@kici-dev/orchestrator 0.9.1 → 0.10.0

package/dist/cluster/cluster-settings-reader.d.ts

@@ -1,7 +1,7 @@
 import type { Kysely } from 'kysely';
 import type { Database } from '../db/types.js';
 /** Numeric columns on cluster_settings readable via {@link ClusterSettingsReader}. */
-export type ClusterNumberColumn = 'max_github_payload_bytes' | 'event_log_max_payload_bytes' | 'lock_file_max_bytes' | 'webhook_dedup_ttl_ms' | 'event_router_event_ttl_seconds' | 'event_router_max_dispatch_attempts' | 'queue_max_depth' | 'reroute_flap_grace_ms' | 'max_fanout_hosts' | 'event_router_rate_limit_per_workflow_per_minute' | 'cache_max_tarball_bytes' | 'cache_ttl_days' | 'lockfile_cache_max' | 'lockfile_cache_max_bytes' | 'lockfile_cache_ttl_ms' | 'content_cache_max' | 'content_cache_max_bytes' | 'content_cache_ttl_ms' | 'global_eval_round_timeout_ms' | 'global_eval_candidate_timeout_ms' | 'global_eval_cache_max' | 'global_eval_wait_timeout_ms' | 'check_run_tracking_ttl_days' | 'run_retention_days' | 'audit_retention_days' | 'provenance_retention_days' | 'held_run_retention_days' | 'concurrency_wait_timeout_ms' | 'agent_token_ttl_ms' | 'ownership_db_check_timeout_ms' | 'unroutable_grace_ms' | 'ingest_overflow_claim_timeout_ms' | 'scaler_reap_interval_ms' | 'scaler_reap_stranded_timeout_ms' | 'scaler_reap_reattempt_interval_ms' | 'scaler_claim_retention_ms' | 'scaler_provision_backoff_base_ms' | 'scaler_provision_backoff_max_ms' | 'scaler_provision_max_consecutive_failures';
+export type ClusterNumberColumn = 'max_github_payload_bytes' | 'event_log_max_payload_bytes' | 'lock_file_max_bytes' | 'webhook_dedup_ttl_ms' | 'event_router_event_ttl_seconds' | 'event_router_max_dispatch_attempts' | 'queue_max_depth' | 'reroute_flap_grace_ms' | 'max_fanout_hosts' | 'event_router_rate_limit_per_workflow_per_minute' | 'cache_max_tarball_bytes' | 'cache_ttl_days' | 'lockfile_cache_max' | 'lockfile_cache_max_bytes' | 'lockfile_cache_ttl_ms' | 'content_cache_max' | 'content_cache_max_bytes' | 'content_cache_ttl_ms' | 'global_eval_round_timeout_ms' | 'global_eval_candidate_timeout_ms' | 'global_eval_cache_max' | 'global_eval_wait_timeout_ms' | 'check_run_tracking_ttl_days' | 'run_retention_days' | 'audit_retention_days' | 'provenance_retention_days' | 'held_run_retention_days' | 'concurrency_wait_timeout_ms' | 'agent_token_ttl_ms' | 'ownership_db_check_timeout_ms' | 'sealed_secrets_retry_backoff_ms' | 'unroutable_grace_ms' | 'ingest_overflow_claim_timeout_ms' | 'scaler_reap_interval_ms' | 'scaler_reap_stranded_timeout_ms' | 'scaler_reap_reattempt_interval_ms' | 'scaler_claim_retention_ms' | 'scaler_provision_backoff_base_ms' | 'scaler_provision_backoff_max_ms' | 'scaler_provision_max_consecutive_failures';
 /** Text columns on cluster_settings readable via {@link ClusterSettingsReader}. */
 export type ClusterStringColumn = 'dashboard_verified_issuer';
 /** Boolean columns on cluster_settings readable via {@link ClusterSettingsReader}. */

package/dist/cluster/coordinator.d.ts

@@ -33,6 +33,8 @@ export interface RunContext {
     traceId?: string;
     /** Pre-resolved clone token for workers without provider credentials. */
     cloneToken?: string;
+    /** Pre-resolved clone token for the workflow repository of an organization-wide job. */
+    workflowCloneToken?: string;
 }
 export interface JobToRoute {
     jobName: string;

package/dist/cluster/live-coordinator-peer.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Whether this coordinator has a live coordinator peer.
+ *
+ * `PeerRegistry` flips `connected` the instant a peer WS closes, with no grace
+ * of its own, so sampling it alone reads a link blip between two healthy
+ * coordinators as a dead peer. That is the same hazard `shouldDeferReroutedJob`
+ * and `adopterIsLive` guard against, and it is answered the same way: a
+ * coordinator peer counts while it is connected or was last heard from within
+ * the flap grace. Worker peers never count: they do not drain the shared queue.
+ */
+import type { PeerRegistry } from './peer-registry.js';
+export declare function hasLiveCoordinatorPeer(peers: Pick<PeerRegistry, 'getCoordinatorPeers'>, nowMs: number, flapGraceMs: number): boolean;
+//# sourceMappingURL=live-coordinator-peer.d.ts.map

package/dist/config.d.ts

@@ -15,6 +15,12 @@
  * and PgSecretStore, not through config. See SourceStore and SourceManager.
  */
 import { z } from 'zod';
+/**
+ * Default for `sealed_secrets_retry_backoff_ms`: how long a coordinator stops
+ * offering a queued job it put back because it could not open its seal. The
+ * config default below and the job queue's own fallback both read this.
+ */
+export declare const DEFAULT_SEALED_SECRETS_RETRY_BACKOFF_MS = 60000;
 /**
  * Validation scope for orchestrator config: a running orchestrator (`runtime`)
  * vs a build-artifact (agent packaging) operation (`packaging`). Packaging only
@@ -73,6 +79,7 @@ declare const configSchema: z.ZodObject<{
     concurrencyWaitTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     dispatchAckTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     ownershipDbCheckTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    sealedSecretsRetryBackoffMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     ingestMaxConcurrency: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     ingestMaxQueueDepth: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     ingestCodelTargetMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -282,6 +289,7 @@ export declare const packagingConfigSchema: z.ZodObject<{
     concurrencyWaitTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     dispatchAckTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     ownershipDbCheckTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    sealedSecretsRetryBackoffMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     ingestMaxConcurrency: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     ingestMaxQueueDepth: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     ingestCodelTargetMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -524,6 +532,7 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     concurrencyWaitTimeoutMs: number;
     dispatchAckTimeoutMs: number;
     ownershipDbCheckTimeoutMs: number;
+    sealedSecretsRetryBackoffMs: number;
     ingestMaxConcurrency: number;
     ingestMaxQueueDepth: number;
     ingestCodelTargetMs: number;

package/dist/contexts/context-store.d.ts

@@ -1,4 +1,5 @@
 import { type Kysely } from 'kysely';
+import { ContextType } from '@kici-dev/engine';
 import type { ConcurrencyStrategy, Context as EngineContext, MinimumTrust } from '@kici-dev/engine';
 import type { Database, Context } from '../db/types.js';
 /** Thrown by `delete` when pending held runs reference the context. */
@@ -15,7 +16,7 @@ export declare function toContext(row: Context): EngineContext;
 /** Fields accepted when creating a context. */
 export interface ContextCreateInput {
     name: string;
-    type?: 'fixed' | 'glob';
+    type?: ContextType;
     globPattern?: string | null;
     branchRestrictions?: string[];
     triggerTypeFilters?: string[];
@@ -44,7 +45,7 @@ export interface ContextCreateInput {
  */
 export interface ContextUpdateInput {
     name?: string;
-    type?: 'fixed' | 'glob';
+    type?: ContextType;
     globPattern?: string | null;
     branchRestrictions?: string[] | null;
     triggerTypeFilters?: string[];

package/dist/contexts/protection/satisfiability.d.ts

@@ -52,13 +52,16 @@ export interface UnsatisfiableBinding {
 export declare function checkBindingSatisfiable(jobName: string, envs: ReadonlyArray<Context | undefined>, envNames: readonly string[]): UnsatisfiableBinding | null;
 /** Minimal lock-workflow shape needed to walk its jobs for satisfiability. */
 interface SatisfiabilityLockWorkflow {
+    /** Workflow-level context names, bound by every job before its own. */
+    contexts?: readonly unknown[];
     jobs?: readonly unknown[];
 }
 /**
  * Walk every workflow's static jobs and reject the registration when a bound
- * context list is provably unsatisfiable (a disabled context, or
- * mutually-exclusive fixed branch/trigger/repo restrictions among the resolved
- * contexts — missing names are lenient, never rejected). Dynamic elements
+ * context list — the workflow-level names plus the job's own — is provably
+ * unsatisfiable (a disabled context, or mutually-exclusive fixed
+ * branch/trigger/repo restrictions among the resolved contexts — missing names
+ * are lenient, never rejected). Dynamic elements
  * are skipped (unresolvable at registration); the all-must-pass semantics keep
  * the static subset's exclusivity sound. Throws the first
  * `UnsatisfiableBinding.message` so the registration route / direct helper

package/dist/db/migrations/145_execution_runs_workflow_provenance.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=145_execution_runs_workflow_provenance.d.ts.map

package/dist/db/migrations/146_pending_job_contexts_context_resolution.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=146_pending_job_contexts_context_resolution.d.ts.map

package/dist/db/migrations/147_sealed_job_secrets.d.ts

@@ -0,0 +1,19 @@
+import { type Kysely } from 'kysely';
+/**
+ * Hold the secret fields of a stored job encrypted under the orchestrator
+ * master key, beside the plain JSON column that keeps every other field.
+ *
+ * Adds a nullable `sealed_secrets text` column to the three tables a job waits
+ * in: `dispatch_queue` (its `job_config`), `pending_job_contexts` (its
+ * `job_input`), and `pending_workflow_contexts` (its `context`).
+ *
+ * Nullable and unbackfilled: NULL on every row written before this column
+ * existed, and on every row an orchestrator without a master key writes. Such
+ * a row keeps its secret fields in the plain column and reads back unchanged.
+ *
+ * Idempotent: each column is added only when missing.
+ */
+export declare const SEALED_SECRETS_TABLES: readonly ['dispatch_queue', 'pending_job_contexts', 'pending_workflow_contexts'];
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=147_sealed_job_secrets.d.ts.map

package/dist/db/migrations/148_cluster_settings_sealed_secrets_retry_backoff_ms.d.ts

@@ -0,0 +1,21 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `cluster_settings.sealed_secrets_retry_backoff_ms` (nullable bigint).
+ *
+ * How long a coordinator leaves a queued job alone after it claimed the job and
+ * could not open its sealed secrets: the job was sealed with a master key this
+ * coordinator does not hold. During a rolling key rotation a coordinator that
+ * holds the key can take the job in that window; after it, this coordinator can
+ * claim the job again, and each claim spends another dispatch attempt, so a job
+ * no coordinator can open still fails.
+ *
+ * Cluster-global (every coordinator drains the same queue), so it lives on
+ * `cluster_settings` rather than `org_settings`. NULL ⇒ the orchestrator's own
+ * configured default applies.
+ *
+ * Idempotent: guarded on column existence; a re-run on a DB that already has the
+ * column is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=148_cluster_settings_sealed_secrets_retry_backoff_ms.d.ts.map

package/dist/db/migrations/149_workflow_registrations_dep_cache_key.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=149_workflow_registrations_dep_cache_key.d.ts.map

package/dist/db/migrations/150_execution_runs_status_epoch.d.ts

@@ -0,0 +1,18 @@
+import { type Kysely } from 'kysely';
+/**
+ * Add `execution_runs.status_epoch` (integer, NOT NULL, default 0).
+ *
+ * The run's status generation. It starts at 0, and the tracker raises it each
+ * time a run leaves a terminal status: a run failed before a job it had already
+ * dispatched reported in, and the run continues. Every `execution.status` frame
+ * carries it, so the Platform can keep a finished run finished against a
+ * non-terminal frame that arrives late, and still follow a real reopen.
+ *
+ * A constant default adds the column without rewriting the table, and every
+ * existing row reads 0: none of them was reopened under this counter.
+ *
+ * Idempotent: guarded on the column's existence, so re-running is a no-op.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=150_execution_runs_status_epoch.d.ts.map

package/dist/db/migrations/151_workflow_registrations_dep_cache_key_sha.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;
+//# sourceMappingURL=151_workflow_registrations_dep_cache_key_sha.d.ts.map

package/dist/db/repos/signing-keys-repo.d.ts

@@ -1,4 +1,4 @@
-import type { Kysely } from 'kysely';
+import { type Kysely } from 'kysely';
 import type { Database, OrchestratorSigningKeyRow } from '../types.js';
 export interface UpsertActiveInput {
     kid: string;
@@ -9,6 +9,31 @@ export interface UpsertActiveInput {
     signer_kind: string;
     key_ref: string | null;
 }
+/**
+ * Advisory-lock name taken (`pg_advisory_xact_lock(hashtext(...))`) by every
+ * writer that changes which key is `active` or revokes a key: `activateIfCurrent`,
+ * `upsertActive` and `revoke`. Holding it for the whole transaction makes
+ * "read the active key, then write" atomic across orchestrator nodes sharing the
+ * database, and orders a revoke against a key switch.
+ */
+export declare const ACTIVE_SIGNING_KEY_LOCK = "orchestrator-signing-key-active";
+/**
+ * The columns a key listing may expose: identity, lifecycle and custody
+ * metadata. Never the public JWK or the wrapped private key.
+ */
+export declare const SIGNING_KEY_METADATA_COLUMNS: readonly ['kid', 'status', 'alg', 'signer_kind', 'key_ref', 'activated_at', 'created_at'];
+/** One row of {@link OrchestratorSigningKeyRepo.listTrustedMetadata}. */
+export type SigningKeyMetadataRow = Pick<OrchestratorSigningKeyRow, (typeof SIGNING_KEY_METADATA_COLUMNS)[number]>;
+/** Outcome of {@link OrchestratorSigningKeyRepo.activateIfCurrent}. */
+export interface ActivateIfCurrentResult {
+    /** True when this call activated `input.kid`. */
+    activated: boolean;
+    /**
+     * The active row after the call: the new row when `activated`, otherwise the
+     * row that was active when the lock was taken (null when none was).
+     */
+    active: OrchestratorSigningKeyRow | null;
+}
 /**
  * Repository for the orchestrator's provenance signing keys. Ports the Platform's
  * `signing-keys-repo.ts` status model (activate / retire / revoke) and adds
@@ -17,18 +42,38 @@ export interface UpsertActiveInput {
 export declare class OrchestratorSigningKeyRepo {
     private readonly db;
     constructor(db: Kysely<Database>);
+    private lockActiveKey;
+    private readActiveRow;
     /** Public keys served in the JWKS / trusted for verification (everything except revoked). */
     listTrusted(): Promise<OrchestratorSigningKeyRow[]>;
+    /**
+     * The same keys as {@link listTrusted}, in the same order, with only the
+     * {@link SIGNING_KEY_METADATA_COLUMNS}. Backs `kici-admin signing-key list`.
+     */
+    listTrustedMetadata(): Promise<SigningKeyMetadataRow[]>;
     /** The single currently-active key row, or null when none is active. */
     getActiveRow(): Promise<OrchestratorSigningKeyRow | null>;
+    /**
+     * Activate the freshly generated key `input` only if the active key is still
+     * the one the caller last read (`expectedActiveKid`; null = none was active).
+     * The read and the write run under {@link ACTIVE_SIGNING_KEY_LOCK}, so of
+     * several nodes that each read "no key" and each generated one, exactly one
+     * activates; every other call returns the winner's row untouched. A replaced
+     * key is demoted to `retiring`.
+     */
+    activateIfCurrent(expectedActiveKid: string | null, input: UpsertActiveInput): Promise<ActivateIfCurrentResult>;
     /**
      * Activate `input.kid`. If it is already active, no-op. Otherwise demote any
      * current active key to `retiring`, upsert this kid as `active`, in one
-     * transaction. Returns true when a NEW kid was activated (caller audits).
-     * Refuses to reactivate a `revoked` kid.
+     * transaction under {@link ACTIVE_SIGNING_KEY_LOCK}. Returns true when a NEW
+     * kid was activated (caller audits). Refuses to reactivate a `revoked` kid.
      */
     upsertActive(input: UpsertActiveInput): Promise<boolean>;
     retire(kid: string): Promise<void>;
+    /**
+     * Mark `kid` revoked, under {@link ACTIVE_SIGNING_KEY_LOCK} so a concurrent
+     * key switch either sees the revoke or finishes before it.
+     */
     revoke(kid: string, reason: string): Promise<void>;
 }
 //# sourceMappingURL=signing-keys-repo.d.ts.map

package/dist/db/types.d.ts

@@ -1,6 +1,7 @@
 import type { ColumnType, Generated, Insertable, Selectable, Updateable } from 'kysely';
 import type { ApprovalRequirement, ApproverClause, InitFailure, StepApprovalPayload } from '@kici-dev/engine';
 import type { PrecursorResult } from '../cache/precursor-result.js';
+import type { DeferredContextResolution } from '../pipeline/held-context-data.js';
 /**
  * Job kind stored in `execution_jobs.job_kind`. `Standard` runs steps on an
  * agent; `Gate` is an invoke gate that summons source-repo runs; `Proxy`
@@ -231,8 +232,15 @@ export interface DispatchQueueTable {
     /** JSONB array of runs-on labels for agent matching.
      *  Insert: JSON.stringify(labels), Select: auto-parsed by pg driver. */
     runs_on_labels: string;
-    /** JSON-encoded Record of the full job configuration */
+    /** JSON-encoded Record of the job configuration, without the fields in `sealed_secrets` */
     job_config: string;
+    /**
+     * The secret fields of the stored job, AES-256-GCM encrypted under the
+     * orchestrator master key (`secrets/job-secret-seal.ts`). NULL when there is
+     * nothing to seal, when no master key is configured, and on a row written
+     * before the column existed: those rows keep the fields in the plain column.
+     */
+    sealed_secrets: ColumnType<string | null, string | null | undefined, string | null>;
     /** Repository clone URL */
     repo_url: string;
     /** Git ref (branch/tag) */
@@ -506,6 +514,13 @@ export interface ExecutionRunTable {
      * cancelled and for one that entered `cancelling` before the column existed.
      */
     cancelling_at: ColumnType<Date | null, Date | null | undefined, Date | null>;
+    /**
+     * The run's status generation (migration 150). Starts at 0 and rises by one
+     * each time the run leaves a terminal status to continue. Forwarded on every
+     * `execution.status` frame as `statusEpoch`, so the Platform can tell a
+     * reopen from a frame that arrives late after the run finished.
+     */
+    status_epoch: Generated<number>;
     /** Total execution duration in milliseconds */
     duration_ms: number | null;
     /**
@@ -627,6 +642,18 @@ export interface ExecutionRunTable {
      * repository that defines it rather than from the one it ran against.
      */
     workflow_repo_identifier: string | null;
+    /**
+     * Commit of the workflow repository the run dispatched, when the workflow is
+     * defined in another repository (`workflow_repo_identifier` set). A re-run
+     * dispatches this exact commit. NULL on every per-repository run.
+     */
+    workflow_sha: string | null;
+    /**
+     * The workflow repository's registered branch, when the workflow is defined
+     * in another repository. The git-credential relay checks context branch rules
+     * against it. NULL on every per-repository run.
+     */
+    workflow_branch: string | null;
     /**
      * True when this row records a global evaluation round rather than a
      * workflow.
@@ -1638,6 +1665,31 @@ export interface WorkflowRegistrationsTable {
     default_branch: ColumnType<string | null, string | null | undefined, string | null>;
     /** Source file path for this workflow (e.g. ".kici/workflows/deploy.ts") */
     source_file: ColumnType<string | null, string | null | undefined, string | null>;
+    /**
+     * `lockfileHash` of the lock file that last registered this workflow: the
+     * package-manager lockfile hash that keys the dependency cache. A run dispatched
+     * from the registration probes the dependency cache with it.
+     *
+     * NULL when that lock file records none, and on rows written before migration
+     * 149. NULL means the run installs its dependencies on the agent.
+     */
+    lockfile_hash: ColumnType<string | null, string | null | undefined, string | null>;
+    /**
+     * `siblingsDigest` of the lock file that last registered this workflow: the
+     * in-repo `workspace:` sibling closure, part of the dependency-cache key next to
+     * `lockfile_hash`. NULL when that lock file records none.
+     */
+    siblings_digest: ColumnType<string | null, string | null | undefined, string | null>;
+    /**
+     * The `commit_sha` written together with `lockfile_hash` and `siblings_digest`.
+     * The key is used only while this equals `commit_sha`: a writer that does not
+     * know the key columns moves `commit_sha` without them, and the key it leaves
+     * behind belongs to an older lock file.
+     *
+     * NULL on rows written before migration 151 and on rows registered with no
+     * commit; such a row uses no key.
+     */
+    dep_cache_key_sha: ColumnType<string | null, string | null | undefined, string | null>;
     /** Whether this is a global workflow (triggers across all repos under same routing key) */
     is_global: ColumnType<boolean, boolean | undefined, boolean>;
     /**
@@ -2211,6 +2263,12 @@ export interface ClusterSettingsTable {
      * violation. NULL ⇒ the orchestrator's configured default.
      */
     ownership_db_check_timeout_ms: ColumnType<string | null, number | null | undefined, number | null>;
+    /**
+     * How long a coordinator leaves a queued job alone after it could not open the
+     * job's sealed secrets, before claiming it again. NULL ⇒ the orchestrator's
+     * configured default.
+     */
+    sealed_secrets_retry_backoff_ms: ColumnType<string | null, number | null | undefined, number | null>;
     /**
      * Verified-tier origin the dashboard fetches the orchestrator's X25519
      * dashboard-encryption public key from (and always displays) under the
@@ -2248,6 +2306,21 @@ export interface PendingJobContextsTable {
      * instead of dispatching to an agent. NULL for every ordinary job.
      */
     invoke_config: ColumnType<string | null, string | null | undefined, string | null>;
+    /**
+     * For a job bound to a context, what the dispatch of the stored job resolves
+     * the job's context variables and secrets from (context names, org, routing
+     * key, host facts, registry-auth inputs) as JSONB. Never a secret value. NULL
+     * for a job with no bound context, and for a row stored before the column
+     * existed, whose `job_input` still carries its resolved context data.
+     */
+    context_resolution: ColumnType<DeferredContextResolution | null, string | null | undefined, string | null>;
+    /**
+     * The secret fields of the stored job, AES-256-GCM encrypted under the
+     * orchestrator master key (`secrets/job-secret-seal.ts`). NULL when there is
+     * nothing to seal, when no master key is configured, and on a row written
+     * before the column existed: those rows keep the fields in the plain column.
+     */
+    sealed_secrets: ColumnType<string | null, string | null | undefined, string | null>;
     /** When this context was stored */
     created_at: Generated<Date>;
 }
@@ -2266,6 +2339,13 @@ export interface PendingWorkflowContextsTable {
     org_id: string;
     /** Serializable WorkflowDispatchContext inputs as JSONB */
     context: ColumnType<Record<string, unknown>, string, string>;
+    /**
+     * The secret fields of the stored job, AES-256-GCM encrypted under the
+     * orchestrator master key (`secrets/job-secret-seal.ts`). NULL when there is
+     * nothing to seal, when no master key is configured, and on a row written
+     * before the column existed: those rows keep the fields in the plain column.
+     */
+    sealed_secrets: ColumnType<string | null, string | null | undefined, string | null>;
     /** When this context was stored */
     created_at: Generated<Date>;
 }

package/dist/git/clone-token-auth.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The structured clone auth a bare clone token stands for.
+ */
+import type { ProviderGitAuth } from '@kici-dev/engine';
+/** Basic-auth envelope for a provider clone token (`x-access-token` user, GitHub convention). */
+export declare function cloneTokenGitAuth(token: string): ProviderGitAuth;
+//# sourceMappingURL=clone-token-auth.d.ts.map

package/dist/git/dispatch-git-auth.d.ts

@@ -0,0 +1,63 @@
+import type { ProviderGitAuth } from '@kici-dev/engine';
+import type { ProviderBundle, ProviderRegistry } from '../provider-registry.js';
+/** Auth the dispatch message carries; every field is optional on the wire. */
+export interface DispatchCloneAuth {
+    /** Bare source-repository token, kept for agents that read only `token`. */
+    token?: string;
+    sourceAuth?: ProviderGitAuth;
+    workflowAuth?: ProviderGitAuth;
+}
+/**
+ * Mint structured auth (and a bare token when it is basic auth) for one
+ * repository through one bundle. Providers that implement `issueGitAuth()`
+ * return the auth kind directly; otherwise a clone token is wrapped in a
+ * basic-auth envelope.
+ */
+export declare function mintRepoGitAuth(bundle: ProviderBundle, repoIdentifier: string, providerContext: unknown): Promise<{
+    token: string | null;
+    structuredAuth: ProviderGitAuth | null;
+}>;
+/** The job fields the auth resolution reads. */
+export interface DispatchAuthJob {
+    id: string;
+    repoUrl: string;
+    routingKey: string;
+    providerContext: unknown;
+    jobConfig: Record<string, unknown>;
+}
+/**
+ * The git host of a clone URL: the URL host, or the host of an scp-style
+ * `[user@]host:path` remote. `undefined` when neither form parses.
+ */
+export declare function gitHostOf(url: string): string | undefined;
+/**
+ * Why a global job must not be dispatched with this auth, or `undefined` when
+ * it may.
+ *
+ * The agent falls back across the two clones: it clones the source repository
+ * with `sourceAuth ?? workflowAuth ?? token` and the workflow repository with
+ * `workflowAuth ?? sourceAuth ?? token`. When only one repository's credential is
+ * present, the other clone sends it to that repository's host. On the same host
+ * that is a credential the host issued; on another host it hands one provider's
+ * credential to another, so the job is refused instead. A job with no source URL
+ * clones nothing from a host, and neither does a `file:` clone, so pairing one
+ * credential with a local repository is never refused.
+ */
+export declare function crossHostAuthRefusal(jobConfig: Record<string, unknown>, repoUrl: string, auth: DispatchCloneAuth): string | undefined;
+/**
+ * Resolve the clone auth of one dispatch: the source repository's through the
+ * job's bundle, and for a global job the workflow repository's through its own
+ * bundle. Returns a refusal message when the job must not be dispatched.
+ */
+export declare function resolveDispatchCloneAuth(args: {
+    providerRegistry: ProviderRegistry;
+    /** The bundle of the job's routing key; undefined for an overlay (local) run. */
+    bundle: ProviderBundle | undefined;
+    repoIdentifier: string;
+    job: DispatchAuthJob;
+}): Promise<{
+    auth: DispatchCloneAuth;
+} | {
+    refused: string;
+}>;
+//# sourceMappingURL=dispatch-git-auth.d.ts.map

package/dist/lockfile-validate.d.ts

@@ -18,9 +18,11 @@ export declare function parseLockDocument(raw: string, repoIdentifier: string, r
  * `schemaVersion` is at or above this codebase's `BREAKING_FLOOR` and whose
  * required reader version is at or below this orchestrator's `SCHEMA_VERSION`.
  * Both out-of-window cases throw a `LockFileParseError` (the established
- * corrupt-lock signal) carrying operator-actionable guidance.
+ * corrupt-lock signal) carrying operator-actionable guidance. `readerVersion`
+ * is the schema version this orchestrator reads, overridable so a test can pose
+ * as an older orchestrator.
  */
-export declare function assertLockFileSchemaCompatible(lockFile: LockFile, repoIdentifier: string, ref: string): void;
+export declare function assertLockFileSchemaCompatible(lockFile: LockFile, repoIdentifier: string, ref: string, readerVersion?: number): void;
 /**
  * Walk every static job's runsOn / excludeLabels / runsOnAll matchers and throw
  * if any element is not a valid LabelMatcher. Dynamic job generators carry no

package/dist/metrics/prometheus.d.ts

@@ -642,7 +642,7 @@ export declare const installSecretsContributorStrippedTotal: import("@openteleme
  */
 export declare const containerRegistryAuthContributorStrippedTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
 /**
- * Per-environment latency of `secretResolver.resolveForJob` calls in the
+ * Per-environment latency of `secretResolver.resolveForContext` calls in the
  * install-secrets path. Buckets mirror `triggerMatchDurationSeconds`:
  * 1ms → 5s covers fast Postgres reads through pathological Vault timeouts.
  *

package/dist/oidc/id-token-claims.d.ts

@@ -14,6 +14,11 @@ export interface RunClaimSource {
     run_id: string;
     org_id: string;
     repo_identifier: string | null;
+    /**
+     * `owner/repo` of the repository that defines the workflow, when that is not
+     * `repo_identifier` (a global workflow). NULL for a same-repository run.
+     */
+    workflow_repo_identifier: string | null;
     ref: string | null;
     sha: string | null;
     workflow_name: string | null;
@@ -77,6 +82,11 @@ export interface IdTokenClaims extends EventClaims {
     kici_run_id: string;
     kici_job_id: string;
     repository: string | null;
+    /**
+     * The repository that defines the workflow. Equals `repository` for a
+     * same-repository run; names the workflow repository for a global workflow.
+     */
+    workflow_repository: string | null;
     ref: string | null;
     sha: string | null;
     workflow_ref: string | null;

package/dist/oidc/oidc-mint-registration.d.ts

@@ -40,6 +40,8 @@ export interface OidcMintRegistrationInput {
      * first mint (leader-election-race-safe).
      */
     resolveOrchestratorSigner?: () => Promise<Signer | null>;
+    /** Whether this node is the Raft leader; named when a mint defers for want of a key. */
+    isLeader?: () => boolean;
     /** The orchestrator's own provenance issuer identity (config.provenanceSigningIssuer). */
     provenanceSigningIssuer?: string;
     dispatcher: LocalMintOwnershipResolver & {

package/dist/oidc/orchestrator-mint.d.ts

@@ -21,6 +21,21 @@ import type { Signer } from './signer.js';
 export declare const DEFAULT_ORG_ID = "__default__";
 /** ID-token lifetime (seconds). */
 export declare const ORCHESTRATOR_ID_TOKEN_TTL_SECONDS = 600;
+/**
+ * Longest an agent mint waits for the provenance signer before it answers
+ * `{ deferred: true, code: 'unavailable' }`. Half the agent's `agent.api`
+ * timeout, so the deferred answer crosses the WebSocket and sandbox hops and
+ * reaches the step before the agent gives up on the call.
+ */
+export declare const ORCHESTRATOR_MINT_SIGNER_WAIT_MS: number;
+/**
+ * Minimum spacing between two warnings about mints deferred for want of a
+ * signing key. The first deferral after a signer was last available warns at
+ * once; later ones within the interval are counted into the next warning.
+ */
+export declare const MINT_DEFER_WARN_INTERVAL_MS = 60000;
+/** Logged when an agent mint defers because no provenance signing key is ready. */
+export declare const MINT_DEFERRED_NO_SIGNER_MESSAGE = "provenance signing key is not provisioned; deferring the identity-token mint";
 export declare class OrchestratorMintRunNotFoundError extends Error {
 }
 export declare class OrchestratorMintJobNotFoundError extends Error {
@@ -77,12 +92,18 @@ export declare class OrchestratorMintSignerUnavailableError extends Error {
 export interface OrchestratorOidcTokenHandlerDeps {
     dispatcher: OrchestratorMintOwnershipResolver;
     /**
-     * Lazily resolve the orchestrator's signing key. Resolved on first token
-     * request (not at boot) so it is unaffected by the Raft leader-election race —
-     * by the time an agent requests a token the cluster has a leader and the key
-     * exists. May return null while the key is still being reconciled.
+     * Lazily resolve the orchestrator's signing key. May return null while the
+     * key is still being reconciled. The handler waits at most
+     * {@link ORCHESTRATOR_MINT_SIGNER_WAIT_MS} for it; a null or a later answer
+     * defers the mint.
      */
     resolveSigner: () => Promise<Signer | null>;
+    /**
+     * Whether this node is the Raft leader, named in the deferral warning so an
+     * operator can tell a non-leader waiting on the leader from a leader that
+     * could not create the key.
+     */
+    isLeader?: () => boolean;
     /** Mint deps except the signer (supplied lazily via `resolveSigner`). */
     mint: Omit<OrchestratorMintDeps, 'signer'>;
     /**