@kici-dev/orchestrator 0.8.0 → 0.9.0

package/dist/oidc/resolve-signer.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Bounded wait for the orchestrator's provenance signer.
+ *
+ * A mint that arrives before the leader has generated the key must NOT fall
+ * back to a Platform-signed bundle (it would fail verification against the
+ * orchestrator trust root), so the resolver waits for the key instead of
+ * deferring on the first miss. But the wait exists for ONE condition — a
+ * reconcile that returns `null` because a non-leader has not yet seen the row
+ * the leader is about to write. A reconcile that THROWS is a different answer:
+ * a signing key sealed under a master key this process does not hold, or `db`
+ * custody with no master key at all. Neither changes across the wait, so
+ * retrying it for the full window only turns every mint into a silent
+ * thirty-second stall that ends in the same `unavailable` defer, with the
+ * cause — which the reconcile phrases as an operator recovery instruction —
+ * swallowed on every attempt.
+ *
+ * So: retry the null, stop on the throw, and say why once per distinct cause.
+ */
+import type { Signer } from './signer.js';
+export interface ResolveSignerOptions {
+    /** One reconcile pass: a signer, `null` while the key is not ready, or a throw. */
+    reconcile: () => Promise<{
+        signer: Signer;
+    } | null>;
+    /** Attempts before giving up on a still-null reconcile. */
+    maxAttempts: number;
+    /** Delay between two null attempts. */
+    delayMs: number;
+    /** Sink for the terminal-cause line; called once per distinct message. */
+    logError: (message: string, meta: Record<string, unknown>) => void;
+    /** Injectable for tests. */
+    sleep?: (ms: number) => Promise<void>;
+}
+/**
+ * Build a memoizing resolver: the first successful reconcile is cached for the
+ * life of the process, a null reconcile is retried up to `maxAttempts` times,
+ * and a thrown reconcile ends the call at once with `null`.
+ */
+export declare function createBoundedSignerResolver(opts: ResolveSignerOptions): () => Promise<Signer | null>;
+//# sourceMappingURL=resolve-signer.d.ts.map

package/dist/orchestrator-core.d.ts

@@ -35,6 +35,7 @@ import type { ScalerConfig } from './scaler/index.js';
 import type { CacheStorage } from './storage/index.js';
 import { type ProvenanceTrustRoot } from './provenance/trust-root.js';
 import { type ResolvedDashboardEncryptionKey } from './secrets/dashboard-encryption-key.js';
+import type { Signer } from './oidc/signer.js';
 import { SourceCache, BuildCoordinator, DepCache, UserCache, DispatchCacheRefTracker, PendingBuildTracker, PendingInitTracker, PendingDynamicTracker, PendingGlobalEvalTracker, GlobalEvalRoundCache } from './cache/index.js';
 import { ArtifactStore } from './artifacts/artifact-store.js';
 import { CheckRunReporter } from './reporting/check-run-reporter.js';
@@ -93,6 +94,16 @@ export interface OrchestratorSubsystems {
      * Platform `auth.success` message via `onProvenanceIssuer`.
      */
     provenanceTrustRoot: ProvenanceTrustRoot;
+    /**
+     * Orchestrator-owned provenance signing, present when
+     * `KICI_ORCHESTRATOR_PROVENANCE_ISSUER` is configured. The deferred-attestation
+     * retrier mints with it; `resolveSigner` reconciles the active key lazily and
+     * returns null while the key is not yet resolvable.
+     */
+    provenanceSigning: {
+        issuer: string;
+        resolveSigner: () => Promise<Signer | null>;
+    } | undefined;
     sourceCache: SourceCache | undefined;
     depCache: DepCache | undefined;
     userCache: UserCache | undefined;

package/dist/pipeline/dispatch-matched-workflow.d.ts

@@ -382,7 +382,6 @@ interface DispatchSetup {
 }
 interface BuildPrepResult {
     sourceTarUrl: string | undefined;
-    sourceTarHash: string | undefined;
     /** SHA-256 of the source tarball's own bytes; the agent verifies against it. */
     sourceTarDigest: string | undefined;
     depsUrl: string | undefined;
@@ -729,7 +728,7 @@ export declare function evaluateJobContexts(args: {
  * reaches it only where the operator said so.
  *
  * "Without a trusted emitter" covers both halves of the internal case: a
- * `kiciEvent()` subscriber that inherited a `known` / `unknown` tier, and one
+ * `kiciEvent()` subscriber that inherited an `unknown` tier, and one
  * that inherited nothing at all (no emitting run, no persisted tier, a lookup
  * that failed) — the strict fallback, which is not an "untrusted emitter".
  *

package/dist/pipeline/job-contexts.d.ts

@@ -25,8 +25,8 @@ export interface ResolvedJobContexts {
 }
 /**
  * Resolve the ordered bound-context names from a lock job. Static elements
- * use their value verbatim; any dynamic element (inline or impure) is resolved
- * by the agent's init job and flags `needsInit`.
+ * use their value verbatim; a dynamic element is resolved by the agent's init
+ * job and flags `needsInit`.
  */
 export declare function resolveJobContextNames(lockJob: LockJob): ResolvedJobContexts;
 /**

package/dist/provenance/attestation-retrier.d.ts

@@ -7,13 +7,19 @@ export type RetrierMintResult = {
 } | {
     deferred: true;
     code: string;
+    /**
+     * What the operator has to change for the deferral to ever clear. Logged
+     * once per drain, not per row: the whole queue defers for the same
+     * reason, and it defers again on every tick until the operator acts.
+     */
+    operatorHint?: string;
 } | {
     rejected: true;
     reason: string;
 };
 export interface AttestationRetrierDeps {
     repo: PendingAttestationsRepo;
-    /** Mint the deferred token (the OIDC relay with deferred params, Task 5). */
+    /** Mint the deferred token with the orchestrator's own signer. */
     requestMint: (args: {
         orchestratorId: string;
         runId: string;
@@ -59,6 +65,8 @@ export interface AttestationRetrierDeps {
 export declare class AttestationRetrier {
     private readonly deps;
     private interval;
+    /** Operator hints the current drain has collected; flushed once per drain. */
+    private drainHints;
     private running;
     constructor(deps: AttestationRetrierDeps);
     /**
@@ -87,6 +95,8 @@ export declare class AttestationRetrier {
         stillPending: number;
         rejected: number;
     }>;
+    /** One warning per distinct hint per drain, naming how many rows it holds up. */
+    private flushDrainHints;
     fulfilOne(row: PendingAttestationRow): Promise<'minted' | 'rejected' | 'deferred'>;
 }
 //# sourceMappingURL=attestation-retrier.d.ts.map

package/dist/provenance/retrier-mint.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The deferred re-mint the attestation retrier asks for.
+ *
+ * A deferred attestation is fulfilled with the orchestrator's own signing key,
+ * bound to the frozen statement hash. This module turns the orchestrator's
+ * signing configuration into the retrier's `requestMint` dependency.
+ */
+import type { Kysely } from 'kysely';
+import type { Database } from '../db/types.js';
+import type { Signer } from '../oidc/signer.js';
+import type { AttestationRetrierDeps } from './attestation-retrier.js';
+/**
+ * What the operator has to do when no provenance signer is configured at all.
+ * Surfaced once per retrier drain, never per row — the queue does not shrink
+ * until the issuer is set, so a per-row line would repeat every minute.
+ */
+export declare const PROVENANCE_ISSUER_UNCONFIGURED_HINT = "No provenance signer is configured, so deferred attestations cannot be completed. Set KICI_ORCHESTRATOR_PROVENANCE_ISSUER on the orchestrator.";
+export interface RetrierMintDeps {
+    db: Kysely<Database>;
+    /** `undefined` when the orchestrator has no provenance issuer configured. */
+    provenanceSigning: {
+        issuer: string;
+        resolveSigner: () => Promise<Signer | null>;
+    } | undefined;
+    /**
+     * Test-only fault injection: the build-time test double supplies a predicate
+     * over the audience that forces a TERMINAL rejection, so an E2E can exercise
+     * the markRejected → gauge-exclusion → `--include-rejected` re-arm cycle with
+     * a real deferred row. It returns before the real mint, so the signing choke
+     * point is preserved. The shipped orchestrator leaves it undefined.
+     */
+    remintReject?: (audience: string) => boolean;
+}
+export declare function createRetrierMintRequest(deps: RetrierMintDeps): AttestationRetrierDeps['requestMint'];
+//# sourceMappingURL=retrier-mint.d.ts.map

package/dist/providers/github/normalizer.d.ts

@@ -4,7 +4,7 @@
  * Implements the WebhookNormalizer interface from @kici-dev/engine for GitHub webhooks.
  * Handles header extraction, HMAC-SHA256 signature verification, and event normalization.
  */
-import type { WebhookNormalizer, SimulatedEvent, AccessCacheInvalidation } from '@kici-dev/engine';
+import type { WebhookNormalizer, SimulatedEvent } from '@kici-dev/engine';
 /**
  * GitHub-specific implementation of WebhookNormalizer.
  *
@@ -73,32 +73,5 @@ export declare class GitHubWebhookNormalizer implements WebhookNormalizer {
      * generating installation tokens for repo access.
      */
     extractCredentials(payload: unknown): Record<string, unknown>;
-    /**
-     * Map GitHub membership-related webhook events to permission-cache
-     * invalidations. See WebhookNormalizer.getAccessCacheInvalidations, which is
-     * deprecated and has no caller.
-     *
-     * Covered event types:
-     *
-     * - `member` (`added` / `removed` / `edited`): a collaborator's repo
-     *   permission changed -> `repo-user` invalidation for the exact
-     *   `{repo, user}` pair.
-     * - `organization` (`member_added` / `member_removed`): a user was added
-     *   to or removed from the org. The user's effective permission on every
-     *   repo under the org may have shifted -> `user-in-org`.
-     * - `membership` (`added` / `removed`, usually team scope): same reasoning
-     *   as `organization`. Slightly broader than strictly required, but the
-     *   cache refills cheaply and over-invalidation is safe.
-     * - `team` (`added_to_repository` / `removed_from_repository`): every
-     *   member of the team gained or lost repo access -> `repo`.
-     *
-     * Any other event type (including other `team` actions like `created` /
-     * `deleted` / `edited` which carry no repo context) returns `[]`.
-     *
-     * Payload fields are probed defensively; a missing field returns `[]`
-     * rather than throwing — this is best-effort and we do not want a
-     * malformed payload to crash webhook processing.
-     */
-    getAccessCacheInvalidations(eventType: string, _action: string | null, payload: unknown): AccessCacheInvalidation[];
 }
 //# sourceMappingURL=normalizer.d.ts.map

package/dist/providers/local/normalizer.d.ts

@@ -7,7 +7,7 @@
  * verification='none'), and event type / routing key are extracted from custom
  * headers.
  */
-import type { WebhookNormalizer, SimulatedEvent, AccessCacheInvalidation } from '@kici-dev/engine';
+import type { WebhookNormalizer, SimulatedEvent } from '@kici-dev/engine';
 /**
  * Local provider implementation of WebhookNormalizer.
  *
@@ -69,19 +69,5 @@ export declare class LocalWebhookNormalizer implements WebhookNormalizer {
      * when no ref is present.
      */
     normalizeEvent(eventType: string, _action: string | null, payload: unknown): SimulatedEvent | null;
-    /**
-     * Map membership-related local-source webhook events to permission-cache
-     * invalidations. See WebhookNormalizer.getAccessCacheInvalidations, which is
-     * deprecated and has no caller.
-     *
-     * Local-source payloads are GitHub-shaped by design, so the mapping
-     * mirrors the GitHub normalizer exactly:
-     *
-     * - `member`: repo-user
-     * - `organization`: user-in-org
-     * - `membership`: user-in-org
-     * - `team` (repo-scoped actions only): repo
-     */
-    getAccessCacheInvalidations(eventType: string, _action: string | null, payload: unknown): AccessCacheInvalidation[];
 }
 //# sourceMappingURL=normalizer.d.ts.map

package/dist/queue/job-queue.d.ts

@@ -148,9 +148,7 @@ export interface QueuedJobInput {
     timeoutMs?: number;
     /** URL to pre-compiled bundle (from cache). Passed through to job.dispatch. */
     sourceTarUrl?: string;
-    /** Content hash of the pre-compiled bundle for verification. */
-    sourceTarHash?: string;
-    /** SHA-256 of the source tarball's own bytes (what `sourceTarHash` never was). */
+    /** SHA-256 of the source tarball's own bytes, for integrity verification. */
     sourceTarDigest?: string;
     /** URL to pre-built dependency tarball (from dep cache). Passed through to job.dispatch. */
     depsUrl?: string;
@@ -208,9 +206,7 @@ export interface QueuedJob {
     routingKey: string;
     /** URL to pre-compiled bundle (from cache). Passed through to job.dispatch. */
     sourceTarUrl?: string;
-    /** Content hash of the pre-compiled bundle for verification. */
-    sourceTarHash?: string;
-    /** SHA-256 of the source tarball's own bytes (what `sourceTarHash` never was). */
+    /** SHA-256 of the source tarball's own bytes, for integrity verification. */
     sourceTarDigest?: string;
     /** URL to pre-built dependency tarball (from dep cache). Passed through to job.dispatch. */
     depsUrl?: string;

package/dist/queue/terminalize-unroutable.d.ts

@@ -12,7 +12,7 @@ import type { ExpiredJobInfo } from './job-queue.js';
  * The predicate is allowed to answer "routable" conservatively: the scaler half
  * matches exact labels only, so a pattern-only `runsOn` reads routable on a
  * scaler-configured orchestrator. That costs precision on the status and on
- * how quickly the job settles, never safety — a job that reads routable simply
+ * how quickly the job settles, never safety — a job that reads routable
  * falls through to the queue-timeout backstop.
  */
 export type CanRouteLabels = (requiredLabels: string[], requiredPatterns: LabelMatcher[], excludeLabels: string[], excludePatterns: LabelMatcher[]) => boolean;

package/dist/reporting/execution-tracker.d.ts

@@ -232,6 +232,22 @@ export interface ExecutionTrackerDeps {
      * `'__default__'` column default (the no-source fallback org).
      */
     resolveOrgId?: (routingKey: string) => Promise<string>;
+    /**
+     * This coordinator's cluster instance id. Written to
+     * `execution_runs.registration_window_instance_id` while this coordinator's
+     * dispatch pipeline still has jobs to register for a run, so a sibling that
+     * rehydrates the run from the database defers finalizing it. Optional for
+     * the same reason `JobQueue`'s is: a worker with no cluster identity leaves
+     * it undefined, holds no durable window, and reads every holder as a sibling.
+     */
+    instanceId?: string;
+    /**
+     * How stale a `cluster_instances` heartbeat may be and still read as live,
+     * for the registration-window holder check. Defaults to
+     * {@link instanceLivenessGraceMs} at the default recovery grace period —
+     * the same window the dispatch queue's ownership predicates use.
+     */
+    instanceLivenessGraceMs?: number;
 }
 /**
  * The per-job fields the tracker persists to an execution_jobs row.
@@ -287,7 +303,16 @@ export declare class ExecutionTracker {
     private readonly orgId?;
     private readonly jobQueue?;
     private readonly resolveOrgIdFn?;
+    private readonly instanceId?;
+    private readonly livenessGraceMs;
     private readonly runs;
+    /**
+     * Per-run chain of the durable registration-window writes. The write that
+     * opens a window is fire-and-forget from the synchronous
+     * `holdRunForPendingJobs`; the clear on the last release awaits the chain
+     * first, so a clear can never overtake the open it undoes.
+     */
+    private readonly registrationWindowWrites;
     /**
      * Per-run async-mutex chain. `onJobStatus` and `addJobsToRun` mutate the same
      * `run.jobs` Map / `execution_jobs` row; without serialization a job-status
@@ -514,6 +539,41 @@ export declare class ExecutionTracker {
      */
     onJobStatus(runId: string, jobId: string, state: string, timestamp: number, agentId?: string, data?: Record<string, unknown>): Promise<void>;
     private onJobStatusImpl;
+    /**
+     * Whether this coordinator may finalize the run now.
+     *
+     * The in-memory job map is only this coordinator's view: a run rehydrated
+     * from the database holds just the jobs its own agents reported, and even
+     * the run's owner holds a sibling-claimed job at the status it last heard.
+     * So once the map reads complete, the shared `execution_jobs` rows are
+     * folded in ({@link syncRunJobsFromRows}) and the check is repeated over the
+     * whole set — a job another coordinator is still running keeps the run
+     * open, and the status computed afterwards covers every job, not a subset.
+     *
+     * Then the registration window: while a LIVE sibling still has jobs to
+     * register (a build-window owner whose real jobs are dispatched only once
+     * the build finishes), the rows say nothing yet, so finalization is deferred
+     * to whichever coordinator sees the last job finish — or to that owner's
+     * own release, which re-runs this check. A dead holder reads as no window,
+     * and a run it left behind is finished by the stale detector's
+     * all-terminal sweep.
+     */
+    private readyToFinalize;
+    /**
+     * Fold the run's persisted `execution_jobs` rows into its in-memory map:
+     * a row this coordinator never registered is added at the row's status, and
+     * a job it holds as non-terminal is lifted to the terminal status the row
+     * carries. Memory is never downgraded — the row for the job being reported
+     * was upserted before any completion check runs, so a terminal entry in
+     * memory is always at least as current as its row.
+     */
+    private syncRunJobsFromRows;
+    /**
+     * Whether a live sibling coordinator has a registration window open on the
+     * run — see {@link holdRunForPendingJobs}. This coordinator's own window is
+     * governed by its in-memory token, so its own id reads as no sibling.
+     */
+    private registrationWindowHeldByLiveSibling;
     /**
      * Phase 1a: recover run state from the DB when in-memory tracking is empty.
      * Returns the rehydrated RunState or null if the run is unknown to the DB
@@ -933,6 +993,28 @@ export declare class ExecutionTracker {
      * Each token must be paired with exactly one {@link releasePendingJobsHold}.
      */
     holdRunForPendingJobs(runId: string): boolean;
+    /**
+     * Record this coordinator as the run's registration-window holder in
+     * `execution_runs.registration_window_instance_id` — the token's durable
+     * form, which a sibling coordinator finalizing the run consults.
+     *
+     * Chained rather than awaited: the caller is synchronous by contract (the
+     * token must be counted before the next `await` can drop a sibling token),
+     * so the write rides a per-run chain that the clear on the last release
+     * awaits. `registrationWindowSettled` exposes the chain to a caller that
+     * must know the window is durable before it starts waiting on a job a
+     * sibling may finish. A coordinator with no instance id holds no durable
+     * window.
+     */
+    private openRegistrationWindow;
+    /**
+     * Clear the durable registration window, only if it still names this
+     * coordinator — a sibling that took the run over owns the column now.
+     */
+    private clearRegistrationWindow;
+    private chainRegistrationWindowWrite;
+    /** Resolves once every registration-window write queued so far for the run has landed. */
+    registrationWindowSettled(runId: string): Promise<void>;
     /**
      * Drop one token taken by {@link holdRunForPendingJobs}, and finalize the run
      * if dropping the LAST one left every remaining job terminal.
@@ -1155,6 +1237,31 @@ export declare class ExecutionTracker {
      * the callbacks nor the completion metrics may claim it.
      */
     private completeRunFromMemoryState;
+    /**
+     * Drop the in-memory state of every run another writer already finished.
+     *
+     * A coordinator finalizes a run — and schedules its own prune — only when it
+     * sees the run's last job finish. In a cluster the last job's frames may go
+     * to a sibling, which finalizes the run and prunes ITS state; this
+     * coordinator's copy has no later trigger and, without this sweep, stays in
+     * memory for the life of the process, one `RunState` per cross-coordinator
+     * run. The stale detector calls this on every tick. One query over the
+     * non-finished runs held here; a run whose row is terminal is released the
+     * way the finalizing path releases its own, minus the completion events and
+     * the row write, which the finalizer already did.
+     *
+     * A run this coordinator legitimately still holds — its row non-terminal,
+     * with or without an open registration window — is not touched.
+     */
+    pruneRunsFinishedElsewhere(): Promise<number>;
+    /**
+     * Treat a run whose row another writer finished as finished here too:
+     * mark it complete so no completion path re-enters it, shed the per-run
+     * state the terminal callback sheds, and schedule the prune. Emits no
+     * completion event and writes no row. Returns false when the run is not
+     * held here or is already finishing.
+     */
+    private releaseRunFinishedElsewhere;
     /**
      * Drop a finished run's in-memory state after a grace period, so a late
      * status/heartbeat arriving just after completion still finds its run.

package/dist/scaler/label-matcher.d.ts

@@ -65,7 +65,6 @@ export declare function findBackendForLabels(labels: string[], scalers: Array<{
     labelSets: Array<{
         labels: string[];
     }>;
-    mandatoryLabels?: string[];
     labelSetMandatoryLabels?: string[][];
 }>, excludeLabels?: string[]): {
     scalerName: string;

package/dist/scaler/manager.d.ts

@@ -125,16 +125,6 @@ export interface ScalerStatus {
         resourceCap?: ResourceCap;
         /** Machine-pool reference, if any. */
         machinePool?: string;
-        /**
-         * The union of every entry in {@link labelSetMandatoryLabels}. Surfaced in
-         * heartbeat-side scaler capacity summaries for a peer that predates the
-         * per-label-set gate.
-         *
-         * @deprecated Use {@link labelSetMandatoryLabels}. On a scaler whose label
-         * sets declare different platforms this union names a taint no single set
-         * can satisfy, which is what made a mixed-platform scaler unroutable.
-         */
-        mandatoryLabels: string[];
         /**
          * Labels a job MUST declare in `runsOn` to be allowed on each label set,
          * index-aligned with `labelSets`. An empty entry means that set has no
@@ -685,18 +675,6 @@ export declare class ScalerManager {
      * that holds one label set never has to reach for the whole backend.
      */
     private labelSetMandatoryLabels;
-    /**
-     * The scaler-wide taint gate: {@link labelSetMandatoryLabels} unioned across
-     * every label set the backend declares.
-     *
-     * Its only remaining consumers are the deprecated scaler-wide fields — the
-     * `mandatoryLabels` entry on `ScalerStatus['backends']` and the peer
-     * scaler-capacity summary — which stay populated for a peer that predates the
-     * per-label-set gate. Do NOT gate routing or stamp an agent with this: on a
-     * scaler whose label sets declare different platforms the union names a taint
-     * no single set can satisfy.
-     */
-    private effectiveMandatoryLabels;
     /**
      * Build enriched scaler entries with auto-labels injected into each label set.
      * This ensures label matching accounts for auto-injected labels (kici:role:*,
@@ -1408,8 +1386,8 @@ export declare class ScalerManager {
      *
      * The `globalUsage` counter is recomputed from `perScalerUsage` to
      * keep the cap math consistent. `eventBuffer` is NOT restored — events
-     * emitted by the previous coord before correlation are lost (see
-     * wishlist for the rationale).
+     * emitted by the previous coord before correlation are lost (they are
+     * observability, not correctness: nothing downstream waits on them).
      *
      * Both reads are scoped to this instance's own rows. An unscoped read
      * hydrates a peer's in-flight spawns and reservations as our own, so our

package/dist/scaler/scaler-state-store.d.ts

@@ -142,8 +142,8 @@ export interface ReservationSnapshot {
  *
  * The `eventBuffer` Map is also not persisted: events emitted before
  * correlation are observability, not correctness. A coord crash before
- * `correlateAgentToJob()` runs accepts losing those events (see the
- * wishlist for the rationale).
+ * `correlateAgentToJob()` runs accepts losing those events (they are
+ * observability, not correctness: nothing downstream waits on them).
  *
  * Ownership columns (`owner_instance_id`, `adopted_by`) let several
  * coordinators behind one shared endpoint divide the same tables between them.

package/dist/security/global-workflow-policy.d.ts

@@ -15,11 +15,9 @@ interface GlobalWorkflowPermission {
  * off — or the cluster row is unreadable, which fails closed — no repo may
  * register or dispatch a global workflow, whatever the per-org lists say.
  *
- * With the switch on, three independent per-org axes apply (each stored as a
+ * With the switch on, two independent per-org axes apply (each stored as a
  * jsonb array of `{routingKey?, pattern}` entries on `org_settings`). A missing
- * `org_settings` row means "no per-org restrictions" for the repo and source
- * axes, not a denial; elevated access still requires an explicit list, so a
- * missing row grants none.
+ * `org_settings` row means "no per-org restrictions", not a denial.
  *
  * - Workflow-repo allow-list (`global_workflow_allowed_repos`): which repos
  *   may author global workflows. null/empty = any repo. Checked at
@@ -31,9 +29,6 @@ interface GlobalWorkflowPermission {
  *   untrusted contrib repos). Checked at dispatch time against the EVENT's
  *   repo (the repo that emitted the webhook).
  *
- * - Elevated access (`global_workflow_elevated_repos`): which workflow-
- *   authoring repos can read source-repo secrets during execution.
- *
  * Each entry can optionally pin a `routingKey`, restricting the entry to
  * one webhook source. An entry without a routing key applies to any source
  * in the org. An entry whose routing key no longer matches any current
@@ -53,7 +48,7 @@ export declare class GlobalWorkflowPolicy {
      * The fleet-wide master gate, consulted before any per-org list.
      *
      * Returns `undefined` when the gate passes, or the denial to return
-     * verbatim when it does not — so all three axes share one decision and one
+     * verbatim when it does not — so both axes share one decision and one
      * pair of reasons.
      *
      * Fails closed on `{ ok: false }`. That case is a database fault, not an
@@ -86,26 +81,6 @@ export declare class GlobalWorkflowPolicy {
      *    key AND whose pattern matches the source repo → not allowed.
      */
     isSourceRepoAllowed(eventRoutingKey: string, sourceRepoIdentifier: string, customerId: string): Promise<GlobalWorkflowPermission>;
-    /**
-     * Check whether a workflow-authoring repository is on the elevated-access
-     * list. The workflow's routing key is matched against each entry's optional
-     * `routingKey` qualifier. Returns false if no org_settings row or the
-     * elevated list is null/empty.
-     *
-     * @deprecated Not enforced, and not enforceable in this shape. It was meant
-     * to gate a global workflow's job reading the *source* repository's secrets,
-     * but the organization-wide dispatch path resolves no secrets at all — it
-     * binds no secret contexts, and writes no secret material into a job config
-     * (asserted by `pipeline/process-webhook-globals-secrets.test.ts`). So there
-     * is no injection for a grant to widen, and this method has no caller.
-     *
-     * Granting it would not be a matter of calling this from the dispatch path:
-     * secrets are stored `(org_id, scope, key)` with no repository dimension, so
-     * "the source repository's secrets" is not a set the orchestrator can name
-     * today. The list, its admin route, its CLI mutators and its wire field are
-     * deprecated pending removal at v1.0.0 (`docs/user/deprecations.md`).
-     */
-    isElevatedAccessAllowed(workflowRoutingKey: string, repoIdentifier: string, customerId: string): Promise<boolean>;
     private getSettings;
 }
 export {};

package/dist/security/lock-source.d.ts

@@ -18,7 +18,7 @@ import type { TrustTier } from '@kici-dev/engine';
  * Select which branch's lock file to fetch.
  *
  * Invariant (customer-isolation): for any pull-request event, an
- * untrusted ref (`tier === 'unknown' | 'known' | undefined`) MUST NOT
+ * untrusted ref (`tier === 'unknown' | undefined`) MUST NOT
  * have its HEAD lock file evaluated by the orchestrator. The
  * base-branch lock — controlled by the project's trusted maintainers —
  * is the source of truth for trigger evaluation, trust-tier-based

package/dist/security/trust-policy-gate.d.ts

@@ -22,20 +22,6 @@ import { ForkPolicy } from '@kici-dev/engine';
 import type { OrchestratorMode, TrustPolicy, TrustTier } from '@kici-dev/engine';
 import { SecurityHoldReason } from '../contexts/held-runs.js';
 import type { StoredTrustPolicy } from './trust-policy-store.js';
-/**
- * The enforcement vocabulary the admin API reports and `kici-admin
- * trust-policy show` renders.
- *
- * @deprecated The route reports `policy` unconditionally: `resolveEffectivePolicy`
- * returns a policy for every input, so there is no state left in which the
- * values are absent. The field and this enum stay so an older `kici-admin`
- * binary keeps parsing the response. Removed at v1.0.0.
- */
-export declare const TrustPolicyEnforcement: z.ZodEnum<{
-    legacy: "legacy";
-    policy: "policy";
-}>;
-export type TrustPolicyEnforcement = z.infer<typeof TrustPolicyEnforcement>;
 /** The per-PR facts the fork switch is evaluated against. */
 export interface TrustPolicySignals {
     /** Resolved contributor tier; undefined when no tier was resolved. */

package/dist/security/trust-policy-store.d.ts

@@ -52,9 +52,8 @@ export declare class TrustPolicyStore {
      * COMMITTED two concurrent PATCHes both read the pre-existing row, and the
      * second `ON CONFLICT DO UPDATE` then overwrites every column from its own
      * stale merge — silently dropping the first operator's change (a tightened
-     * `unknownContributorPolicy` reverting to whatever the second caller last
-     * saw). The lock releases on commit or rollback, so there is no unlock to
-     * leak.
+     * `forkPolicy` reverting to whatever the second caller last saw). The lock
+     * releases on commit or rollback, so there is no unlock to leak.
      *
      * `onWrite` receives the same transaction and the merged result, so an audit
      * row written there commits or rolls back with the policy itself — a

package/dist/security/trust-resolver.d.ts

@@ -7,8 +7,7 @@
  * provider API call, no identity lookup.
  *
  * The stored/wire tier vocabulary keeps 'unknown' as the name for
- * "untrusted" and 'trusted' for "trusted"; 'known' is legacy vocabulary
- * that is no longer produced.
+ * "untrusted" and 'trusted' for "trusted".
  */
 import type { TrustTier } from '@kici-dev/engine';
 /** Result of ref-based trust resolution, with the reason recorded for audit. */