisfy `{team}` approval clauses.
-     * Optional -- defaults to "no teams".
+     * Persisted approval directory, read at `/kici approve` time when neither
+     * `identityLinks` nor `orgMemberPermissions` was supplied.
+     *
+     * The two fields above are the Platform-push path: `server.ts` keeps them in
+     * memory and refreshes them on every `trust_policy.update`, so it always
+     * supplies both and this store is never consulted there. Every other
+     * assembly of these deps — the direct-ingress pipeline in `app.ts`, which is
+     * the ONLY one an independent orchestrator has — supplies neither, and
+     * without this store its approval path would resolve an empty directory and
+     * refuse every commenter forever.
+     *
+     * Optional so a hand-built deps object keeps working; the read is skipped
+     * when it is absent.
      */
-    teamMembershipLookup?: TeamMembershipLookup;
+    trustDirectoryStore?: TrustDirectoryStore;
     /** Global workflow policy for org-level permission enforcement. Optional -- if not set, global workflows are unrestricted. */
     globalWorkflowPolicy?: GlobalWorkflowPolicy;
     /** Inbound webhook delivery log writer. Optional -- if not set, deliveries are not persisted to event_log. */
@@ -415,11 +467,6 @@ export interface ProcessingDeps {
      *  Used by the eventLog writer to populate the source column. Defaults to
      *  'direct' when omitted (independent / direct paths). */
     eventLogSource?: EventLogSource;
-    /** Contributor permission cache. Optional -- if not set, membership-webhook
-     *  invalidations silently no-op. In platform/hybrid mode the singleton is
-     *  created in server.ts and threaded through both the Platform-relay WS
-     *  path and the generic webhook HTTP path. */
-    contributorCache?: ContributorCache;
     /** Access-log writer for the orchestrator audit stream. Optional -- if not
      *  set, hold-creation audit rows (`held_run.request`) are skipped. */
     accessLogWriter?: AccessLogWriter;
@@ -443,6 +490,120 @@ export interface ProcessingDeps {
  */
 export declare function anyTriggerHasPathPatterns(workflows: LockWorkflow[]): boolean;
 export { processWebhook } from './process-webhook.js';
+/** How many times {@link hasPendingHold} reads before it gives up and refuses. */
+export declare const PENDING_HOLD_READ_ATTEMPTS = 3;
+/** Backoff between {@link hasPendingHold} attempts, multiplied by the attempt number. */
+export declare const PENDING_HOLD_RETRY_BASE_MS = 25;
+/**
+ * Is there a still-pending hold for this (run, job)?
+ *
+ * `held_runs.job_id` carries the expanded job NAME for job-scoped holds, which
+ * is the same key the pending dispatch context uses. A missing row, or any
+ * non-pending status, means nothing is gating the job.
+ *
+ * **Fails CLOSED** once the read has genuinely failed: a job whose hold state
+ * cannot be read is treated as held and left for the release path. This gate is
+ * the enforcement point for "every requirement answered" on a job carrying two
+ * holds — the reviewer row and the security row are written together and BOTH
+ * must leave `pending` before dispatch — so answering `false` on a read error
+ * dispatched a job with neither hold released and the approval boundary
+ * bypassed entirely. That is unrecoverable; the failure in the other direction
+ * is not.
+ *
+ * A refusal leaves the job pending rather than losing it: the context is not
+ * consumed (the check runs before the consume), every release path re-drives
+ * `dispatchReadyJob`, and the needs-scheduler recovery loop on the next start
+ * recomputes `needs_satisfied` for every non-terminal run and re-fires the
+ * ready jobs. So the worst case of a closed failure is a delay, against a
+ * silently bypassed approval for an open one.
+ *
+ * The retries are what keep that trade cheap. The realistic error here is a
+ * transient one — a deadlock, a statement timeout, a lost connection — and a
+ * single blip must not park a job until the next restart, so the read is
+ * attempted {@link PENDING_HOLD_READ_ATTEMPTS} times with a short linear
+ * backoff before the refusal stands.
+ */
+export declare function hasPendingHold(db: Kysely<Database>, runId: string, jobName: string, opts?: {
+    attempts?: number;
+    retryBaseMs?: number;
+}): Promise<boolean>;
+/** Read attempts for the needs verdict, mirroring {@link PENDING_HOLD_READ_ATTEMPTS}. */
+export declare const NEEDS_READ_ATTEMPTS = 3;
+/** Linear backoff base between needs-verdict read attempts. */
+export declare const NEEDS_RETRY_BASE_MS = 25;
+/**
+ * Read whether a job's `needs` upstreams are satisfied, for the dispatch guard.
+ *
+ * Fails CLOSED, exactly as {@link hasPendingHold} does and for the same reason:
+ * an unreadable verdict must never be read as permission to dispatch. A closed
+ * failure returns `{ satisfied: false }`, which the guard treats as "upstream
+ * still pending" — the recoverable branch, since the start-up recovery loop
+ * recomputes `needs_satisfied` for every non-terminal run and re-fires its ready
+ * jobs, and the stale-run expiry sweep is the backstop.
+ *
+ * Reads only. It never writes `needs_satisfied` — the scheduler owns that claim.
+ */
+export declare function readNeedsVerdict(db: Kysely<Database>, runId: string, jobName: string, opts?: {
+    attempts?: number;
+    retryBaseMs?: number;
+}): Promise<{
+    satisfied: boolean;
+    action?: 'dispatch' | 'skip';
+    reason?: string;
+}>;
+/**
+ * The subset of a context row the ready-dispatch re-gate reads.
+ *
+ * `ContextStore.matchContext` returns the raw `contexts` row, so the field names
+ * are snake_case. `concurrency_strategy` and `hold_expiry_seconds` are optional
+ * because the release-path callers already in the tree narrow their closure to
+ * `concurrency_limit` alone; an absent strategy resolves to
+ * {@link DEFAULT_CONCURRENCY_STRATEGY} and an absent hold window to
+ * {@link DEFAULT_HOLD_EXPIRY_SECONDS}, which are also the columns' own defaults.
+ */
+export interface ReadyDispatchContextRow {
+    id: string;
+    concurrency_limit: number | null;
+    concurrency_strategy?: string | null;
+    hold_expiry_seconds?: number | null;
+}
+/** Inputs the ready-dispatch concurrency re-gate needs. Absent = no re-gate. */
+export interface ReadyDispatchGateDeps {
+    matchContext: (orgId: string, name: string) => Promise<ReadyDispatchContextRow | null>;
+    heldRunStore: Pick<HeldRunStore, 'create'>;
+    /**
+     * Audits each re-hold, mirroring the `held_run.request` row the dispatch-pass
+     * path writes for every hold it mints. Optional: a call site with no writer
+     * still gates, exactly as the dispatch path's own `accessLogWriter?.record`
+     * degrades.
+     */
+    accessLogWriter?: Pick<AccessLogWriter, 'record'>;
+    /** The routing key the audit row is attributed to, when the call site knows it. */
+    routingKey?: string | null;
+}
+/** What {@link resolveRunConcurrency} needs to evaluate the concurrency gate. */
+export interface RunConcurrency {
+    orgId: string;
+    group: string;
+    contextId: string;
+    limit: number | null;
+    strategy: EngineContext['concurrencyStrategy'];
+    /**
+     * The context's own hold window, seconds. A queued hold this gate mints must
+     * expire on the same schedule as one the dispatch pass mints for the same
+     * context, or an operator's configured queue timeout applies to one path and
+     * not the other.
+     */
+    holdExpirySeconds: number;
+}
+/**
+ * Resolve a run's bound context to the inputs the concurrency gate needs.
+ *
+ * `null` means no concurrency constraint applies — the run has no bound context,
+ * or the context it names no longer exists. That is the common case, so the cost
+ * on the ready-dispatch path is one indexed lookup by `run_id`.
+ */
+export declare function resolveRunConcurrency(db: Kysely<Database>, matchContext: ReadyDispatchGateDeps['matchContext'], runId: string): Promise<RunConcurrency | null>;
 /**
  * Dispatch a job that has become ready via the needs scheduler.
  *
@@ -451,20 +612,64 @@ export { processWebhook } from './process-webhook.js';
  * dispatches the job through the normal dispatcher path, and updates the
  * execution tracker with the real job ID.
  */
-export declare function dispatchReadyJob(runId: string, jobName: string, dispatcher: Dispatcher, executionTracker?: ExecutionTracker, coordinator?: RunCoordinator, db?: Kysely<Database>): Promise<void>;
+export declare function dispatchReadyJob(runId: string, jobName: string, dispatcher: Dispatcher, executionTracker?: ExecutionTracker, coordinator?: RunCoordinator, db?: Kysely<Database>, invokeGateDeps?: InvokeGateDeps, gateDeps?: ReadyDispatchGateDeps): Promise<void>;
 /**
- * Check whether a webhook event is a push to the repository's default branch.
- * Used to trigger registration extraction for workflow event subscriptions.
+ * Read the repository's default branch out of a webhook payload.
  *
- * Resolution order for the default branch:
+ * Resolution order:
  *   1. `normalizer.extractDefaultBranch?(payload)` — provider-specific hook
  *      (universal-git reads a JSONPath from the source's `payloadPaths.defaultBranch`).
  *   2. Fallback to `payload.repository.default_branch` — the GitHub-shaped
  *      default that most forges mirror.
+ *
+ * `null` when neither source names one. Shared by `isDefaultBranchPush` (which
+ * compares it against the pushed branch) and the registration write path (which
+ * persists it, so a scheduled run can present it as its own branch).
+ */
+export declare function extractDefaultBranch(payload: Record<string, unknown>, normalizer: WebhookNormalizer): string | null;
+/**
+ * Check whether a webhook event is a push to the repository's default branch.
+ * Used to trigger registration extraction for workflow event subscriptions.
  */
 export declare function isDefaultBranchPush(info: WebhookInfo, event: SimulatedEvent, payload: Record<string, unknown>, normalizer: WebhookNormalizer): boolean;
+/**
+ * Cap on the per-decision trace forwarded to the Platform.
+ *
+ * A fixed bound on a debug payload, not a behavior an operator tunes: the
+ * summary rides an `execution.event` and lands in a stored row, so an
+ * essay-length trace from a workflow with hundreds of triggers must not be able
+ * to grow either without limit.
+ */
+export declare const DECISION_TRACE_MAX_CHECKS = 50;
 /**
  * Create a serializable summary of a workflow decision for Platform forwarding.
+ *
+ * Carries the individual checks, capped, so the dashboard can answer "why did
+ * this workflow not fire" from the delivery alone. `checksCount` stays the
+ * untruncated total, and `checksTruncated` marks a trace the cap shortened.
  */
 export declare function summarizeDecision(decision: WorkflowDecision): Record<string, unknown>;
+/**
+ * Byte budget for the whole forwarded trace, across every workflow on the
+ * delivery.
+ *
+ * The per-decision check cap and the per-field text clamp bound one entry; this
+ * bounds the frame. One event is evaluated against every workflow in the lock
+ * file plus every organization-wide registration, so a repository with a
+ * hundred comment-triggered workflows multiplies a bounded entry into an
+ * unbounded message. A frame past the Platform's WebSocket payload ceiling
+ * closes the orchestrator's connection, stalling every delivery for that
+ * organization until it reconnects — so the budget sits well under the
+ * Platform's own storage guard, which is then a backstop rather than the only
+ * limit.
+ */
+export declare const DECISION_TRACE_MAX_BYTES = 131072;
+/**
+ * Bound the serialized trace, replacing whatever did not fit with a marker.
+ *
+ * Truncating rather than dropping keeps the delivery's answer to "why did my
+ * workflow not fire" partially readable, and says out loud that the rest was
+ * dropped.
+ */
+export declare function capDecisionSummaries(summaries: readonly Record<string, unknown>[], maxBytes?: number): Record<string, unknown>[];
 //# sourceMappingURL=processor.d.ts.map

package/dist/pipeline/rerun.d.ts

@@ -27,6 +27,7 @@ import type { SourceCache } from '../cache/index.js';
 import type { BuildCoordinator } from '../cache/index.js';
 import type { DepCache } from '../cache/index.js';
 import type { PendingBuildTracker } from '../cache/index.js';
+import type { ProcessingDeps } from './processor.js';
 /**
  * Thrown when a rerun is attempted on a run whose row is absent from PG AND
  * the cold-store replay path failed or is unavailable (chunk missing,
@@ -65,6 +66,17 @@ export interface RerunDeps {
      * cold-store wired up.
      */
     coldStore: ColdStore | null;
+    /**
+     * The live webhook-processing bag, assembled on demand.
+     *
+     * Only the re-run of a failed global evaluation round needs it: that re-run
+     * re-drives the organization-wide pass, which reaches deps an ordinary
+     * workflow re-run never touches (the registration index, the policy reader,
+     * the pending-eval tracker). Supplied by the entry point that already
+     * assembles the bag for the inbound webhook path, so the two cannot drift.
+     * Absent means round re-runs are not available on this deployment.
+     */
+    processingDeps?: (() => ProcessingDeps) | null;
 }
 export declare function handleRerun(originalRunId: string, triggeredBy: string | null, triggeredByAgentLabel: string | null, deps: RerunDeps, 
 /**
@@ -83,4 +95,13 @@ requestId: string,
 routingKeyHint?: string): Promise<{
     newRunId: string;
 }>;
+/**
+ * Settle every detached re-evaluation started so far.
+ *
+ * Nothing in a running orchestrator calls this — the re-evaluation is detached
+ * precisely so no request waits on it. It exists so a caller that needs the
+ * work to have finished (a test asserting on the pass) can wait for it
+ * deterministically instead of racing the microtask queue.
+ */
+export declare function settlePendingRoundReevaluations(): Promise<void>;
 //# sourceMappingURL=rerun.d.ts.map

package/dist/pipeline/resume-workflow.d.ts

@@ -4,23 +4,56 @@ import type { ProcessingDeps } from './processor.js';
 import type { ReleaseSignal } from '../contexts/held-runs.js';
 import { type WorkflowDispatchContext } from './dispatch-matched-workflow.js';
 import { type SerializableWorkflowDispatchInputs } from './pending-workflow-context.js';
+import { type SecurityCheckHold } from './security-hold-check.js';
 /**
  * Rebuild a live `WorkflowDispatchContext` from the persisted serializable
  * inputs by re-attaching the orchestrator's live `deps` and reconstructing the
  * provider `bundle` from the live registry (keyed by the stored routing key).
  * Returns null when the provider bundle can no longer be resolved.
+ *
+ * The key it looks the bundle up by is `effectiveRoutingKey ?? info.routingKey`
+ * — the post-overlay key, the same one `setupDispatchContext` builds
+ * `setup.info` from and the same one the run row records. `info.routingKey` is
+ * the INBOUND key and never carries the overlay, so on a cross-source or
+ * fallback-resolved dispatch it names the source the event arrived on rather
+ * than the source the workflow belongs to: the resumed run would get the wrong
+ * app, the wrong credentials, and a check poster writing to the wrong place.
  */
 export declare function rebuildWorkflowDispatchContext(inputs: SerializableWorkflowDispatchInputs, deps: ProcessingDeps): WorkflowDispatchContext | null;
 /**
- * Resume a released workflow install-gate hold. Loads the pending context,
- * rebuilds the dispatch context, and re-dispatches with the gate skipped. On a
- * lost pending context (or unresolvable provider bundle) the run is failed
- * loudly rather than silently dropped.
+ * Resume a released workflow-scoped hold. Loads the pending context, rebuilds
+ * the dispatch context, and re-dispatches. On a lost pending context (or
+ * unresolvable provider bundle) the run is failed loudly rather than silently
+ * dropped.
  */
 export declare function resumeWorkflow(signal: ReleaseSignal, deps: ProcessingDeps, db: Kysely<Database> | undefined): Promise<void>;
 /**
- * Cancel a rejected workflow install-gate hold: mark the run cancelled and drop
- * the pending context.
+ * Cancel a rejected workflow-scoped hold (install gate or trust policy): mark
+ * the run cancelled, complete the check runs the dispatch already posted, and
+ * drop the pending context.
+ *
+ * The check runs are completed `cancelled`, matching the run row this writes —
+ * `cancelHeldRun` sets `execution_runs.status` to `cancelled` with failure class
+ * `cancelled`. Without this the workflow and per-job checks stay `queued` on the
+ * commit for a run that will never start; see `completeUndispatchedHoldChecks`.
+ * It runs before the delete because the pending context is what the check-run
+ * names are derived from.
+ *
+ * The hold row decides whether the `KiCI Security` check is terminalized too:
+ * the trust policy's PR-wide hold and the SDK's workflow-level `requireApproval`
+ * each posted one pending, while the install gate posted none and must not have
+ * one fabricated. That is `postedPendingSecurityCheck`'s job — see it for the
+ * per-shape derivation, and for why `queue_type` cannot make the distinction.
+ *
+ * This is the single writer of that check for a rejection, on both surfaces the
+ * shared applier serves: the dashboard / CLI / MCP reject reaches it through
+ * `applyDecision`'s `onWorkflowReject`, and `/kici reject` through the comment
+ * handler's. Both therefore render identically on the pull request, and the
+ * summary below is the one both check families carry. The returned boolean says
+ * whether a security check was actually WRITTEN, so a caller suppresses its own
+ * post on the strength of a write rather than of a delegate resolving —
+ * a rejection this declines to report (an install gate, or a commit whose other
+ * holds are still pending) leaves the caller free to decide for itself.
  */
-export declare function rejectWorkflow(runId: string, deps: ProcessingDeps, db: Kysely<Database> | undefined, reason: string): Promise<void>;
+export declare function rejectWorkflow(hold: SecurityCheckHold, deps: ProcessingDeps, db: Kysely<Database> | undefined, reason: string): Promise<boolean>;
 //# sourceMappingURL=resume-workflow.d.ts.map

package/dist/pipeline/route-or-dispatch-jobs.d.ts

@@ -11,6 +11,7 @@
  */
 import { createLogger } from '@kici-dev/shared';
 import type { LockJob, MaterializedJob } from '@kici-dev/engine';
+import type { JobKind } from '../db/types.js';
 import type { RunContext, RunCoordinator } from '../cluster/coordinator.js';
 import type { Dispatcher } from '../agent/dispatcher.js';
 import type { ExecutionTracker } from '../reporting/execution-tracker.js';
@@ -25,6 +26,14 @@ export interface DispatchedJobEntry {
      * groups a wave's children by — a NULL there makes the wave gate bail.
      */
     baseJobName?: string;
+    /**
+     * `gate` marks an invoke-gate row (runs the gate executor, never an agent).
+     * The global-workflow dispatch path registers a gate as a synthetic pending
+     * row and carries its kind through to `execution_jobs.job_kind`.
+     */
+    jobKind?: JobKind;
+    /** For a gate job, its wall-clock timeout in ms (orchestrator-swept). */
+    timeoutMs?: number;
 }
 export interface RejectedJobEntry {
     jobId: string;