@kici-dev/orchestrator 0.8.0 → 0.9.0

package/dist/index.js

@@ -629,7 +629,8 @@ function createCacheStorage(config) {
 * the workflow entry file alone rather than the tree the tarball holds — the
 * defect this layout closes — so serving it would serve the bug. For a v6 lock
 * the fallback is unreachable anyway, since the schema bump moves every hash.
-* Old objects are orphaned and aged out by the normal cache TTL.
+* Old objects are orphaned. The cache TTL is enforced lazily on access, so
+* nothing here removes them; `kici-admin cache purge-legacy` does.
 */
 const logger$3 = createLogger({ prefix: "source-cache" });
 /**
@@ -1030,10 +1031,32 @@ const DEFAULT_USER_CACHE_QUOTA_BYTES = 5368709120;
 const DEFAULT_USER_CACHE_TTL_MS = 6048e5;
 /** Tarball suffix for committed cache entries. */
 const TAR_SUFFIX = ".tar.gz";
+/**
+* Stem prefix of an in-flight upload, `.tmp-<uuid>.tar.gz`: the presigned PUT
+* target a save lands on before commit copies it to its final key. Shared with
+* the retired-layout classifier so both agree on what an upload looks like.
+*/
+const TEMP_UPLOAD_STEM = ".tmp-";
+/** Whether a listed object is an in-flight upload rather than a cache entry. */
+function isTempUpload(key) {
+	return key.slice(key.lastIndexOf("/") + 1).startsWith(TEMP_UPLOAD_STEM);
+}
 /** Matches a stem ending in the fixed-width discriminator this module appends. */
 const KEY_DISCRIMINATOR_TAIL = new RegExp(`^(.*)-([0-9a-f]{32})$`);
 /**
-* Recover the reported cache key from a stored object's stem.
+* Whether a listed object is a committed entry, `<stem>-<discriminator>.tar.gz`.
+*
+* This is the filter the `restoreKeys` prefix scan applies to a listing, and it
+* is what keeps two other kinds of object out of a restore: an in-flight
+* `.tmp-<uuid>.tar.gz` upload, which is a partial tarball until commit copies
+* it to its final key, and an object under the retired un-discriminated layout,
+* which nothing writes and which `kici-admin cache purge-legacy` removes.
+*/
+function isCommittedEntry(key) {
+	return key.endsWith(TAR_SUFFIX) && KEY_DISCRIMINATOR_TAIL.test(key.slice(0, -7));
+}
+/**
+* Recover the reported cache key from a committed entry's stem.
 *
 * The value on this path is already the sanitized, lossy form, so this only
 * needs to undo the discriminator the key format appends. A stem that itself
@@ -1043,28 +1066,74 @@ const KEY_DISCRIMINATOR_TAIL = new RegExp(`^(.*)-([0-9a-f]{32})$`);
 function stripKeyDiscriminator(stem) {
 	return KEY_DISCRIMINATOR_TAIL.exec(stem)?.[1] ?? stem;
 }
-/** Device names NTFS reserves; a file cannot actually be created under one. */
-const WINDOWS_RESERVED_NAME = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\.|$)/;
-/** Keys that cannot have been part of a case collision in the old key format. */
-const UNAMBIGUOUS_LEGACY_KEY = /^[a-z0-9_][a-z0-9._-]*$/;
 /**
-* Whether a cache key is safe to look up in the pre-discriminator key format.
+* Sanitize a path segment so a key can never escape its org/repo/scope
+* namespace. Beyond stripping disallowed characters, a segment consisting
+* only of dots (`.`, `..`, …) is replaced wholesale: such a segment is a
+* dot-segment that HTTP/S3 path canonicalization collapses (`a/./b` → `a/b`,
+* `a/../b` → `b`), which both corrupts the namespace and breaks the SigV4
+* signature on a pre-signed PUT/GET. Repo identifiers like `.` (the internal
+* provider's repo id) hit exactly this case, so the all-dots guard keeps the
+* object key canonical and the namespace boundary intact.
 *
-* Every clause rules out a way the old format could have folded two distinct
-* keys onto one object:
+* Exported so an operator tool that addresses an org's prefix from a raw org id
+* (`kici-admin cache purge-legacy --org`) lands on the segment the writer used.
+*/
+function sanitizeSegment(s) {
+	const cleaned = s.replace(/[^A-Za-z0-9._-]/g, "_");
+	return /^\.+$/.test(cleaned) ? `_${cleaned}` : cleaned;
+}
+/** Org-level prefix: the per-tenant isolation boundary and quota scope. */
+function orgPrefix(ref) {
+	return `cache/${sanitizeSegment(ref.org)}/`;
+}
+/** Org + repo prefix shared by every scope of a repo. */
+function repoPrefix(ref) {
+	return `${orgPrefix(ref)}${sanitizeSegment(ref.repo)}`;
+}
+/** Namespace prefix for the WRITE scope of a ref (shared OR per-run isolated). */
+function writePrefix(ref) {
+	const base = repoPrefix(ref);
+	if (ref.scope === "isolated") {
+		if (!ref.runId) throw new Error("isolated cache scope requires a runId");
+		return `${base}/iso/${sanitizeSegment(ref.runId)}/`;
+	}
+	return `${base}/shared/`;
+}
+/** Namespace prefixes the ref may READ, in priority order. Isolated reads its own run scope, then shared. */
+function readPrefixes(ref) {
+	const base = repoPrefix(ref);
+	if (ref.scope === "isolated") {
+		if (!ref.runId) throw new Error("isolated cache scope requires a runId");
+		return [`${base}/iso/${sanitizeSegment(ref.runId)}/`, `${base}/shared/`];
+	}
+	return [`${base}/shared/`];
+}
+/**
+* Object key for a committed cache entry.
 *
-* - the character class is a subset of what `seg()` preserves, so a match
-*   implies the key survives sanitization unchanged (no many-to-one rewrite)
-*   and is pure ASCII, which rules out HFS+ Unicode normalisation;
-* - requiring lowercase rules out case folding, the collision this change fixes;
-* - a trailing `.` is stripped by NTFS, and a reserved device name cannot be
-*   created there at all.
+* The trailing discriminator is a hash of the EXACT cache key, and it is what
+* keeps `build` and `Build` apart on a case-insensitive namespace — the
+* filesystem backend on a macOS or Windows host, where the two would
+* otherwise resolve to one object and a restore could return the other key's
+* tarball.
 *
-* A key failing any clause gets no legacy fallback — it is re-fetched
-* and re-saved under the discriminated key, which is always correct.
+* It is deliberately a SUFFIX: `restoreByPrefix` matches `restoreKeys` by
+* string prefix, so appending leaves those semantics untouched. The only
+* parse that has to know about it is the `matchedKey` slice.
+*/
+function finalKey(prefix, key) {
+	return `${prefix}${sanitizeSegment(key)}-${keyDiscriminator(key)}${TAR_SUFFIX}`;
+}
+/**
+* The object key a committed save under `key` lands on for this ref. This is
+* the writer's own path — `beginSave` and `commitSave` address the entry
+* through it — so anything that must recognise a current-layout key (the
+* legacy-layout classifier tests) takes it from here rather than restating
+* the format.
 */
-function unambiguousLegacyKey(key) {
-	return UNAMBIGUOUS_LEGACY_KEY.test(key) && !key.endsWith(".") && !WINDOWS_RESERVED_NAME.test(key);
+function userCacheEntryKey(ref, key) {
+	return finalKey(writePrefix(ref), key);
 }
 var UserCache = class {
 	storage;
@@ -1105,105 +1174,10 @@ var UserCache = class {
 			ttlMs: limits.ttlMs ?? this.defaultTtlMs
 		};
 	}
-	/**
-	* Sanitize a path segment so a key can never escape its org/repo/scope
-	* namespace. Beyond stripping disallowed characters, a segment consisting
-	* only of dots (`.`, `..`, …) is replaced wholesale: such a segment is a
-	* dot-segment that HTTP/S3 path canonicalization collapses (`a/./b` → `a/b`,
-	* `a/../b` → `b`), which both corrupts the namespace and breaks the SigV4
-	* signature on a pre-signed PUT/GET. Repo identifiers like `.` (the internal
-	* provider's repo id) hit exactly this case, so the all-dots guard keeps the
-	* object key canonical and the namespace boundary intact.
-	*/
-	seg(s) {
-		const cleaned = s.replace(/[^A-Za-z0-9._-]/g, "_");
-		return /^\.+$/.test(cleaned) ? `_${cleaned}` : cleaned;
-	}
-	/** Org-level prefix: the per-tenant isolation boundary and quota scope. */
-	orgPrefix(ref) {
-		return `cache/${this.seg(ref.org)}/`;
-	}
-	/** Org + repo prefix shared by every scope of a repo. */
-	repoPrefix(ref) {
-		return `${this.orgPrefix(ref)}${this.seg(ref.repo)}`;
-	}
-	/** Namespace prefix for the WRITE scope of a ref (shared OR per-run isolated). */
-	writePrefix(ref) {
-		const base = this.repoPrefix(ref);
-		if (ref.scope === "isolated") {
-			if (!ref.runId) throw new Error("isolated cache scope requires a runId");
-			return `${base}/iso/${this.seg(ref.runId)}/`;
-		}
-		return `${base}/shared/`;
-	}
-	/** Namespace prefixes the ref may READ, in priority order. Isolated reads its own run scope, then shared. */
-	readPrefixes(ref) {
-		const base = this.repoPrefix(ref);
-		if (ref.scope === "isolated") {
-			if (!ref.runId) throw new Error("isolated cache scope requires a runId");
-			return [`${base}/iso/${this.seg(ref.runId)}/`, `${base}/shared/`];
-		}
-		return [`${base}/shared/`];
-	}
-	/**
-	* Object key for a committed cache entry.
-	*
-	* The trailing discriminator is a hash of the EXACT cache key, and it is what
-	* keeps `build` and `Build` apart on a case-insensitive namespace — the
-	* filesystem backend on a macOS or Windows host, where the two would
-	* otherwise resolve to one object and a restore could return the other key's
-	* tarball.
-	*
-	* It is deliberately a SUFFIX: `restoreByPrefix` matches `restoreKeys` by
-	* string prefix, so appending leaves those semantics untouched. The only
-	* parse that has to know about it is the `matchedKey` slice.
-	*/
-	finalKey(prefix, key) {
-		return `${prefix}${this.seg(key)}-${keyDiscriminator(key)}${TAR_SUFFIX}`;
-	}
-	/**
-	* The pre-discriminator object key.
-	*
-	* @deprecated Read-only compatibility path for entries written before the key
-	* carried a discriminator. Nothing writes this format; it is removed at the
-	* next major, by which point every such entry has aged out of the cache TTL.
-	*/
-	legacyFinalKey(prefix, key) {
-		return `${prefix}${this.seg(key)}${TAR_SUFFIX}`;
-	}
-	/**
-	* Restore an entry still stored in the pre-discriminator key format.
-	*
-	* Two gates, and BOTH are load-bearing — dropping either re-creates the
-	* wrong-cache-hit this change fixes:
-	*
-	* 1. `unambiguousLegacyKey` statically rules out any key that could have
-	*    collided with a case variant in the old format.
-	* 2. The listed name must match byte-exactly. A case-insensitive backend
-	*    resolves `getUrl('build')` to an object created as `Build`, but its
-	*    *listing* reports the real created name — so comparing against the
-	*    listing is what detects that the object is not really ours.
-	*
-	* @deprecated Removed at the next major; see `legacyFinalKey`.
-	*/
-	async restoreLegacyExact(ref, prefix, ttlMs) {
-		if (!unambiguousLegacyKey(ref.key)) return null;
-		const legacyKey = this.legacyFinalKey(prefix, ref.key);
-		if (!(await this.storage.list(prefix)).includes(legacyKey)) return null;
-		const url = await this.storage.getUrl(legacyKey, ttlMs);
-		if (!url) return null;
-		await this.storage.touch(legacyKey);
-		return {
-			hit: true,
-			matchedKey: ref.key,
-			downloadUrl: url,
-			tarHash: await this.readHash(legacyKey)
-		};
-	}
 	/** Restore: try the exact key across read prefixes, then restoreKeys prefix scan (newest wins). */
 	async restore(ref) {
 		const { ttlMs } = await this.resolveLimits(ref.org);
-		const prefixes = this.readPrefixes(ref);
+		const prefixes = readPrefixes(ref);
 		const exact = await this.restoreExact(ref, prefixes, ttlMs);
 		if (exact) return exact;
 		return await this.restoreByPrefix(ref, prefixes, ttlMs) ?? { hit: false };
@@ -1211,7 +1185,7 @@ var UserCache = class {
 	/** Try the exact key in read-prefix priority order. */
 	async restoreExact(ref, prefixes, ttlMs) {
 		for (const prefix of prefixes) {
-			const key = this.finalKey(prefix, ref.key);
+			const key = finalKey(prefix, ref.key);
 			const url = await this.storage.getUrl(key, ttlMs);
 			if (url) {
 				await this.storage.touch(key);
@@ -1222,15 +1196,13 @@ var UserCache = class {
 					tarHash: await this.readHash(key)
 				};
 			}
-			const legacy = await this.restoreLegacyExact(ref, prefix, ttlMs);
-			if (legacy) return legacy;
 		}
 		return null;
 	}
 	/** restoreKeys prefix fallback (ordered); within a prefix, list() returns newest-first. */
 	async restoreByPrefix(ref, prefixes, ttlMs) {
 		for (const rk of ref.restoreKeys ?? []) for (const prefix of prefixes) {
-			const matches = (await this.storage.list(`${prefix}${this.seg(rk)}`)).filter((k) => k.endsWith(TAR_SUFFIX));
+			const matches = (await this.storage.list(`${prefix}${sanitizeSegment(rk)}`)).filter(isCommittedEntry);
 			if (matches.length === 0) continue;
 			const winner = matches[0];
 			const url = await this.storage.getUrl(winner, ttlMs);
@@ -1247,13 +1219,12 @@ var UserCache = class {
 	}
 	/** Begin a save: presigned PUT to a temp key, or skip=true when the immutable key exists. */
 	async beginSave(ref) {
-		const prefix = this.writePrefix(ref);
-		const final = this.finalKey(prefix, ref.key);
+		const final = userCacheEntryKey(ref, ref.key);
 		if (await this.storage.has(final)) {
 			logger$1.info("user-cache save skipped (immutable key exists)", { key: ref.key });
 			return { skip: true };
 		}
-		const tempKey = `${prefix}.tmp-${randomUUID()}${TAR_SUFFIX}`;
+		const tempKey = `${writePrefix(ref)}${TEMP_UPLOAD_STEM}${randomUUID()}${TAR_SUFFIX}`;
 		return {
 			skip: false,
 			uploadUrl: await this.storage.getUploadUrl(tempKey),
@@ -1262,8 +1233,7 @@ var UserCache = class {
 	}
 	/** Commit a save: copy temp -> final, init metadata, store companion hash/size, delete temp, enforce quota. */
 	async commitSave(ref) {
-		const prefix = this.writePrefix(ref);
-		const final = this.finalKey(prefix, ref.key);
+		const final = userCacheEntryKey(ref, ref.key);
 		if (await this.storage.has(final)) return;
 		if (ref.tempKey) {
 			await this.storage.copy(ref.tempKey, final);
@@ -1281,11 +1251,18 @@ var UserCache = class {
 	async readHash(key) {
 		return (await this.storage.get(`${key}.hash`))?.toString("utf-8") || void 0;
 	}
-	/** Evict least-recently-used entries for the org until total tarball size <= the per-org quota. */
+	/**
+	* Evict least-recently-used entries for the org until total tarball size <= the per-org quota.
+	*
+	* An in-flight `.tmp-` upload is never a candidate. A presigned PUT carries
+	* no metadata, so it would rank oldest and be reclaimed first — freeing
+	* nothing, since it has no `.size` — and the concurrent commit would then
+	* fail on its copy to the final key. Retired un-discriminated entries stay
+	* in the set: they hold accounted bytes and are evictable like any other.
+	*/
 	async enforceQuota(ref) {
 		const { quotaBytes } = await this.resolveLimits(ref.org);
-		const orgPrefix = this.orgPrefix(ref);
-		const keys = (await this.storage.list(orgPrefix)).filter((k) => k.endsWith(TAR_SUFFIX));
+		const keys = (await this.storage.list(orgPrefix(ref))).filter((k) => k.endsWith(TAR_SUFFIX) && !isTempUpload(k));
 		const sized = [];
 		let total = 0;
 		for (const k of keys) {
@@ -1818,12 +1795,12 @@ function deriveKeys(secret) {
 *
 * - `fork_pr` — the org trust policy's fork switch held the run.
 * - `context_trust` — a context's minimum-trust gate held the run.
-* - `workflow_modification` — deprecated; no longer raised. Modifications to
-*   `.kici/` are surfaced on their own informational check and no longer feed
-*   a policy arm. Removed at v1.0.0.
-* - `unknown_contributor` — deprecated; no longer raised. The policy turns on
-*   whether the pull request came from a fork, not on who opened it. Removed
-*   at v1.0.0.
+* - `workflow_modification` — no longer raised. Modifications to `.kici/`
+*   are surfaced on their own informational check and no longer feed a policy
+*   arm. Kept so stored `held_runs` rows with this reason still render.
+* - `unknown_contributor` — no longer raised. The policy turns on whether the
+*   pull request came from a fork, not on who opened it. Kept so stored
+*   `held_runs` rows with this reason still render.
 */
 const SecurityHoldReason = z.enum([
 	"workflow_modification",
@@ -2176,20 +2153,15 @@ function createHeldRunStoreFromUrl(databaseUrl, opts) {
 		}
 	};
 }
-z.enum(["policy", "legacy"]);
 /** The fork switch applied when no policy row is stored. */
 const DEFAULT_FORK_POLICY = ForkPolicy.enum.ignore;
 Object.freeze({
 	forkPolicy: DEFAULT_FORK_POLICY,
-	unknownContributorPolicy: "hold",
-	workflowChangePolicy: "hold",
 	approvalExpiryHours: DEFAULT_APPROVAL_EXPIRY_HOURS,
 	approvalExpirySeconds: DEFAULT_APPROVAL_EXPIRY_SECONDS
 });
 Object.freeze({
 	forkPolicy: ForkPolicy.enum.hold,
-	unknownContributorPolicy: "hold",
-	workflowChangePolicy: "hold",
 	approvalExpiryHours: DEFAULT_APPROVAL_EXPIRY_HOURS,
 	approvalExpirySeconds: DEFAULT_APPROVAL_EXPIRY_SECONDS
 });
@@ -2220,8 +2192,6 @@ const TrustPolicySource = z.enum(["platform", "local"]);
 */
 const DEFAULT_TRUST_POLICY = {
 	forkPolicy: DEFAULT_FORK_POLICY,
-	unknownContributorPolicy: "hold",
-	workflowChangePolicy: "hold",
 	approvalExpiryHours: DEFAULT_APPROVAL_EXPIRY_HOURS,
 	approvalExpirySeconds: DEFAULT_APPROVAL_EXPIRY_SECONDS
 };
@@ -2265,8 +2235,6 @@ var TrustPolicyStore = class {
 		if (!row) return null;
 		return {
 			forkPolicy: row.fork_policy,
-			unknownContributorPolicy: row.unknown_contributor_policy,
-			workflowChangePolicy: row.workflow_change_policy,
 			approvalExpiryHours: Number(row.approval_expiry_hours),
 			approvalExpirySeconds: approvalExpirySecondsOf({
 				approvalExpiryHours: Number(row.approval_expiry_hours),
@@ -2295,9 +2263,8 @@ var TrustPolicyStore = class {
 	* COMMITTED two concurrent PATCHes both read the pre-existing row, and the
 	* second `ON CONFLICT DO UPDATE` then overwrites every column from its own
 	* stale merge — silently dropping the first operator's change (a tightened
-	* `unknownContributorPolicy` reverting to whatever the second caller last
-	* saw). The lock releases on commit or rollback, so there is no unlock to
-	* leak.
+	* `forkPolicy` reverting to whatever the second caller last saw). The lock
+	* releases on commit or rollback, so there is no unlock to leak.
 	*
 	* `onWrite` receives the same transaction and the merged result, so an audit
 	* row written there commits or rolls back with the policy itself — a
@@ -2312,8 +2279,6 @@ var TrustPolicyStore = class {
 			const existing = await this.get(orgId, trx);
 			const merged = {
 				forkPolicy: patch.forkPolicy ?? existing?.forkPolicy ?? DEFAULT_TRUST_POLICY.forkPolicy,
-				unknownContributorPolicy: patch.unknownContributorPolicy ?? existing?.unknownContributorPolicy ?? DEFAULT_TRUST_POLICY.unknownContributorPolicy,
-				workflowChangePolicy: patch.workflowChangePolicy ?? existing?.workflowChangePolicy ?? DEFAULT_TRUST_POLICY.workflowChangePolicy,
 				...mergedExpiry(patch, existing)
 			};
 			await this.write(orgId, merged, TrustPolicySource.enum.local, trx);
@@ -2325,8 +2290,6 @@ var TrustPolicyStore = class {
 		const seconds = approvalExpirySecondsOf(policy);
 		const columns = {
 			fork_policy: policy.forkPolicy,
-			unknown_contributor_policy: policy.unknownContributorPolicy,
-			workflow_change_policy: policy.workflowChangePolicy,
 			approval_expiry_hours: approvalExpiryHoursOf(seconds),
 			approval_expiry_seconds: seconds,
 			source,
@@ -2525,15 +2488,11 @@ var AdminApiClient = class {
 		fs.writeFileSync(outPath, buf);
 	}
 	/**
-	* List secret scopes for an org.
-	*
-	* @param allBackends - Aggregate every registered backend and return scopes
-	*   in qualified `<backend>:<path>` form. Default (false) returns the bare,
-	*   pg-only listing; that default flips at v1.0.0.
+	* List an org's secret scopes across every registered backend, each in
+	* qualified `<backend>:<path>` form.
 	*/
-	async listScopes(orgId, allBackends = false) {
+	async listScopes(orgId) {
 		const params = new URLSearchParams({ orgId });
-		if (allBackends) params.set("allBackends", "true");
 		return this.request("GET", `/api/v1/admin/secrets/scopes?${params}`);
 	}
 	async listKeys(orgId, scope) {

package/dist/metrics/prometheus.d.ts

@@ -625,7 +625,7 @@ export declare const installSecretsRegistryUsedTotal: import("@opentelemetry/api
  * from leaving the orchestrator for those dispatches.
  *
  * Labels:
- * - trust_tier: unknown | known (the `trusted` tier does not strip and therefore never fires this counter)
+ * - trust_tier: unknown (the `trusted` tier does not strip and therefore never fires this counter)
  */
 export declare const installSecretsContributorStrippedTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
 /**
@@ -638,7 +638,7 @@ export declare const installSecretsContributorStrippedTotal: import("@openteleme
  * and registry auth is per-job, so one run can strip both, either, or neither.
  *
  * Labels:
- * - trust_tier: unknown | known (the `trusted` tier does not strip and therefore never fires this counter)
+ * - trust_tier: unknown (the `trusted` tier does not strip and therefore never fires this counter)
  */
 export declare const containerRegistryAuthContributorStrippedTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
 /**

package/dist/oidc/id-token-claims.d.ts

@@ -8,7 +8,7 @@
  * differs only in the local sentinel issuer (`kici-local`) and the org anchor
  * (`__default__`, the plane's default org).
  */
-import { AttestationOrigin, SourceOrigin, type EventClaims } from '@kici-dev/engine';
+import { AttestationOrigin, ID_TOKEN_CLAIM_NAMES, SourceOrigin, type EventClaims } from '@kici-dev/engine';
 /** The subset of an execution_runs row the claims need. */
 export interface RunClaimSource {
     run_id: string;
@@ -61,15 +61,6 @@ export interface BuildClaimsOpts {
         statementHash: string;
         origin: 'deferred' | 'offline-backfill';
     };
-    /**
-     * Restore the pre-split pull-request `sub` — the branch-shaped form that
-     * collides with a push to the same base branch. An escape hatch for an
-     * operator whose cloud trust policy breaks mid-migration, set by
-     * `KICI_OIDC_LEGACY_PR_SUB`.
-     *
-     * @deprecated Removed at v1.0.0. Move the policy to `repo:<repo>:pull_request`.
-     */
-    legacyPullRequestSubject?: boolean;
 }
 /**
  * Extends {@link EventClaims}, so every token carries the event-context claims
@@ -96,6 +87,14 @@ export interface IdTokenClaims extends EventClaims {
     statement_hash: string | null;
     attestation_origin: AttestationOrigin;
 }
+/**
+ * The claim names shared by both discovery documents live in `@kici-dev/engine`;
+ * re-exported here for the route and the drift test. The binding below fails
+ * to compile when the engine list names a claim this type does not carry, and
+ * the drift test in `routes/provenance-oidc.test.ts` fails when the builder
+ * emits a claim the list does not name — together they keep the two in step.
+ */
+export { ID_TOKEN_CLAIM_NAMES };
 /**
  * Build the OIDC ID-token claims for a build job from the orchestrator's own
  * execution_runs/execution_jobs rows. A live (synchronous) mint leaves

package/dist/oidc/local-mint.d.ts

@@ -1,19 +1,16 @@
 /**
  * Local dev-signed OIDC mint (independent mode only).
  *
- * The Platform-connected orchestrator relays `oidc.token.request` to the hosted
- * Platform, which reads its own run/job rows and mints (`ws/oidc-token-relay.ts`
- * → `oidc.mint.request`). The offline local dev plane has no Platform, so this
- * module mints locally: it reads the orchestrator's OWN execution_runs/
- * execution_jobs rows and signs claims with the in-process `LocalDevSigner`,
- * issuer `kici-local`.
+ * The production sibling is `orchestrator-mint.ts`, which signs with the
+ * orchestrator's own long-lived key under its real issuer. The offline local dev
+ * plane has no provenance issuer configured, so this module mints with the
+ * in-process `LocalDevSigner` under the issuer `kici-local`, reading the
+ * orchestrator's OWN execution_runs/execution_jobs rows.
  *
  * Security: this path is registered ONLY when the orchestrator runs in
- * `independent` mode with a `LocalDevSigner` present, and app.ts registers the
- * Platform relay in preference (the local path is registered strictly in the
- * `else` branch), so a Platform-connected orchestrator can never reach the local
- * signer — it keeps minting via the Platform exactly as today. The agent never
- * asserts its own claims; every identity claim is read server-side from the
+ * `independent` mode with a `LocalDevSigner` present and no orchestrator-owned
+ * signer is configured (`selectOidcMintRegistration`). The agent never asserts
+ * its own claims; every identity claim is read server-side from the
  * orchestrator's rows, and the job-ownership check is against dispatch state.
  */
 import type { Kysely } from 'kysely';
@@ -21,7 +18,7 @@ import { type OidcTokenResult } from '@kici-dev/engine/protocol/messages/oidc-to
 import type { Database } from '../db/types.js';
 import { type IdTokenClaims } from './id-token-claims.js';
 import { type LocalSigner } from './local-dev-signer.js';
-/** ID-token lifetime (seconds). Matches the Platform's 10-minute cap. */
+/** ID-token lifetime (seconds). Matches the production mint's 10-minute cap. */
 export declare const LOCAL_ID_TOKEN_TTL_SECONDS = 600;
 /** The org anchor stamped into a local-plane token (the plane's default org). */
 export declare const LOCAL_ORG_ID = "__default__";

package/dist/oidc/oidc-mint-registration.d.ts

@@ -6,14 +6,11 @@
  *
  *  1. **Orchestrator-owned signing** (a resolved signer + the orchestrator's own
  *     provenance issuer) → the **orchestrator** handler, minting + signing
- *     locally. Wins whenever signing is configured — even Platform-connected —
- *     because the orchestrator is now the root of trust.
- *  2. **Platform-connected** (platformUrl + token + client), no signer → the
- *     **relay** handler, minting via the hosted Platform (the DEPRECATED path,
- *     kept for orchestrators with no signer configured).
- *  3. **Offline local dev plane** (independent identity + a local signer, AND
- *     NOT Platform-connected) → the **local** dev-signed handler (`kici-local`).
- *  4. None → **no** registration (the method returns "unknown method").
+ *     locally. Wins whenever signing is configured — the orchestrator is the
+ *     root of trust.
+ *  2. **Offline local dev plane** (independent identity + a local signer) → the
+ *     **local** dev-signed handler (`kici-local`).
+ *  3. None → **no** registration (the method returns "unknown method").
  *
  * The identity claims are always read SERVER-SIDE from the orchestrator's own
  * rows and job ownership from dispatch state — no forgeable agent-asserted mint
@@ -22,29 +19,25 @@
 import type { Kysely } from 'kysely';
 import type { OidcTokenResult } from '@kici-dev/engine/protocol/messages/oidc-token-relay';
 import type { Database } from '../db/types.js';
-import { type MintPlatformClient } from '../ws/oidc-token-relay.js';
 import { type LocalMintOwnershipResolver } from './local-mint.js';
 import type { LocalSigner } from './local-dev-signer.js';
 import type { Signer } from './signer.js';
 export type OidcMintHandler = (agentId: string, params: Record<string, unknown>) => Promise<OidcTokenResult>;
 export interface OidcMintRegistration {
     /**
-     * `orchestrator` = orchestrator-owned signing (the new root of trust);
-     * `relay` = Platform-minted (deprecated); `local` = offline dev-signed.
+     * `orchestrator` = orchestrator-owned signing (the root of trust);
+     * `local` = offline dev-signed.
      */
-    kind: 'orchestrator' | 'relay' | 'local';
+    kind: 'orchestrator' | 'local';
     handler: OidcMintHandler;
 }
 export interface OidcMintRegistrationInput {
-    platformUrl?: string;
-    platformToken?: string;
-    platformClient?: MintPlatformClient;
     independentIdentity: boolean;
     localOidcSigner?: LocalSigner;
     /**
-     * Lazily resolve the orchestrator's own provenance signer (Task 7 reconcile).
-     * Present whenever orchestrator-owned signing is configured; the signer itself
-     * is resolved on first mint (leader-election-race-safe).
+     * Lazily resolve the orchestrator's own provenance signer. Present whenever
+     * orchestrator-owned signing is configured; the signer itself is resolved on
+     * first mint (leader-election-race-safe).
      */
     resolveOrchestratorSigner?: () => Promise<Signer | null>;
     /** The orchestrator's own provenance issuer identity (config.provenanceSigningIssuer). */
@@ -57,16 +50,10 @@ export interface OidcMintRegistrationInput {
     db: Kysely<Database>;
     orchestratorId: string;
     /**
-     * `KICI_OIDC_LEGACY_PR_SUB` — restore the pre-split pull-request `sub`.
-     *
-     * @deprecated Removed at v1.0.0.
-     */
-    legacyPullRequestSubject?: boolean;
-    /**
-     * Test-only fault-injection predicate forwarded to the relay mint handler,
-     * supplied only by the build-time test double. Only ever defers — the
-     * anti-forgery choke point is preserved. Undefined (the shipped default) means
-     * no fault injection.
+     * Test-only fault-injection predicate forwarded to the orchestrator mint
+     * handler, supplied only by the build-time test double. Only ever defers —
+     * the anti-forgery choke point is preserved. Undefined (the shipped default)
+     * means no fault injection.
      */
     initialMintFault?: (audience: string) => boolean;
 }

package/dist/oidc/orchestrator-mint.d.ts

@@ -6,7 +6,7 @@
  * execution_jobs rows, signed with its own long-lived signing key (`Signer`),
  * issued under its own real issuer. Zero hosted-Platform dependency.
  *
- * Anti-forgery is identical to the Platform-minted path and the local dev plane:
+ * Anti-forgery is identical to the local dev plane:
  * every identity claim (run/job/repo/ref/sha/org) is read SERVER-SIDE from the
  * orchestrator's own rows — never from the agent's wire input — and job ownership
  * is resolved from dispatch state, never agent-asserted. The token is never
@@ -19,7 +19,7 @@ import { type IdTokenClaims } from './id-token-claims.js';
 import type { Signer } from './signer.js';
 /** The org anchor stamped when a run has no routing key (sourceless / local plane). */
 export declare const DEFAULT_ORG_ID = "__default__";
-/** ID-token lifetime (seconds). Matches the Platform's 10-minute cap. */
+/** ID-token lifetime (seconds). */
 export declare const ORCHESTRATOR_ID_TOKEN_TTL_SECONDS = 600;
 export declare class OrchestratorMintRunNotFoundError extends Error {
 }
@@ -36,14 +36,6 @@ export interface OrchestratorMintDeps {
     ttlSeconds?: number;
     /** Injectable clock (seconds). Defaults to wall-clock. */
     nowSeconds?: () => number;
-    /**
-     * Restore the pre-split pull-request `sub`, from `KICI_OIDC_LEGACY_PR_SUB`.
-     * An escape hatch for an operator whose cloud trust policy breaks mid-
-     * migration; leaves the collision with a same-branch push in place.
-     *
-     * @deprecated Removed at v1.0.0.
-     */
-    legacyPullRequestSubject?: boolean;
 }
 export interface OrchestratorMintInput {
     runId: string;
@@ -93,6 +85,14 @@ export interface OrchestratorOidcTokenHandlerDeps {
     resolveSigner: () => Promise<Signer | null>;
     /** Mint deps except the signer (supplied lazily via `resolveSigner`). */
     mint: Omit<OrchestratorMintDeps, 'signer'>;
+    /**
+     * Test-only fault-injection predicate over the requested OIDC `audience`,
+     * supplied only by the build-time test double. Returning `true` short-circuits
+     * the *initial* mint to a transient defer BEFORE the signer is resolved — it
+     * can only defer, never forge or weaken a signature. Undefined (the shipped
+     * default) means no fault injection.
+     */
+    initialMintFault?: (audience: string) => boolean;
 }
 /**
  * Build the agent.api handler for `OIDC_TOKEN_REQUEST_METHOD` when the