@kici-dev/orchestrator 0.7.0 → 0.9.0

package/dist/cluster/cluster-settings-reader.d.ts

@@ -1,9 +1,7 @@
 import type { Kysely } from 'kysely';
 import type { Database } from '../db/types.js';
 /** Numeric columns on cluster_settings readable via {@link ClusterSettingsReader}. */
-export type ClusterNumberColumn = 'max_github_payload_bytes' | 'event_log_max_payload_bytes' | 'lock_file_max_bytes' | 'webhook_dedup_ttl_ms'
-/** @deprecated Readable, but no call site reads it. Removed at v1.0.0. */
- | 'contributor_cache_ttl_ms' | 'event_router_event_ttl_seconds' | 'event_router_max_dispatch_attempts' | 'queue_max_depth' | 'reroute_flap_grace_ms' | 'max_fanout_hosts' | 'event_router_rate_limit_per_workflow_per_minute' | 'cache_max_tarball_bytes' | 'cache_ttl_days' | 'lockfile_cache_max' | 'lockfile_cache_max_bytes' | 'lockfile_cache_ttl_ms' | 'content_cache_max' | 'content_cache_max_bytes' | 'content_cache_ttl_ms' | 'global_eval_round_timeout_ms' | 'global_eval_candidate_timeout_ms' | 'global_eval_cache_max' | 'global_eval_wait_timeout_ms' | 'check_run_tracking_ttl_days' | 'run_retention_days' | 'audit_retention_days' | 'provenance_retention_days' | 'held_run_retention_days' | 'concurrency_wait_timeout_ms' | 'agent_token_ttl_ms' | 'ownership_db_check_timeout_ms' | 'unroutable_grace_ms' | 'ingest_overflow_claim_timeout_ms' | 'scaler_reap_interval_ms' | 'scaler_reap_stranded_timeout_ms' | 'scaler_reap_reattempt_interval_ms' | 'scaler_claim_retention_ms' | 'scaler_provision_backoff_base_ms' | 'scaler_provision_backoff_max_ms' | 'scaler_provision_max_consecutive_failures';
+export type ClusterNumberColumn = 'max_github_payload_bytes' | 'event_log_max_payload_bytes' | 'lock_file_max_bytes' | 'webhook_dedup_ttl_ms' | 'event_router_event_ttl_seconds' | 'event_router_max_dispatch_attempts' | 'queue_max_depth' | 'reroute_flap_grace_ms' | 'max_fanout_hosts' | 'event_router_rate_limit_per_workflow_per_minute' | 'cache_max_tarball_bytes' | 'cache_ttl_days' | 'lockfile_cache_max' | 'lockfile_cache_max_bytes' | 'lockfile_cache_ttl_ms' | 'content_cache_max' | 'content_cache_max_bytes' | 'content_cache_ttl_ms' | 'global_eval_round_timeout_ms' | 'global_eval_candidate_timeout_ms' | 'global_eval_cache_max' | 'global_eval_wait_timeout_ms' | 'check_run_tracking_ttl_days' | 'run_retention_days' | 'audit_retention_days' | 'provenance_retention_days' | 'held_run_retention_days' | 'concurrency_wait_timeout_ms' | 'agent_token_ttl_ms' | 'ownership_db_check_timeout_ms' | 'unroutable_grace_ms' | 'ingest_overflow_claim_timeout_ms' | 'scaler_reap_interval_ms' | 'scaler_reap_stranded_timeout_ms' | 'scaler_reap_reattempt_interval_ms' | 'scaler_claim_retention_ms' | 'scaler_provision_backoff_base_ms' | 'scaler_provision_backoff_max_ms' | 'scaler_provision_max_consecutive_failures';
 /** Text columns on cluster_settings readable via {@link ClusterSettingsReader}. */
 export type ClusterStringColumn = 'dashboard_verified_issuer';
 /** Boolean columns on cluster_settings readable via {@link ClusterSettingsReader}. */

package/dist/cluster/coordinator.d.ts

@@ -46,7 +46,6 @@ export interface JobToRoute {
     ref: string;
     sha: string;
     sourceTarUrl?: string;
-    sourceTarHash?: string;
     sourceTarDigest?: string;
     depsUrl?: string;
     depsHash?: string;
@@ -305,8 +304,8 @@ export declare class RunCoordinator {
      * tracking entry once the shared row is terminal, otherwise re-arm the window
      * as a reap poll.
      *
-     * The entry cannot simply be dropped here: cancel propagation still needs it
-     * while the job runs. It also cannot simply be kept, because a peer
+     * The entry cannot be dropped here: cancel propagation still needs it
+     * while the job runs. It also cannot be kept, because a peer
      * COORDINATOR relays no terminal `job.progress` — the shared row IS its
      * report — so nothing else would ever release it and `reroutedJobs` would
      * grow for the lifetime of the process. A read fault re-arms (never releases),

package/dist/cluster/join-client.d.ts

@@ -22,45 +22,15 @@ interface JoinClientOptions {
     peerUrl?: string;
     /** API key for Platform authentication (required for --platform mode) */
     apiKey?: string;
-    /**
-     * Path to write the resulting local config YAML.
-     *
-     * @deprecated The orchestrator boots from its environment, so nothing reads
-     * this file. Leave it unset and use {@link JoinClientOptions.envFilePath}.
-     */
-    configPath?: string;
     /** Path to write the env file `orchestrator install --env-file` consumes. */
     envFilePath?: string;
 }
 /** Default path the join writes its env file to. */
 export declare const DEFAULT_JOIN_ENV_FILE = "./kici-orchestrator.env";
-/**
- * Local config structure written by the deprecated `--config` path.
- *
- * @deprecated `loadLocalConfig()` strips `storage` and `secrets`, and the boot
- * path never reads the file at all.
- */
-interface JoinLocalConfig {
-    database: {
-        url: string;
-    };
-    storage?: ConfigBundle['storage'];
-    secrets?: {
-        key: string;
-    };
-}
 /**
  * Decrypt a base64-encoded encrypted config bundle using a derived encryption key.
  */
 export declare function decryptAndParseBundle(encryptedB64: string, encryptionKey: Buffer): ConfigBundle;
-/**
- * Build a JoinLocalConfig from a decrypted ConfigBundle.
- * Maps bundle fields to the structure expected by loadLocalConfig().
- *
- * @deprecated Feeds the deprecated `--config` artifact. Use
- * {@link buildEnvFile}.
- */
-export declare function buildLocalConfig(bundle: ConfigBundle): JoinLocalConfig;
 /**
  * Startup environment variable each `ConfigBundle.storage` field is delivered
  * through.
@@ -93,13 +63,6 @@ export declare function buildEnvFile(bundle: ConfigBundle): string;
  * Write the env file the orchestrator boots from.
  */
 export declare function writeEnvFile(path: string, bundle: ConfigBundle): Promise<void>;
-/**
- * Write a local config object to a YAML file.
- *
- * @deprecated The orchestrator boot path is environment-only, so nothing reads
- * this file. Use {@link writeEnvFile}.
- */
-export declare function writeConfigFile(path: string, config: Record<string, unknown>): Promise<void>;
 export declare class JoinClient {
     private readonly options;
     constructor(options: JoinClientOptions);
@@ -108,8 +71,7 @@ export declare class JoinClient {
      * 1. Send join.request with token to Platform relay or direct peer
      * 2. Receive join.response with encrypted config bundle
      * 3. Decrypt bundle using token-derived key
-     * 4. Write the env file the orchestrator boots from (and, when `--config`
-     *    names one, the deprecated local YAML)
+     * 4. Write the env file the orchestrator boots from
      */
     join(): Promise<void>;
     /**

package/dist/config.d.ts

@@ -43,7 +43,6 @@ declare const configSchema: z.ZodObject<{
     provenanceIssuer: z.ZodOptional<z.ZodString>;
     provenanceSigningIssuer: z.ZodOptional<z.ZodString>;
     provenanceSignerKind: z.ZodOptional<z.ZodString>;
-    oidcLegacyPrSub: z.ZodPipe<z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>, z.ZodTransform<boolean, string | boolean>>;
     provenanceKmsKeyArn: z.ZodOptional<z.ZodString>;
     provenanceKmsRegion: z.ZodOptional<z.ZodString>;
     provenanceKmsAccessKeyId: z.ZodOptional<z.ZodString>;
@@ -195,7 +194,6 @@ declare const configSchema: z.ZodObject<{
     maxGithubPayloadBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     lockFileMaxBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     webhookDedupTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    contributorCacheTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     clusterSettingsCacheTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     logLevel: z.ZodDefault<z.ZodEnum<{
         debug: "debug";
@@ -254,7 +252,6 @@ export declare const packagingConfigSchema: z.ZodObject<{
     provenanceIssuer: z.ZodOptional<z.ZodString>;
     provenanceSigningIssuer: z.ZodOptional<z.ZodString>;
     provenanceSignerKind: z.ZodOptional<z.ZodString>;
-    oidcLegacyPrSub: z.ZodPipe<z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>, z.ZodTransform<boolean, string | boolean>>;
     provenanceKmsKeyArn: z.ZodOptional<z.ZodString>;
     provenanceKmsRegion: z.ZodOptional<z.ZodString>;
     provenanceKmsAccessKeyId: z.ZodOptional<z.ZodString>;
@@ -406,7 +403,6 @@ export declare const packagingConfigSchema: z.ZodObject<{
     maxGithubPayloadBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     lockFileMaxBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     webhookDedupTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    contributorCacheTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     clusterSettingsCacheTtlMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     logLevel: z.ZodDefault<z.ZodEnum<{
         debug: "debug";
@@ -498,7 +494,6 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     provenanceIssuer?: string | undefined;
     provenanceSigningIssuer?: string | undefined;
     provenanceSignerKind?: string | undefined;
-    oidcLegacyPrSub: boolean;
     provenanceKmsKeyArn?: string | undefined;
     provenanceKmsRegion?: string | undefined;
     provenanceKmsAccessKeyId?: string | undefined;
@@ -629,7 +624,6 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     maxGithubPayloadBytes: number;
     lockFileMaxBytes: number;
     webhookDedupTtlMs: number;
-    contributorCacheTtlMs: number;
     clusterSettingsCacheTtlMs: number;
     logLevel: "debug" | "error" | "info" | "warn";
     nodeEnv: "development" | "production" | "test";

package/dist/contexts/context-store.d.ts

@@ -1,5 +1,5 @@
 import { type Kysely } from 'kysely';
-import type { ConcurrencyStrategy, Context as EngineContext } from '@kici-dev/engine';
+import type { ConcurrencyStrategy, Context as EngineContext, MinimumTrust } from '@kici-dev/engine';
 import type { Database, Context } from '../db/types.js';
 /** Thrown by `delete` when pending held runs reference the context. */
 export declare class ContextDeleteBlockedError extends Error {
@@ -26,7 +26,7 @@ export interface ContextCreateInput {
     requiredReviewers?: string[] | null;
     waitTimerSeconds?: number | null;
     holdExpirySeconds?: number;
-    minimumTrust?: 'known' | 'trusted' | null;
+    minimumTrust?: MinimumTrust;
     allowLocalExecution?: boolean;
     enabled?: boolean;
     createdBy?: string | null;
@@ -55,7 +55,7 @@ export interface ContextUpdateInput {
     requiredReviewers?: string[] | null;
     waitTimerSeconds?: number | null;
     holdExpirySeconds?: number | null;
-    minimumTrust?: 'known' | 'trusted' | null;
+    minimumTrust?: MinimumTrust;
     allowLocalExecution?: boolean;
     enabled?: boolean;
 }

package/dist/contexts/held-runs.d.ts

@@ -32,12 +32,12 @@ export declare enum HeldRunStatus {
  *
  * - `fork_pr` — the org trust policy's fork switch held the run.
  * - `context_trust` — a context's minimum-trust gate held the run.
- * - `workflow_modification` — deprecated; no longer raised. Modifications to
- *   `.kici/` are surfaced on their own informational check and no longer feed
- *   a policy arm. Removed at v1.0.0.
- * - `unknown_contributor` — deprecated; no longer raised. The policy turns on
- *   whether the pull request came from a fork, not on who opened it. Removed
- *   at v1.0.0.
+ * - `workflow_modification` — no longer raised. Modifications to `.kici/`
+ *   are surfaced on their own informational check and no longer feed a policy
+ *   arm. Kept so stored `held_runs` rows with this reason still render.
+ * - `unknown_contributor` — no longer raised. The policy turns on whether the
+ *   pull request came from a fork, not on who opened it. Kept so stored
+ *   `held_runs` rows with this reason still render.
  */
 export declare const SecurityHoldReason: z.ZodEnum<{
     context_trust: "context_trust";

package/dist/contexts/protection/aggregate.d.ts

@@ -8,7 +8,7 @@ export interface ContextGateRejection {
 }
 /** Effective protection parameters after most-restrictive aggregation. */
 export interface EffectiveProtection {
-    minimumTrust?: 'known' | 'trusted';
+    minimumTrust?: 'trusted';
     requiredReviewers: string[];
     waitTimerSeconds: number | null;
     holdExpirySeconds: number;
@@ -26,10 +26,10 @@ export declare function evaluateMultiContextGates(envs: ReadonlyArray<{
 }>, ctx: JobDispatchContext): ContextGateRejection[];
 /**
  * Aggregate hold/wait/queue parameters across all bound contexts, most
- * restrictive wins: trust = strictest declared floor (see `TRUST_RANK` — a
- * wording choice, not a verdict), reviewers = sorted dedup union, wait timer =
- * max, hold expiry = min, concurrency limit = min (tightest). The concurrency
- * strategy follows the primary (first) context.
+ * restrictive wins: trust = the declared floor when any context declares one,
+ * reviewers = sorted dedup union, wait timer = max, hold expiry = min,
+ * concurrency limit = min (tightest). The concurrency strategy follows the
+ * primary (first) context.
  */
 export declare function aggregateProtectionParams(envs: ReadonlyArray<Context>): EffectiveProtection;
 /**

package/dist/dashboard/handler.d.ts

@@ -466,7 +466,7 @@ export declare class DashboardHandler {
      * volume without adding attribution detail.
      *
      * Pacing: a `setImmediate` yield between sends keeps the WS connection
-     * from saturating. For a 5 MB cap (the wishlist's worst case) this means
+     * from saturating. For the 5 MB cap this means
      * ~80 yields per stream — negligible.
      */
     handleEventLogPayloadStream(msg: DashboardEventLogPayloadStreamRequest): Promise<void>;

package/dist/db/migrations/142_sweep_deprecated_columns.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(): Promise<void>;
+//# sourceMappingURL=142_sweep_deprecated_columns.d.ts.map

package/dist/db/migrations/143_execution_jobs_precursor_result.d.ts

@@ -0,0 +1,26 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `execution_jobs.precursor_result JSONB NULL` — the payload a precursor
+ * job (source-pack build, init, dynamic eval) reports on its terminal
+ * `job.status`, persisted so a coordinator other than the one whose agent ran
+ * the job can read it back.
+ *
+ * The dispatch queue is cluster-wide: a job one coordinator dispatched may be
+ * claimed by an agent connected to a sibling coordinator. The sibling receives
+ * the agent's terminal frame; the coordinator awaiting the job never does. The
+ * shared row is the channel between them, and until this column existed the
+ * row carried the status but not the result — a build's `buildComplete`
+ * marker, an init's resolved fields, a dynamic eval's generated jobs — so the
+ * awaiting coordinator waited out its build timeout on a build that had
+ * succeeded.
+ *
+ * Nullable, with no default: NULL means "this job reported no precursor
+ * payload", which is true of every ordinary job and of every row written
+ * before this column existed.
+ *
+ * Idempotent: the add is guarded on existence and the drop uses IF EXISTS, so a
+ * re-run is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=143_execution_jobs_precursor_result.d.ts.map

package/dist/db/migrations/144_execution_runs_registration_window.d.ts

@@ -0,0 +1,32 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `execution_runs.registration_window_instance_id TEXT NULL` — the
+ * coordinator whose dispatch pipeline still has jobs to register for this run.
+ *
+ * A run is registered before all of its jobs exist: with its source-pack build
+ * job alone, or with no jobs at all ahead of its dispatch loop, and the real
+ * jobs land only once the build finishes or every dispatch has returned. The
+ * coordinator running that pipeline holds an in-memory token that keeps its
+ * own completion check from finalizing the run on the jobs registered so far.
+ *
+ * The dispatch queue is cluster-wide, so a job may be claimed by an agent
+ * connected to a sibling coordinator, and that sibling rehydrates the run from
+ * the database when the agent reports on it. The sibling has no token, so
+ * once the jobs it knows about are terminal it finalizes the run — on a build
+ * job alone, that is a green run in which nothing ran. This column is the
+ * token's durable form: the owner writes its instance id when it takes its
+ * first token and clears it when it drops its last, and every finalization
+ * path defers while the column names a live sibling.
+ *
+ * Nullable, with no default: NULL means "no coordinator has a registration
+ * window open", which is true of every run whose owner released its window
+ * and of every row written before this column existed. A dead holder's id
+ * reads as no window at all — liveness comes from `cluster_instances`, the
+ * same way the dispatch plane reads `dispatch_queue.owner_instance_id`.
+ *
+ * Idempotent: the add is guarded on existence and the drop uses IF EXISTS, so a
+ * re-run is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=144_execution_runs_registration_window.d.ts.map

package/dist/db/types.d.ts

@@ -1,5 +1,6 @@
 import type { ColumnType, Generated, Insertable, Selectable, Updateable } from 'kysely';
 import type { ApprovalRequirement, ApproverClause, InitFailure, StepApprovalPayload } from '@kici-dev/engine';
+import type { PrecursorResult } from '../cache/precursor-result.js';
 /**
  * Job kind stored in `execution_jobs.job_kind`. `Standard` runs steps on an
  * agent; `Gate` is an invoke gate that summons source-repo runs; `Proxy`
@@ -252,8 +253,6 @@ export interface DispatchQueueTable {
     provider_context: Generated<string>;
     /** Pre-packed `.kici/` source tarball URL (from cache). Nullable. */
     source_tar_url: string | null;
-    /** SHA-256 hash of the source tarball bytes for integrity verification. Nullable. */
-    source_tar_hash: string | null;
     source_tar_digest: string | null;
     /** Pre-built dependency tarball URL (from dep cache). Nullable. */
     deps_url: string | null;
@@ -712,6 +711,18 @@ export interface ExecutionRunTable {
      * breaker bounds recursion. Defaults to 0.
      */
     chain_depth: Generated<number>;
+    /**
+     * The coordinator whose dispatch pipeline still has jobs to register for
+     * this run — the durable form of the in-memory pending-jobs token
+     * (`ExecutionTracker.holdRunForPendingJobs`). The owner writes its instance
+     * id when it takes its first token and clears it when it drops its last;
+     * every finalization path defers while the column names a LIVE sibling
+     * (liveness from `cluster_instances`, the same read the dispatch queue's
+     * `owner_instance_id` predicates use). A dead holder's id reads as no
+     * window. NULL for every run with no window open and every row written
+     * before the column existed.
+     */
+    registration_window_instance_id: string | null;
 }
 /**
  * Execution job table
@@ -859,6 +870,16 @@ export interface ExecutionJobTable {
      * proxies have not all terminalized in time. NULL = no gate timeout.
      */
     timeout_ms: number | null;
+    /**
+     * The precursor payload a build / init / dynamic-eval job reported on its
+     * terminal `job.status` (shape: `PrecursorResult`), persisted so a
+     * coordinator other than the one whose agent ran the job can settle its
+     * pending tracker from the shared row. JSONB: the driver returns a parsed
+     * object on SELECT, while writers pass a `JSON.stringify` string. NULL for
+     * every ordinary job and for a precursor job that has not reached a
+     * terminal state.
+     */
+    precursor_result: ColumnType<PrecursorResult | null, string | null | undefined, string | null>;
 }
 /**
  * Execution step table
@@ -1809,8 +1830,6 @@ export interface OrgSettingsTable {
     customer_id: string;
     /** Repos allowed to author global workflows (null = any repo can author) */
     global_workflow_allowed_repos: ColumnType<OrgSettingsRepoPatternEntry[] | null, OrgSettingsRepoPatternEntry[] | null | undefined | string, OrgSettingsRepoPatternEntry[] | null | string>;
-    /** Repos with elevated trust for global workflow execution (null = none) */
-    global_workflow_elevated_repos: ColumnType<OrgSettingsRepoPatternEntry[] | null, OrgSettingsRepoPatternEntry[] | null | undefined | string, OrgSettingsRepoPatternEntry[] | null | string>;
     /**
      * Repos explicitly denied as event sources for global workflows.
      * Deny takes precedence over the allow-list (null = no deny patterns).
@@ -1962,19 +1981,15 @@ export type OrgSettingsUpdate = Updateable<OrgSettingsTable>;
  * tunes org_settings, the Platform owns this. `source` records which of the two
  * wrote the row.
  *
- * The three policy columns are plain `string`, not the Zod enums that name the
- * known vocabulary — same reasoning as `held_runs.hold_type`: a value written by
- * a newer Platform must still be readable rather than failing the row.
+ * The policy column is plain `string`, not the Zod enum that names the known
+ * vocabulary — same reasoning as `held_runs.hold_type`: a value written by a
+ * newer Platform must still be readable rather than failing the row.
  */
 export interface OrgTrustPolicyTable {
     /** Customer/org identifier (primary key) */
     customer_id: string;
-    /** How to treat a pull request opened from a fork: hold | reject | allow */
+    /** How to treat a pull request opened from a fork: ignore | hold | allow */
     fork_policy: string;
-    /** How to treat a PR from a contributor with no resolved identity: hold | reject */
-    unknown_contributor_policy: string;
-    /** How to treat a PR that modifies workflow files: hold | reject | allow */
-    workflow_change_policy: string;
     /**
      * The coarse, hours-granularity view of the security-hold window.
      *
@@ -2082,7 +2097,6 @@ export interface ClusterSettingsTable {
     event_log_max_payload_bytes: ColumnType<string | null, number | null | undefined, number | null>;
     lock_file_max_bytes: ColumnType<string | null, number | null | undefined, number | null>;
     webhook_dedup_ttl_ms: ColumnType<string | null, number | null | undefined, number | null>;
-    contributor_cache_ttl_ms: ColumnType<string | null, number | null | undefined, number | null>;
     event_router_event_ttl_seconds: ColumnType<number | null, number | null | undefined, number | null>;
     event_router_max_dispatch_attempts: ColumnType<number | null, number | null | undefined, number | null>;
     queue_max_depth: ColumnType<number | null, number | null | undefined, number | null>;