@lchase/kiln 0.10.0 → 0.12.0

package/dist/board.js

@@ -1,102 +1,5 @@
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
-import { scheduledRetry } from "./attention.js";
-const FEATURE_STAGES = ["spec", "build", "review", "approve", "land", "pr-review"];
-const CATALOG = [
-    { id: "queued", label: "Queued", who: "waiting · deps", tone: "queued" },
-    { id: "spec", label: "Spec", who: "spec-writer · opus" },
-    { id: "build", label: "Build", who: "builder · opus" },
-    { id: "review", label: "Review", who: "sec · ux · ui · code" },
-    { id: "approve", label: "Approve", who: "approver · opus" },
-    { id: "explore", label: "Explore", who: "investigator · opus" },
-    { id: "land", label: "Land", who: "git commit" },
-    { id: "pr-review", label: "PR review", who: "pr-sync" },
-    { id: "done", label: "Done", who: "local", tone: "merged" },
-    { id: "merged", label: "Merged", who: "pr", tone: "merged" },
-    { id: "needs-human", label: "Needs human", who: "approve · retry", tone: "human" },
-];
-const STEP_STAGE = {
-    spec: "spec",
-    build: "build",
-    verify: "build",
-    security: "review",
-    ux: "review",
-    ui: "review",
-    code: "review",
-    approver: "approve",
-    approve: "needs-human",
-    land: "land",
-    explore: "explore",
-};
-const HUMAN_STATES = new Set(["needs-human", "failed", "dead", "invalid", "rejected"]);
-/**
- * Column for one job. Human gates and broken runs sit in Needs human.
- * A failed job with an automatic retry still scheduled stays on the step
- * its last run reached. `scheduledRetry` is that decision.
- */
-export function stageOf(job) {
-    if (scheduledRetry(job))
-        return runStage(job);
-    if (HUMAN_STATES.has(job.state))
-        return "needs-human";
-    if (job.state === "in-review")
-        return "pr-review";
-    if (job.state === "done")
-        return job.prUrl || job.prNumber ? "merged" : "done";
-    const current = job.steps.find((step) => step.phase === "current" || step.phase === "failed");
-    if (job.state === "queued" || job.state === "blocked")
-        return "queued";
-    if (job.state === "approved") {
-        if (current && current.id !== "land" && current.id !== "approve" && STEP_STAGE[current.id])
-            return STEP_STAGE[current.id];
-        return "land";
-    }
-    if (current && STEP_STAGE[current.id])
-        return STEP_STAGE[current.id];
-    return runStage(job);
-}
-/**
- * Stage of the last step the run actually reached.
- * The approve gate's column is Needs human; a scheduled retry is not a gate,
- * so that step stays on Approve. Spec or Explore when the run never started a step.
- */
-function runStage(job) {
-    const last = [...job.steps].reverse().find((step) => step.phase === "current" || step.phase === "failed");
-    const stage = last ? STEP_STAGE[last.id] : undefined;
-    if (stage && stage !== "needs-human")
-        return stage;
-    if (stage === "needs-human") {
-        const earlier = [...job.steps].reverse().find((step) => {
-            const mapped = STEP_STAGE[step.id];
-            return step.phase === "done" && mapped !== undefined && mapped !== "needs-human";
-        });
-        if (earlier)
-            return STEP_STAGE[earlier.id] ?? "approve";
-        return "approve";
-    }
-    return job.workflow === "investigation" ? "explore" : "spec";
-}
-/** Stages to render. An empty kiln still shows the feature pipeline, collapsed. */
-export function stagesFor(jobs) {
-    const workflows = new Set(jobs.map((job) => job.workflow));
-    const wanted = new Set();
-    if (jobs.length === 0 || workflows.has("feature") || [...workflows].some((name) => name !== "investigation")) {
-        for (const id of FEATURE_STAGES)
-            wanted.add(id);
-    }
-    if (workflows.has("investigation"))
-        wanted.add("explore");
-    wanted.add("queued");
-    wanted.add("needs-human");
-    const reached = new Set(jobs.map((job) => stageOf(job)));
-    if (reached.has("done") || !reached.has("merged"))
-        wanted.add("done");
-    if (reached.has("merged"))
-        wanted.add("merged");
-    for (const id of reached)
-        wanted.add(id);
-    return CATALOG.filter((stage) => wanted.has(stage.id));
-}
 const REVIEW_FILE = /^(security|ux|ui|code)(?:\.(\d+))?\.json$/;
 const TEXT_LIMIT = 8_000;
 export function readReviewRounds(runDir) {

package/dist/cli.js

@@ -2,6 +2,7 @@
 import { addRepo, renderRepoList, resolveKilnConfig } from "./config.js";
 import { renderSandboxStatus, runSandboxBuild } from "./sandbox.js";
 import { answerJob, retryJob, reviseJob, runStatus, runTick } from "./driver.js";
+import { productionHost } from "./host.js";
 import { pauseFactory, resumeFactory } from "./rails.js";
 import { parseSince, renderLedgerFile } from "./ledger.js";
 import { startServe } from "./serve.js";
@@ -88,6 +89,11 @@ function usage() {
         "that requests changes starts a fix on that same branch, up to maxFixRounds",
         "(default 2). Kiln does not merge, approve, or comment. Past that bound the",
         "job is needs-human with reason feedback-exhausted.",
+        "Triggers in the kiln config start work without kiln add. A cron fires",
+        "on the serve tick in local time, once per slot, and once on startup",
+        "when a slot was missed. Jira polls are per repo. Kiln-owned pull",
+        "request activity uses the same read as the fix loop. A failed fire",
+        "waits for the next slot. Pause and the daily cap skip the fire.",
         "",
         "serve listens on 127.0.0.1. The page is a board of workflow stages:",
         "queued, spec, build, review, approve, land, PR review, Done (landed locally),",
@@ -401,7 +407,7 @@ function tickCommand(argv) {
         usage();
     }
     const config = resolveKilnConfig({ configPath: flags.configPath });
-    process.stdout.write(runTick(config));
+    process.stdout.write(runTick(config, productionHost()));
 }
 function statusCommand(argv) {
     const flags = parseFlags(argv);

package/dist/config.js

@@ -54,6 +54,11 @@ export function loadKilnConfig(configPath, options = {}) {
         sandbox: parsed.data.sandbox ?? {},
         workflowSandbox: workflowSandboxFrom(parsed.data.workflows),
         ...(jira ? { jira } : {}),
+        triggers: parsed.data.triggers ?? [],
+        routes: parsed.data.routes ?? [],
+        ...(parsed.data.reviewPrompt
+            ? { reviewPrompt: resolveConfiguredPath(configDir, parsed.data.reviewPrompt, home) }
+            : {}),
     };
 }
 /**

package/dist/driver.js

@@ -21,7 +21,8 @@ import { projectRunJournal, promptsHash } from "./project.js";
 import { gateAnswerCommand, renderStatus, renderTick, statusView, yakCliPath, sandboxFailureDetail, } from "./report.js";
 import { AGENT_SANDBOX_IMAGE, injectAgentSandbox, jobIsSandboxed, probeSandboxEnvironment, PROXY_SANDBOX_IMAGE, requiredSandboxImages, resolveSandbox, sandboxIsEnabled, sandboxPreflight, sandboxPreflightFor, } from "./sandbox.js";
 import { JobSchema } from "./schemas.js";
-import { leafStepIds, materializeWorkflow, workflowInputs, workflowNeedsTestCommand, workflowStepPlan } from "./workflow.js";
+import { ensureReviewHead, evaluateTriggers, recordOwnedPullRequest, reviewHeadOf, } from "./triggers.js";
+import { leafStepIds, materializeWorkflow, REVIEW_WORKFLOW, workflowInputs, workflowNeedsTestCommand, workflowStepPlan, } from "./workflow.js";
 const TAG_PREFIX = "kiln:";
 export function jobTag(jobId) {
     return `${TAG_PREFIX}${jobId}`;
@@ -53,8 +54,14 @@ export function runTick(config, host = defaultHost(), options = {}) {
         const midway = observe(config, host, now);
         bindOpenFixRuns(config, midway);
         const published = publishReadyFixes(config, host, midway);
+        evaluateTriggers({
+            config,
+            now,
+            startup: options.triggerStartup ?? startup,
+            ...(host.reviews ? { reviews: host.reviews } : {}),
+        });
         const world = observe(config, host, now);
-        const feedbackNotes = watchPullRequests(config, world, host);
+        const feedbackNotes = watchPullRequests(config, world, host, now);
         const actions = decide(world.observation, now);
         if (world.observation.spendBlocked) {
             recordDailyCap(config.kilnDir, spendSnapshot(readEvents(config.kilnDir, { warn: () => { } }), config.dailyDollarCap, now), now);
@@ -749,7 +756,7 @@ function gateEdit(checkout, runId, stepId) {
  * Read each open pull request once per tick and attach a plan.
  * `readStatus` does not call this. A host with no feedback reader does not watch.
  */
-function watchPullRequests(config, world, host) {
+function watchPullRequests(config, world, host, now) {
     const notes = [];
     if (!host.feedback)
         return notes;
@@ -775,11 +782,28 @@ function watchPullRequests(config, world, host) {
             ledger,
             snapshot,
         });
+        recordOwnedPullRequest(config, {
+            jobId: job.jobId,
+            repo: job.repo,
+            prNumber: job.delivery?.prNumber ?? 0,
+            headSha: snapshot.headSha,
+            comments: snapshot.comments.map((comment) => ({
+                id: comment.id,
+                author: comment.author,
+                body: comment.body,
+                resolved: comment.resolved,
+            })),
+            reviews: snapshot.reviews.map((review) => ({
+                id: review.id,
+                author: review.author,
+                body: review.body,
+            })),
+        }, now);
     }
     return notes;
 }
 function shouldWatch(job) {
-    if (job.deliver !== "pr" || job.workflow === INVESTIGATION_WORKFLOW)
+    if (job.deliver !== "pr" || job.workflow === INVESTIGATION_WORKFLOW || job.workflow === REVIEW_WORKFLOW)
         return false;
     if (job.error || job.feedbackLedgerError || job.feedbackExhausted || job.feedbackAmbiguous)
         return false;
@@ -1041,7 +1065,9 @@ function launchJob(config, world, job, host, sandboxFacts) {
     if (workflowNeedsTestCommand(sourceWorkflow) && !testCommand?.trim()) {
         throw new Error(`Repo ${job.repo} has no test command. Set repos.${job.repo}.test. The feature workflow refuses to run an empty KILN_TEST.`);
     }
-    const workflow = materializeWorkflow(config.kilnDir, job.id, job.workflow);
+    const workflow = materializeWorkflow(config.kilnDir, job.id, job.workflow, {
+        ...(config.reviewPrompt ? { reviewPrompt: config.reviewPrompt } : {}),
+    });
     const logPath = join(config.kilnDir, "logs", `${jobBasename(job.id)}.log`);
     mkdirSync(dirname(logPath), { recursive: true });
     ensureCheckoutExcludes(repo.path);
@@ -1053,14 +1079,23 @@ function launchJob(config, world, job, host, sandboxFacts) {
         if (blocked)
             return { jobId: job.id, repo: job.repo, output: blocked };
         assertStackTarget(world, job);
-        baseSha = resolveLaunchBase({
-            checkout: repo.path,
-            deliver: repo.deliver,
-            stack: job.stack === true,
-            ...(repo.base ? { configuredBase: repo.base } : {}),
-            ...(job.stack ? { upstreamBranch: upstreamLocalBranch(world, job) } : {}),
-            git: host.git,
-        });
+        const pinned = reviewHeadOf(job);
+        if (pinned) {
+            const number = Number(job.source?.ref.split(":")[2]);
+            if (Number.isInteger(number) && number > 0)
+                ensureReviewHead(repo.path, number, pinned);
+            baseSha = resolveCommit(host, repo.path, pinned);
+        }
+        else {
+            baseSha = resolveLaunchBase({
+                checkout: repo.path,
+                deliver: repo.deliver,
+                stack: job.stack === true,
+                ...(repo.base ? { configuredBase: repo.base } : {}),
+                ...(job.stack ? { upstreamBranch: upstreamLocalBranch(world, job) } : {}),
+                git: host.git,
+            });
+        }
         specText = specHandedToYak(config, world, job);
     }
     catch (error) {

package/dist/events.js

@@ -9,8 +9,8 @@ import { redactDeep } from "./redact.js";
  * parses it. A write failure is reported and does not escape to the caller.
  *
  * `run_id` and `step` are null when the moment has none. `job_id` is null
- * for `config.reloaded`, `kiln.paused`, `kiln.resumed`, and `budget.blocked`,
- * which are not a job.
+ * for `config.reloaded`, `kiln.paused`, `kiln.resumed`, `budget.blocked`,
+ * and trigger fires that do not belong to a job yet.
  */
 export const EVENT_NAMES = [
     "job.added",
@@ -31,6 +31,10 @@ export const EVENT_NAMES = [
     "kiln.paused",
     "kiln.resumed",
     "budget.blocked",
+    "trigger.fired",
+    "trigger.routed",
+    "trigger.failed",
+    "trigger.skipped",
 ];
 const ISO_UTC = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/;
 const once = z.string().min(1).optional();
@@ -131,6 +135,35 @@ const BudgetBlocked = z.object({
     cap: z.number().nonnegative(),
     once,
 });
+const TriggerFired = z.object({
+    trigger_id: z.string().min(1),
+    source: z.enum(["schedule", "jira", "pr", "review"]),
+    /** Stable dedupe id. Not named `key`: the redactor masks any property with that name. */
+    dedupe: z.string().min(1),
+    external_id: z.string().min(1),
+    revision: z.string().min(1),
+    repo: z.string().min(1).optional(),
+    title: z.string().min(1).optional(),
+    once,
+});
+const TriggerRouted = z.object({
+    trigger_id: z.string().min(1),
+    dedupe: z.string().min(1),
+    action: z.enum(["create", "attach"]),
+    workflow: z.string().min(1).optional(),
+    repo: z.string().min(1).optional(),
+    once,
+});
+const TriggerFailed = z.object({
+    trigger_id: z.string().min(1),
+    error: z.string().min(1),
+    once,
+});
+const TriggerSkipped = z.object({
+    trigger_id: z.string().min(1),
+    reason: z.enum(["paused", "capped"]),
+    once,
+});
 const envelope = {
     id: z.string().min(1),
     ts: z.string().regex(ISO_UTC, "ts must be ISO-8601 UTC"),
@@ -176,6 +209,30 @@ export const EventSchema = z.discriminatedUnion("event", [
         job_id: z.string().min(1).nullable(),
         properties: BudgetBlocked,
     }),
+    z.object({
+        ...envelope,
+        event: z.literal("trigger.fired"),
+        job_id: z.string().min(1).nullable(),
+        properties: TriggerFired,
+    }),
+    z.object({
+        ...envelope,
+        event: z.literal("trigger.routed"),
+        job_id: z.string().min(1).nullable(),
+        properties: TriggerRouted,
+    }),
+    z.object({
+        ...envelope,
+        event: z.literal("trigger.failed"),
+        job_id: z.string().min(1).nullable(),
+        properties: TriggerFailed,
+    }),
+    z.object({
+        ...envelope,
+        event: z.literal("trigger.skipped"),
+        job_id: z.string().min(1).nullable(),
+        properties: TriggerSkipped,
+    }),
 ]);
 const LOCK_WAIT_MS = 5_000;
 const pauseBuf = new Int32Array(new SharedArrayBuffer(4));

package/dist/host.js

@@ -18,6 +18,59 @@ export class HostError extends Error {
 export function defaultHost() {
     return { github: realGitHub, git: realGitRemote, feedback: realPullRequestFeedback };
 }
+/** `kiln tick` and `kiln serve`. Review requests use the operator's gh auth. */
+export function productionHost() {
+    return { ...defaultHost(), reviews: { list: listReviewRequests } };
+}
+/**
+ * Open pull requests awaiting the authenticated user's review, per registered repo.
+ * A remote that is not GitHub is skipped, so a local test origin does not call gh.
+ */
+export function listReviewRequests(repos) {
+    const found = [];
+    for (const repo of repos) {
+        if (!githubRemote(repo.path))
+            continue;
+        const result = spawnSync(ghBin(), ["pr", "list", "--search", "review-requested:@me", "--state", "open", "--limit", "50", "--json", "number,title,url,headRefOid"], {
+            cwd: repo.path,
+            encoding: "utf8",
+            timeout: 20_000,
+            env: { ...process.env, GH_PROMPT_DISABLED: "1", GIT_TERMINAL_PROMPT: "0" },
+        });
+        if (result.error || result.status !== 0) {
+            throw new HostError(`Could not list review requests for ${repo.name}.`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(result.stdout || "[]");
+        }
+        catch {
+            throw new HostError("gh pr list returned data that is not JSON.");
+        }
+        if (!Array.isArray(parsed))
+            throw new HostError("gh pr list returned data that is not a list.");
+        for (const item of parsed) {
+            if (typeof item !== "object" || item === null)
+                continue;
+            const record = item;
+            const number = typeof record.number === "number" ? record.number : Number.NaN;
+            const sha = typeof record.headRefOid === "string" ? record.headRefOid.trim().toLowerCase() : "";
+            if (!Number.isInteger(number) || number <= 0 || !/^[0-9a-f]{7,64}$/.test(sha))
+                continue;
+            const title = typeof record.title === "string" && record.title.trim() ? record.title.trim() : `PR ${number}`;
+            const url = typeof record.url === "string" ? record.url : "";
+            found.push({ repo: repo.name, number, title, url, headSha: sha });
+        }
+    }
+    return found;
+}
+function githubRemote(checkout) {
+    const result = gitResult(checkout, ["remote", "get-url", "origin"]);
+    if (result.status !== 0)
+        return false;
+    const url = result.stdout.trim();
+    return /github\.com[:/]/i.test(url);
+}
 const YAK_BRANCH = /^yak\/[A-Za-z0-9._-]+$/;
 function assertYakBranch(branch, baseBranch) {
     if (branch === baseBranch || branch === `refs/heads/${baseBranch}`) {

package/dist/intake/jira.js

@@ -1,3 +1,4 @@
+import { spawnSync } from "node:child_process";
 import { assertCanStack, listValidJobs, renderAddedJob, writeJob } from "../jobs.js";
 import { ISSUE_KEY } from "../schemas.js";
 import { assertWorkflowName } from "../workflow.js";
@@ -89,6 +90,92 @@ export async function addFromJira(config, input) {
         warnings,
     };
 }
+/**
+ * Search Jira with the operator's token. The token stays in the child
+ * environment and is never written to stdout, a job, or an event.
+ * `POST /rest/api/3/search/jql` is the read. There is no webhook here.
+ */
+export function searchJiraIssues(config, jql, env = process.env) {
+    const query = jql.trim();
+    if (!query || query.length > 2_000)
+        throw new Error("Jira poll JQL is empty or too long.");
+    const credentials = resolveJiraCredentials(config, env);
+    const script = [
+        "const base = process.env.KILN_JIRA_BASE;",
+        "const email = process.env.KILN_JIRA_EMAIL;",
+        "const token = process.env.KILN_JIRA_TOKEN;",
+        "const jql = process.env.KILN_JIRA_JQL;",
+        "if (!base || !email || !token || !jql) { console.error('jira search is missing credentials'); process.exit(2); }",
+        "const auth = Buffer.from(email + ':' + token, 'utf8').toString('base64');",
+        "let url;",
+        "try { url = new URL('/rest/api/3/search/jql', base.endsWith('/') ? base : base + '/'); }",
+        "catch { console.error('jira base url is invalid'); process.exit(2); }",
+        "const response = await fetch(url, {",
+        "  method: 'POST',",
+        "  headers: { Authorization: 'Basic ' + auth, Accept: 'application/json', 'Content-Type': 'application/json' },",
+        "  body: JSON.stringify({ jql, maxResults: 50, fields: ['summary', 'updated', 'description'] }),",
+        "});",
+        "const text = await response.text();",
+        "if (!response.ok) { console.error('jira search failed HTTP ' + response.status); process.exit(1); }",
+        "process.stdout.write(text);",
+    ].join("\n");
+    const result = spawnSync(process.execPath, ["--input-type=module", "-e", script], {
+        encoding: "utf8",
+        timeout: 20_000,
+        env: {
+            PATH: env.PATH,
+            KILN_JIRA_BASE: credentials.baseUrl,
+            KILN_JIRA_EMAIL: credentials.email,
+            KILN_JIRA_TOKEN: credentials.apiToken,
+            KILN_JIRA_JQL: query,
+        },
+    });
+    if (result.error || result.status !== 0) {
+        const detail = (result.stderr || result.error?.message || "jira search failed").trim().split("\n")[0] ?? "jira search failed";
+        throw new Error(redactSecrets(detail, credentials).slice(0, 300));
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(result.stdout || "{}");
+    }
+    catch {
+        throw new Error("Jira search returned data that is not JSON.");
+    }
+    return parseSearchIssues(parsed, credentials);
+}
+function parseSearchIssues(payload, credentials) {
+    const issues = typeof payload === "object" && payload !== null && "issues" in payload ? payload.issues : undefined;
+    if (!Array.isArray(issues))
+        throw new Error("Jira search returned data that is not a list of issues.");
+    const out = [];
+    for (const item of issues) {
+        if (typeof item !== "object" || item === null)
+            continue;
+        const record = item;
+        if (typeof record.key !== "string")
+            continue;
+        let key;
+        try {
+            key = normalizeIssueKey(record.key);
+        }
+        catch {
+            continue;
+        }
+        const fields = typeof record.fields === "object" && record.fields !== null ? record.fields : {};
+        const summary = typeof fields.summary === "string" ? fields.summary.trim().replace(/\s+/g, " ") : "";
+        if (!summary)
+            continue;
+        const updated = typeof fields.updated === "string" && fields.updated.trim() ? fields.updated.trim() : key;
+        const description = adfToMarkdown(fields.description).trim();
+        out.push({
+            key,
+            summary: redactSecrets(summary, credentials),
+            updated: redactSecrets(updated, credentials),
+            ...(description ? { description: redactSecrets(description, credentials) } : {}),
+        });
+    }
+    return out;
+}
 export function normalizeIssueKey(raw) {
     const key = raw.trim().toUpperCase();
     if (!ISSUE_KEY.test(key)) {

package/dist/jobs.js

@@ -5,7 +5,7 @@ import { appendEvent } from "./events.js";
 import { INVESTIGATION_WORKFLOW } from "./findings.js";
 import { jobBasename } from "./paths.js";
 import { JobSchema, parseIssueKey } from "./schemas.js";
-import { assertWorkflowName } from "./workflow.js";
+import { assertWorkflowName, REVIEW_WORKFLOW } from "./workflow.js";
 export function newJobId(now = new Date()) {
     const stamp = now.toISOString().replace(/[-:TZ.]/g, "").slice(0, 14);
     return `j${stamp}${randomBytes(2).toString("hex")}`;
@@ -149,8 +149,9 @@ export function assertCanStack(repo, dependsOn, stack, known = []) {
     }
     const upstreamId = dependsOn[0];
     const upstream = known.find((job) => job.id === upstreamId);
-    if (upstream?.workflow === INVESTIGATION_WORKFLOW) {
-        throw new Error(`stack cannot target investigation job ${upstreamId}. An investigation does not land a branch.`);
+    if (upstream?.workflow === INVESTIGATION_WORKFLOW || upstream?.workflow === REVIEW_WORKFLOW) {
+        const kind = upstream.workflow === INVESTIGATION_WORKFLOW ? "investigation" : "review";
+        throw new Error(`stack cannot target ${kind} job ${upstreamId}. ${kind === "investigation" ? "An investigation" : "A review"} does not land a branch.`);
     }
     if (upstream && upstream.repo !== repo) {
         throw new Error(`stack needs upstream ${upstreamId} to be in repo ${repo}. That job is in repo ${upstream.repo}.`);

package/dist/reconcile.js

@@ -1,4 +1,5 @@
 import { INVESTIGATION_WORKFLOW } from "./findings.js";
+import { REVIEW_WORKFLOW } from "./workflow.js";
 /**
  * Why an attempt failed. Written under `<kilnDir>/attempts`, not on the job.
  * `auth-failed` is not an automatic retry: the job stays in Needs human.
@@ -118,17 +119,20 @@ export function isLanded(job) {
  * `deliver=local`: landed. `deliver=pr`: landed and the pull request has merged.
  * An investigation is done once the gate says approve. There is no pull request.
  */
+function noPullRequest(workflow) {
+    return workflow === INVESTIGATION_WORKFLOW || workflow === REVIEW_WORKFLOW;
+}
 export function isDone(job) {
     if (!isLanded(job))
         return false;
-    if (job.workflow === INVESTIGATION_WORKFLOW)
+    if (noPullRequest(job.workflow))
         return true;
     if ((job.deliver ?? "local") !== "pr")
         return true;
     return job.delivery?.merged === true || job.delivery?.prState === "MERGED";
 }
 function landedState(job) {
-    if (job.workflow === INVESTIGATION_WORKFLOW)
+    if (noPullRequest(job.workflow))
         return "done";
     if ((job.deliver ?? "local") !== "pr")
         return "done";
@@ -146,7 +150,7 @@ function landedState(job) {
 function needsDelivery(job) {
     if (job.error)
         return false;
-    if (job.workflow === INVESTIGATION_WORKFLOW)
+    if (noPullRequest(job.workflow))
         return false;
     if ((job.deliver ?? "local") !== "pr")
         return false;

package/dist/schemas.js

@@ -127,8 +127,45 @@ const maxFixRounds = z
 /**
  * The subset `kiln serve` settings can edit. The file schema below uses these
  * same field validators. Settings does not accept jira, tokens, adapter,
- * workflows, or sandbox image.
+ * workflows, or sandbox image. Trigger edits are enable/disable only.
  */
+const TRIGGER_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+/**
+ * One trigger in `kiln.config.json`. `enabled` defaults to true.
+ * `schedule` uses `cron` (5 fields, local time). `jira` uses `jql` or
+ * `label` / `status` (compiled to JQL) and `every` (default `5m`).
+ * `pr` is the built-in Kiln-owned pull request source.
+ */
+export const TriggerConfigSchema = z
+    .object({
+    id: z.string().regex(TRIGGER_ID, "Trigger id must start with a letter or digit."),
+    enabled: z.boolean().optional(),
+    kind: z.enum(["schedule", "jira", "pr"]),
+    cron: z.string().min(1).optional(),
+    every: z.string().min(1).optional(),
+    repo: z.string().regex(REPO_NAME).optional(),
+    jql: z.string().min(1).optional(),
+    label: z.string().min(1).optional(),
+    status: z.string().min(1).optional(),
+})
+    .strict();
+/** Maps a trigger id to create a job or attach to one. Hot-reloaded with the config. */
+export const RouteConfigSchema = z
+    .object({
+    id: z.string().regex(TRIGGER_ID, "Route id must start with a letter or digit."),
+    trigger: z.string().regex(TRIGGER_ID),
+    action: z.enum(["create", "attach"]),
+    workflow: z.string().min(1).optional(),
+    repo: z.string().regex(REPO_NAME).optional(),
+})
+    .strict();
+/** Settings API body for enable/disable. Other trigger fields stay in the file. */
+export const TriggerToggleSchema = z
+    .object({
+    id: z.string().regex(TRIGGER_ID),
+    enabled: z.boolean(),
+})
+    .strict();
 export const EditableKilnSettingsSchema = z.object({
     repos: KilnReposSchema,
     stallTimeoutMs,
@@ -137,6 +174,7 @@ export const EditableKilnSettingsSchema = z.object({
     maxSameFingerprint,
     dailyDollarCap,
     sandbox: EditableSandboxSchema.optional(),
+    triggers: z.array(TriggerToggleSchema).optional(),
 });
 /** PUT /api/settings body. `revision` is the sha256 of the file the client loaded. */
 export const SettingsWriteSchema = EditableKilnSettingsSchema.extend({
@@ -156,14 +194,24 @@ export const KilnConfigFileSchema = z.object({
     workflows: z.record(z.string().regex(WORKFLOW_KEY), z.object({ sandbox: SandboxSettingsSchema.optional() })).optional(),
     repos: KilnReposSchema,
     jira: JiraConfigSchema.optional(),
+    /** Clock, Jira poll, and pull-request sources. Omitted entries use the built-ins. */
+    triggers: z.array(TriggerConfigSchema).optional(),
+    /** Trigger id → create a job or attach to an existing one. */
+    routes: z.array(RouteConfigSchema).optional(),
+    /**
+     * Reviewer prompt file. Relative paths resolve from the config directory.
+     * Omitted uses the packaged `prompts/kiln/review.md`.
+     */
+    reviewPrompt: z.string().min(1).optional(),
 });
 /**
  * Where a job came from. Adapters set this; tick and reconcile do not branch on it.
  * `ref` is an absolute spec path (`file`), `inline` or `stdin` (`prompt`), the
- * absolute ticket path (`tickets`), or the issue key (`jira`, such as `PROJ-123`).
+ * absolute ticket path (`tickets`), the issue key (`jira`, such as `SAMPLE-1`),
+ * or the trigger dedupe key (`trigger`).
  */
 export const JobSourceSchema = z.object({
-    kind: z.enum(["file", "prompt", "tickets", "jira"]),
+    kind: z.enum(["file", "prompt", "tickets", "jira", "trigger"]),
     ref: z.string().min(1),
 });
 /**