@lchase/kiln 0.11.0 → 0.12.0

package/README.md

@@ -254,6 +254,33 @@ By default, serve runs `kiln tick` once when it starts and then every 30 seconds
 
 The Jira API token is not rendered. Do not commit checkout paths or job files.
 
+## Triggers
+
+A trigger starts work without `kiln add`. `kiln serve` evaluates triggers on each tick. `kiln tick` does the same pass once. Config is the `triggers` and `routes` arrays in `kiln.config.json`, re-read when the file changes.
+
+Two triggers are built in. `review-requests` is a schedule, cron `0 * * * *` (minute 0 of every hour, local time). `pr-activity` reads Kiln-owned pull requests from the same snapshot the fix loop already fetched. It does not poll a second time. Add a Jira trigger per repo when you want one:
+
+```json
+{
+  "triggers": [
+    { "id": "sample-ready", "kind": "jira", "repo": "web", "every": "5m", "label": "sample", "status": "Ready" }
+  ],
+  "routes": [
+    { "id": "sample-ready", "trigger": "sample-ready", "action": "create", "workflow": "feature", "repo": "web" }
+  ]
+}
+```
+
+`every` defaults to `5m` (`30s`, `5m`, `1h`). `label` and `status` compile to JQL. A `jql` string replaces them. `enabled` defaults to true. The Triggers page and `PUT /api/settings` send `{ "triggers": [{ "id", "enabled" }] }` and leave cron, JQL, and repo on the file.
+
+A cron fires once per slot. While serve was down, startup fires the latest missed slot once and does not replay the ones behind it. A Jira poll that was missed does the same: one search, not one per skipped interval. The router writes `trigger.routed` with a `dedupe` property (`review:<repo>:<number>:<head sha>`, `jira:<trigger>:<issue>`, `pr:<job>:<comment>`). A later tick that sees that value does not create another job. Comments and commits from `kiln`, a `[bot]` login, a `kiln:` subject, or a `Kiln-Job` trailer are ignored.
+
+A failed fire stores `last_error` and `lastErrorAt` under `<kiln-home>/triggers/state.json`, appends `trigger.failed`, and waits for the next slot. It does not retry on the next tick. Pause and the daily dollar cap append `trigger.skipped` with reason `paused` or `capped` and do not queue the fire.
+
+`review-requests` lists open pull requests where your `gh` user is the requested reviewer (`gh pr list --search review-requested:@me` in each registered GitHub repo). A pull request already drafted at that head SHA is skipped. The `review` workflow returns findings (severity, file, line, suggested comment) and stops on a gate in the Inbox. Approving the gate does not post, approve, or merge. There is no gated posting path for a review comment yet, so the draft stops there. `reviewPrompt` is a path to your own prompt file. Omitted, Kiln uses `prompts/kiln/review.md`.
+
+Jira search sends `JIRA_API_TOKEN` only as a Basic header in a child process. The token is not written into the job, the spec, or the event log. Polling is the only Jira ingress. A webhook can later call the same issue-to-event function.
+
 ## Tick, status, approve
 
 ```bash

package/assets/serve.css

@@ -257,6 +257,26 @@ body.open .drawer { transform: none; }
 .repo-row .num { font-family: var(--mono); font-size: 13px; }
 .repo-row .d-actions { margin-top: 0; flex: none; }
 #settings-error { white-space: pre-wrap; }
+.trigger {
+  border: 1px solid var(--line);
+  background: var(--card);
+  border-radius: 10px;
+  padding: 14px 16px;
+  margin: 0 0 12px;
+}
+.trigger h3 { margin: 0 0 4px; color: var(--ink); font-size: 15px; letter-spacing: 0; text-transform: none; }
+.trigger .err { margin: 6px 0 0; color: var(--human); font-family: var(--mono); font-size: 12px; line-height: 16px; }
+.trigger button {
+  margin-top: 10px;
+  background: var(--card-hover);
+  border: 1px solid var(--line-strong);
+  border-radius: 6px;
+  padding: 4px 10px;
+  cursor: pointer;
+}
+.trigger .recent { list-style: none; margin: 10px 0 0; padding: 0; }
+.trigger .recent li { margin: 4px 0; font-size: 12px; line-height: 16px; color: var(--muted); }
+.trigger .ev { font-family: var(--mono); color: var(--ink); }
 
 @media (max-width: 960px) {
   .shell { grid-template-columns: 1fr; }

package/assets/serve.js

@@ -911,6 +911,54 @@
       .catch(function () { showSettingsError("Could not load settings."); });
   }
 
+  function toggleTrigger(button) {
+    var id = button.getAttribute("data-trigger-toggle");
+    var enabled = button.getAttribute("data-enabled") !== "true";
+    var error = document.getElementById("trigger-error");
+    if (error) error.hidden = true;
+    button.disabled = true;
+    fetch("/api/settings", { cache: "no-store", headers: { Accept: "application/json" } })
+      .then(function (response) { return response.json().then(function (data) { return { ok: response.ok, data: data }; }); })
+      .then(function (result) {
+        if (!result.ok) throw new Error((result.data && result.data.error) || "Could not load settings.");
+        var data = result.data;
+        var toggles = [];
+        var buttons = document.querySelectorAll("[data-trigger-toggle]");
+        for (var i = 0; i < buttons.length; i++) {
+          var buttonId = buttons[i].getAttribute("data-trigger-toggle");
+          var on = buttons[i].getAttribute("data-enabled") === "true";
+          if (buttonId === id) on = enabled;
+          toggles.push({ id: buttonId, enabled: on });
+        }
+        var body = { revision: data.revision, repos: data.repos || {}, triggers: toggles };
+        ["stallTimeoutMs", "maxAttempts", "maxFixRounds", "maxSameFingerprint", "dailyDollarCap"].forEach(function (key) {
+          if (data[key] !== undefined && data[key] !== null) body[key] = data[key];
+        });
+        if (data.sandbox) body.sandbox = data.sandbox;
+        return fetch("/api/settings", {
+          method: "PUT",
+          headers: {
+            Accept: "application/json",
+            "Content-Type": "application/json",
+            "X-Kiln-CSRF": document.body.getAttribute("data-csrf") || "",
+          },
+          body: JSON.stringify(body),
+        });
+      })
+      .then(function (response) { return response.json().then(function (data) { return { ok: response.ok, data: data }; }); })
+      .then(function (result) {
+        if (!result.ok) throw new Error((result.data && result.data.error) || "Could not save settings.");
+        location.reload();
+      })
+      .catch(function (err) {
+        button.disabled = false;
+        if (error) {
+          error.hidden = false;
+          error.textContent = err && err.message ? err.message : "Could not update the trigger.";
+        }
+      });
+  }
+
   function saveSettings() {
     if (settingsSaving) return;
     if (!flushEditor()) return;
@@ -1011,6 +1059,11 @@
   document.addEventListener("click", function (event) {
     var target = event.target;
     if (!target || !target.closest) return;
+    var triggerToggle = target.closest("[data-trigger-toggle]");
+    if (triggerToggle) {
+      toggleTrigger(triggerToggle);
+      return;
+    }
     var settingsControl = target.closest("#open-settings");
     if (settingsControl) {
       if (settingsControl.tagName !== "A") openSettings();

package/dist/cli.js

@@ -2,6 +2,7 @@
 import { addRepo, renderRepoList, resolveKilnConfig } from "./config.js";
 import { renderSandboxStatus, runSandboxBuild } from "./sandbox.js";
 import { answerJob, retryJob, reviseJob, runStatus, runTick } from "./driver.js";
+import { productionHost } from "./host.js";
 import { pauseFactory, resumeFactory } from "./rails.js";
 import { parseSince, renderLedgerFile } from "./ledger.js";
 import { startServe } from "./serve.js";
@@ -88,6 +89,11 @@ function usage() {
         "that requests changes starts a fix on that same branch, up to maxFixRounds",
         "(default 2). Kiln does not merge, approve, or comment. Past that bound the",
         "job is needs-human with reason feedback-exhausted.",
+        "Triggers in the kiln config start work without kiln add. A cron fires",
+        "on the serve tick in local time, once per slot, and once on startup",
+        "when a slot was missed. Jira polls are per repo. Kiln-owned pull",
+        "request activity uses the same read as the fix loop. A failed fire",
+        "waits for the next slot. Pause and the daily cap skip the fire.",
         "",
         "serve listens on 127.0.0.1. The page is a board of workflow stages:",
         "queued, spec, build, review, approve, land, PR review, Done (landed locally),",
@@ -401,7 +407,7 @@ function tickCommand(argv) {
         usage();
     }
     const config = resolveKilnConfig({ configPath: flags.configPath });
-    process.stdout.write(runTick(config));
+    process.stdout.write(runTick(config, productionHost()));
 }
 function statusCommand(argv) {
     const flags = parseFlags(argv);

package/dist/config.js

@@ -54,6 +54,11 @@ export function loadKilnConfig(configPath, options = {}) {
         sandbox: parsed.data.sandbox ?? {},
         workflowSandbox: workflowSandboxFrom(parsed.data.workflows),
         ...(jira ? { jira } : {}),
+        triggers: parsed.data.triggers ?? [],
+        routes: parsed.data.routes ?? [],
+        ...(parsed.data.reviewPrompt
+            ? { reviewPrompt: resolveConfiguredPath(configDir, parsed.data.reviewPrompt, home) }
+            : {}),
     };
 }
 /**

package/dist/driver.js

@@ -21,7 +21,8 @@ import { projectRunJournal, promptsHash } from "./project.js";
 import { gateAnswerCommand, renderStatus, renderTick, statusView, yakCliPath, sandboxFailureDetail, } from "./report.js";
 import { AGENT_SANDBOX_IMAGE, injectAgentSandbox, jobIsSandboxed, probeSandboxEnvironment, PROXY_SANDBOX_IMAGE, requiredSandboxImages, resolveSandbox, sandboxIsEnabled, sandboxPreflight, sandboxPreflightFor, } from "./sandbox.js";
 import { JobSchema } from "./schemas.js";
-import { leafStepIds, materializeWorkflow, workflowInputs, workflowNeedsTestCommand, workflowStepPlan } from "./workflow.js";
+import { ensureReviewHead, evaluateTriggers, recordOwnedPullRequest, reviewHeadOf, } from "./triggers.js";
+import { leafStepIds, materializeWorkflow, REVIEW_WORKFLOW, workflowInputs, workflowNeedsTestCommand, workflowStepPlan, } from "./workflow.js";
 const TAG_PREFIX = "kiln:";
 export function jobTag(jobId) {
     return `${TAG_PREFIX}${jobId}`;
@@ -53,8 +54,14 @@ export function runTick(config, host = defaultHost(), options = {}) {
         const midway = observe(config, host, now);
         bindOpenFixRuns(config, midway);
         const published = publishReadyFixes(config, host, midway);
+        evaluateTriggers({
+            config,
+            now,
+            startup: options.triggerStartup ?? startup,
+            ...(host.reviews ? { reviews: host.reviews } : {}),
+        });
         const world = observe(config, host, now);
-        const feedbackNotes = watchPullRequests(config, world, host);
+        const feedbackNotes = watchPullRequests(config, world, host, now);
         const actions = decide(world.observation, now);
         if (world.observation.spendBlocked) {
             recordDailyCap(config.kilnDir, spendSnapshot(readEvents(config.kilnDir, { warn: () => { } }), config.dailyDollarCap, now), now);
@@ -749,7 +756,7 @@ function gateEdit(checkout, runId, stepId) {
  * Read each open pull request once per tick and attach a plan.
  * `readStatus` does not call this. A host with no feedback reader does not watch.
  */
-function watchPullRequests(config, world, host) {
+function watchPullRequests(config, world, host, now) {
     const notes = [];
     if (!host.feedback)
         return notes;
@@ -775,11 +782,28 @@ function watchPullRequests(config, world, host) {
             ledger,
             snapshot,
         });
+        recordOwnedPullRequest(config, {
+            jobId: job.jobId,
+            repo: job.repo,
+            prNumber: job.delivery?.prNumber ?? 0,
+            headSha: snapshot.headSha,
+            comments: snapshot.comments.map((comment) => ({
+                id: comment.id,
+                author: comment.author,
+                body: comment.body,
+                resolved: comment.resolved,
+            })),
+            reviews: snapshot.reviews.map((review) => ({
+                id: review.id,
+                author: review.author,
+                body: review.body,
+            })),
+        }, now);
     }
     return notes;
 }
 function shouldWatch(job) {
-    if (job.deliver !== "pr" || job.workflow === INVESTIGATION_WORKFLOW)
+    if (job.deliver !== "pr" || job.workflow === INVESTIGATION_WORKFLOW || job.workflow === REVIEW_WORKFLOW)
         return false;
     if (job.error || job.feedbackLedgerError || job.feedbackExhausted || job.feedbackAmbiguous)
         return false;
@@ -1041,7 +1065,9 @@ function launchJob(config, world, job, host, sandboxFacts) {
     if (workflowNeedsTestCommand(sourceWorkflow) && !testCommand?.trim()) {
         throw new Error(`Repo ${job.repo} has no test command. Set repos.${job.repo}.test. The feature workflow refuses to run an empty KILN_TEST.`);
     }
-    const workflow = materializeWorkflow(config.kilnDir, job.id, job.workflow);
+    const workflow = materializeWorkflow(config.kilnDir, job.id, job.workflow, {
+        ...(config.reviewPrompt ? { reviewPrompt: config.reviewPrompt } : {}),
+    });
     const logPath = join(config.kilnDir, "logs", `${jobBasename(job.id)}.log`);
     mkdirSync(dirname(logPath), { recursive: true });
     ensureCheckoutExcludes(repo.path);
@@ -1053,14 +1079,23 @@ function launchJob(config, world, job, host, sandboxFacts) {
         if (blocked)
             return { jobId: job.id, repo: job.repo, output: blocked };
         assertStackTarget(world, job);
-        baseSha = resolveLaunchBase({
-            checkout: repo.path,
-            deliver: repo.deliver,
-            stack: job.stack === true,
-            ...(repo.base ? { configuredBase: repo.base } : {}),
-            ...(job.stack ? { upstreamBranch: upstreamLocalBranch(world, job) } : {}),
-            git: host.git,
-        });
+        const pinned = reviewHeadOf(job);
+        if (pinned) {
+            const number = Number(job.source?.ref.split(":")[2]);
+            if (Number.isInteger(number) && number > 0)
+                ensureReviewHead(repo.path, number, pinned);
+            baseSha = resolveCommit(host, repo.path, pinned);
+        }
+        else {
+            baseSha = resolveLaunchBase({
+                checkout: repo.path,
+                deliver: repo.deliver,
+                stack: job.stack === true,
+                ...(repo.base ? { configuredBase: repo.base } : {}),
+                ...(job.stack ? { upstreamBranch: upstreamLocalBranch(world, job) } : {}),
+                git: host.git,
+            });
+        }
         specText = specHandedToYak(config, world, job);
     }
     catch (error) {

package/dist/events.js

@@ -9,8 +9,8 @@ import { redactDeep } from "./redact.js";
  * parses it. A write failure is reported and does not escape to the caller.
  *
  * `run_id` and `step` are null when the moment has none. `job_id` is null
- * for `config.reloaded`, `kiln.paused`, `kiln.resumed`, and `budget.blocked`,
- * which are not a job.
+ * for `config.reloaded`, `kiln.paused`, `kiln.resumed`, `budget.blocked`,
+ * and trigger fires that do not belong to a job yet.
  */
 export const EVENT_NAMES = [
     "job.added",
@@ -31,6 +31,10 @@ export const EVENT_NAMES = [
     "kiln.paused",
     "kiln.resumed",
     "budget.blocked",
+    "trigger.fired",
+    "trigger.routed",
+    "trigger.failed",
+    "trigger.skipped",
 ];
 const ISO_UTC = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/;
 const once = z.string().min(1).optional();
@@ -131,6 +135,35 @@ const BudgetBlocked = z.object({
     cap: z.number().nonnegative(),
     once,
 });
+const TriggerFired = z.object({
+    trigger_id: z.string().min(1),
+    source: z.enum(["schedule", "jira", "pr", "review"]),
+    /** Stable dedupe id. Not named `key`: the redactor masks any property with that name. */
+    dedupe: z.string().min(1),
+    external_id: z.string().min(1),
+    revision: z.string().min(1),
+    repo: z.string().min(1).optional(),
+    title: z.string().min(1).optional(),
+    once,
+});
+const TriggerRouted = z.object({
+    trigger_id: z.string().min(1),
+    dedupe: z.string().min(1),
+    action: z.enum(["create", "attach"]),
+    workflow: z.string().min(1).optional(),
+    repo: z.string().min(1).optional(),
+    once,
+});
+const TriggerFailed = z.object({
+    trigger_id: z.string().min(1),
+    error: z.string().min(1),
+    once,
+});
+const TriggerSkipped = z.object({
+    trigger_id: z.string().min(1),
+    reason: z.enum(["paused", "capped"]),
+    once,
+});
 const envelope = {
     id: z.string().min(1),
     ts: z.string().regex(ISO_UTC, "ts must be ISO-8601 UTC"),
@@ -176,6 +209,30 @@ export const EventSchema = z.discriminatedUnion("event", [
         job_id: z.string().min(1).nullable(),
         properties: BudgetBlocked,
     }),
+    z.object({
+        ...envelope,
+        event: z.literal("trigger.fired"),
+        job_id: z.string().min(1).nullable(),
+        properties: TriggerFired,
+    }),
+    z.object({
+        ...envelope,
+        event: z.literal("trigger.routed"),
+        job_id: z.string().min(1).nullable(),
+        properties: TriggerRouted,
+    }),
+    z.object({
+        ...envelope,
+        event: z.literal("trigger.failed"),
+        job_id: z.string().min(1).nullable(),
+        properties: TriggerFailed,
+    }),
+    z.object({
+        ...envelope,
+        event: z.literal("trigger.skipped"),
+        job_id: z.string().min(1).nullable(),
+        properties: TriggerSkipped,
+    }),
 ]);
 const LOCK_WAIT_MS = 5_000;
 const pauseBuf = new Int32Array(new SharedArrayBuffer(4));

package/dist/host.js

@@ -18,6 +18,59 @@ export class HostError extends Error {
 export function defaultHost() {
     return { github: realGitHub, git: realGitRemote, feedback: realPullRequestFeedback };
 }
+/** `kiln tick` and `kiln serve`. Review requests use the operator's gh auth. */
+export function productionHost() {
+    return { ...defaultHost(), reviews: { list: listReviewRequests } };
+}
+/**
+ * Open pull requests awaiting the authenticated user's review, per registered repo.
+ * A remote that is not GitHub is skipped, so a local test origin does not call gh.
+ */
+export function listReviewRequests(repos) {
+    const found = [];
+    for (const repo of repos) {
+        if (!githubRemote(repo.path))
+            continue;
+        const result = spawnSync(ghBin(), ["pr", "list", "--search", "review-requested:@me", "--state", "open", "--limit", "50", "--json", "number,title,url,headRefOid"], {
+            cwd: repo.path,
+            encoding: "utf8",
+            timeout: 20_000,
+            env: { ...process.env, GH_PROMPT_DISABLED: "1", GIT_TERMINAL_PROMPT: "0" },
+        });
+        if (result.error || result.status !== 0) {
+            throw new HostError(`Could not list review requests for ${repo.name}.`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(result.stdout || "[]");
+        }
+        catch {
+            throw new HostError("gh pr list returned data that is not JSON.");
+        }
+        if (!Array.isArray(parsed))
+            throw new HostError("gh pr list returned data that is not a list.");
+        for (const item of parsed) {
+            if (typeof item !== "object" || item === null)
+                continue;
+            const record = item;
+            const number = typeof record.number === "number" ? record.number : Number.NaN;
+            const sha = typeof record.headRefOid === "string" ? record.headRefOid.trim().toLowerCase() : "";
+            if (!Number.isInteger(number) || number <= 0 || !/^[0-9a-f]{7,64}$/.test(sha))
+                continue;
+            const title = typeof record.title === "string" && record.title.trim() ? record.title.trim() : `PR ${number}`;
+            const url = typeof record.url === "string" ? record.url : "";
+            found.push({ repo: repo.name, number, title, url, headSha: sha });
+        }
+    }
+    return found;
+}
+function githubRemote(checkout) {
+    const result = gitResult(checkout, ["remote", "get-url", "origin"]);
+    if (result.status !== 0)
+        return false;
+    const url = result.stdout.trim();
+    return /github\.com[:/]/i.test(url);
+}
 const YAK_BRANCH = /^yak\/[A-Za-z0-9._-]+$/;
 function assertYakBranch(branch, baseBranch) {
     if (branch === baseBranch || branch === `refs/heads/${baseBranch}`) {

package/dist/intake/jira.js

@@ -1,3 +1,4 @@
+import { spawnSync } from "node:child_process";
 import { assertCanStack, listValidJobs, renderAddedJob, writeJob } from "../jobs.js";
 import { ISSUE_KEY } from "../schemas.js";
 import { assertWorkflowName } from "../workflow.js";
@@ -89,6 +90,92 @@ export async function addFromJira(config, input) {
         warnings,
     };
 }
+/**
+ * Search Jira with the operator's token. The token stays in the child
+ * environment and is never written to stdout, a job, or an event.
+ * `POST /rest/api/3/search/jql` is the read. There is no webhook here.
+ */
+export function searchJiraIssues(config, jql, env = process.env) {
+    const query = jql.trim();
+    if (!query || query.length > 2_000)
+        throw new Error("Jira poll JQL is empty or too long.");
+    const credentials = resolveJiraCredentials(config, env);
+    const script = [
+        "const base = process.env.KILN_JIRA_BASE;",
+        "const email = process.env.KILN_JIRA_EMAIL;",
+        "const token = process.env.KILN_JIRA_TOKEN;",
+        "const jql = process.env.KILN_JIRA_JQL;",
+        "if (!base || !email || !token || !jql) { console.error('jira search is missing credentials'); process.exit(2); }",
+        "const auth = Buffer.from(email + ':' + token, 'utf8').toString('base64');",
+        "let url;",
+        "try { url = new URL('/rest/api/3/search/jql', base.endsWith('/') ? base : base + '/'); }",
+        "catch { console.error('jira base url is invalid'); process.exit(2); }",
+        "const response = await fetch(url, {",
+        "  method: 'POST',",
+        "  headers: { Authorization: 'Basic ' + auth, Accept: 'application/json', 'Content-Type': 'application/json' },",
+        "  body: JSON.stringify({ jql, maxResults: 50, fields: ['summary', 'updated', 'description'] }),",
+        "});",
+        "const text = await response.text();",
+        "if (!response.ok) { console.error('jira search failed HTTP ' + response.status); process.exit(1); }",
+        "process.stdout.write(text);",
+    ].join("\n");
+    const result = spawnSync(process.execPath, ["--input-type=module", "-e", script], {
+        encoding: "utf8",
+        timeout: 20_000,
+        env: {
+            PATH: env.PATH,
+            KILN_JIRA_BASE: credentials.baseUrl,
+            KILN_JIRA_EMAIL: credentials.email,
+            KILN_JIRA_TOKEN: credentials.apiToken,
+            KILN_JIRA_JQL: query,
+        },
+    });
+    if (result.error || result.status !== 0) {
+        const detail = (result.stderr || result.error?.message || "jira search failed").trim().split("\n")[0] ?? "jira search failed";
+        throw new Error(redactSecrets(detail, credentials).slice(0, 300));
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(result.stdout || "{}");
+    }
+    catch {
+        throw new Error("Jira search returned data that is not JSON.");
+    }
+    return parseSearchIssues(parsed, credentials);
+}
+function parseSearchIssues(payload, credentials) {
+    const issues = typeof payload === "object" && payload !== null && "issues" in payload ? payload.issues : undefined;
+    if (!Array.isArray(issues))
+        throw new Error("Jira search returned data that is not a list of issues.");
+    const out = [];
+    for (const item of issues) {
+        if (typeof item !== "object" || item === null)
+            continue;
+        const record = item;
+        if (typeof record.key !== "string")
+            continue;
+        let key;
+        try {
+            key = normalizeIssueKey(record.key);
+        }
+        catch {
+            continue;
+        }
+        const fields = typeof record.fields === "object" && record.fields !== null ? record.fields : {};
+        const summary = typeof fields.summary === "string" ? fields.summary.trim().replace(/\s+/g, " ") : "";
+        if (!summary)
+            continue;
+        const updated = typeof fields.updated === "string" && fields.updated.trim() ? fields.updated.trim() : key;
+        const description = adfToMarkdown(fields.description).trim();
+        out.push({
+            key,
+            summary: redactSecrets(summary, credentials),
+            updated: redactSecrets(updated, credentials),
+            ...(description ? { description: redactSecrets(description, credentials) } : {}),
+        });
+    }
+    return out;
+}
 export function normalizeIssueKey(raw) {
     const key = raw.trim().toUpperCase();
     if (!ISSUE_KEY.test(key)) {

package/dist/jobs.js

@@ -5,7 +5,7 @@ import { appendEvent } from "./events.js";
 import { INVESTIGATION_WORKFLOW } from "./findings.js";
 import { jobBasename } from "./paths.js";
 import { JobSchema, parseIssueKey } from "./schemas.js";
-import { assertWorkflowName } from "./workflow.js";
+import { assertWorkflowName, REVIEW_WORKFLOW } from "./workflow.js";
 export function newJobId(now = new Date()) {
     const stamp = now.toISOString().replace(/[-:TZ.]/g, "").slice(0, 14);
     return `j${stamp}${randomBytes(2).toString("hex")}`;
@@ -149,8 +149,9 @@ export function assertCanStack(repo, dependsOn, stack, known = []) {
     }
     const upstreamId = dependsOn[0];
     const upstream = known.find((job) => job.id === upstreamId);
-    if (upstream?.workflow === INVESTIGATION_WORKFLOW) {
-        throw new Error(`stack cannot target investigation job ${upstreamId}. An investigation does not land a branch.`);
+    if (upstream?.workflow === INVESTIGATION_WORKFLOW || upstream?.workflow === REVIEW_WORKFLOW) {
+        const kind = upstream.workflow === INVESTIGATION_WORKFLOW ? "investigation" : "review";
+        throw new Error(`stack cannot target ${kind} job ${upstreamId}. ${kind === "investigation" ? "An investigation" : "A review"} does not land a branch.`);
     }
     if (upstream && upstream.repo !== repo) {
         throw new Error(`stack needs upstream ${upstreamId} to be in repo ${repo}. That job is in repo ${upstream.repo}.`);

package/dist/reconcile.js

@@ -1,4 +1,5 @@
 import { INVESTIGATION_WORKFLOW } from "./findings.js";
+import { REVIEW_WORKFLOW } from "./workflow.js";
 /**
  * Why an attempt failed. Written under `<kilnDir>/attempts`, not on the job.
  * `auth-failed` is not an automatic retry: the job stays in Needs human.
@@ -118,17 +119,20 @@ export function isLanded(job) {
  * `deliver=local`: landed. `deliver=pr`: landed and the pull request has merged.
  * An investigation is done once the gate says approve. There is no pull request.
  */
+function noPullRequest(workflow) {
+    return workflow === INVESTIGATION_WORKFLOW || workflow === REVIEW_WORKFLOW;
+}
 export function isDone(job) {
     if (!isLanded(job))
         return false;
-    if (job.workflow === INVESTIGATION_WORKFLOW)
+    if (noPullRequest(job.workflow))
         return true;
     if ((job.deliver ?? "local") !== "pr")
         return true;
     return job.delivery?.merged === true || job.delivery?.prState === "MERGED";
 }
 function landedState(job) {
-    if (job.workflow === INVESTIGATION_WORKFLOW)
+    if (noPullRequest(job.workflow))
         return "done";
     if ((job.deliver ?? "local") !== "pr")
         return "done";
@@ -146,7 +150,7 @@ function landedState(job) {
 function needsDelivery(job) {
     if (job.error)
         return false;
-    if (job.workflow === INVESTIGATION_WORKFLOW)
+    if (noPullRequest(job.workflow))
         return false;
     if ((job.deliver ?? "local") !== "pr")
         return false;

package/dist/schemas.js

@@ -127,8 +127,45 @@ const maxFixRounds = z
 /**
  * The subset `kiln serve` settings can edit. The file schema below uses these
  * same field validators. Settings does not accept jira, tokens, adapter,
- * workflows, or sandbox image.
+ * workflows, or sandbox image. Trigger edits are enable/disable only.
  */
+const TRIGGER_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+/**
+ * One trigger in `kiln.config.json`. `enabled` defaults to true.
+ * `schedule` uses `cron` (5 fields, local time). `jira` uses `jql` or
+ * `label` / `status` (compiled to JQL) and `every` (default `5m`).
+ * `pr` is the built-in Kiln-owned pull request source.
+ */
+export const TriggerConfigSchema = z
+    .object({
+    id: z.string().regex(TRIGGER_ID, "Trigger id must start with a letter or digit."),
+    enabled: z.boolean().optional(),
+    kind: z.enum(["schedule", "jira", "pr"]),
+    cron: z.string().min(1).optional(),
+    every: z.string().min(1).optional(),
+    repo: z.string().regex(REPO_NAME).optional(),
+    jql: z.string().min(1).optional(),
+    label: z.string().min(1).optional(),
+    status: z.string().min(1).optional(),
+})
+    .strict();
+/** Maps a trigger id to create a job or attach to one. Hot-reloaded with the config. */
+export const RouteConfigSchema = z
+    .object({
+    id: z.string().regex(TRIGGER_ID, "Route id must start with a letter or digit."),
+    trigger: z.string().regex(TRIGGER_ID),
+    action: z.enum(["create", "attach"]),
+    workflow: z.string().min(1).optional(),
+    repo: z.string().regex(REPO_NAME).optional(),
+})
+    .strict();
+/** Settings API body for enable/disable. Other trigger fields stay in the file. */
+export const TriggerToggleSchema = z
+    .object({
+    id: z.string().regex(TRIGGER_ID),
+    enabled: z.boolean(),
+})
+    .strict();
 export const EditableKilnSettingsSchema = z.object({
     repos: KilnReposSchema,
     stallTimeoutMs,
@@ -137,6 +174,7 @@ export const EditableKilnSettingsSchema = z.object({
     maxSameFingerprint,
     dailyDollarCap,
     sandbox: EditableSandboxSchema.optional(),
+    triggers: z.array(TriggerToggleSchema).optional(),
 });
 /** PUT /api/settings body. `revision` is the sha256 of the file the client loaded. */
 export const SettingsWriteSchema = EditableKilnSettingsSchema.extend({
@@ -156,14 +194,24 @@ export const KilnConfigFileSchema = z.object({
     workflows: z.record(z.string().regex(WORKFLOW_KEY), z.object({ sandbox: SandboxSettingsSchema.optional() })).optional(),
     repos: KilnReposSchema,
     jira: JiraConfigSchema.optional(),
+    /** Clock, Jira poll, and pull-request sources. Omitted entries use the built-ins. */
+    triggers: z.array(TriggerConfigSchema).optional(),
+    /** Trigger id → create a job or attach to an existing one. */
+    routes: z.array(RouteConfigSchema).optional(),
+    /**
+     * Reviewer prompt file. Relative paths resolve from the config directory.
+     * Omitted uses the packaged `prompts/kiln/review.md`.
+     */
+    reviewPrompt: z.string().min(1).optional(),
 });
 /**
  * Where a job came from. Adapters set this; tick and reconcile do not branch on it.
  * `ref` is an absolute spec path (`file`), `inline` or `stdin` (`prompt`), the
- * absolute ticket path (`tickets`), or the issue key (`jira`, such as `PROJ-123`).
+ * absolute ticket path (`tickets`), the issue key (`jira`, such as `SAMPLE-1`),
+ * or the trigger dedupe key (`trigger`).
  */
 export const JobSourceSchema = z.object({
-    kind: z.enum(["file", "prompt", "tickets", "jira"]),
+    kind: z.enum(["file", "prompt", "tickets", "jira", "trigger"]),
     ref: z.string().min(1),
 });
 /**