kici-admin: org settings

Guide

org — the org ids this orchestrator holds

kici-admin org list [--json] [--database-url <url>]

Lists every org id this orchestrator holds data for. The commands that take an org id (secret, context, variable, remote-source, org-settings, trust-policy) accept these values. Each row names the data that holds the org id:

• platform — the org the Platform attached this orchestrator to. Only the admin API reports it.
• remote-source — the anchor for kici run remote, created when the orchestrator authenticates with the Platform.
• source, generic-source — webhook sources. On an orchestrator attached to the Platform, a GitHub source added without an org belongs to the attached org. On an independent orchestrator, it belongs to __default__.
• context, secret, org-settings, trust-policy, registration — the data of those commands.

The command reads the orchestrator admin API (GET /api/v1/admin/org-ids). It needs an unscoped admin token with the secret.read permission (owner or admin). --database-url (or KICI_DATABASE_URL) reads the orchestrator database instead. That mode cannot see the Platform connection, so it does not list the platform source, and the table output says so. With --json, the output is { "platformAttachment": "attached" | "pending" | "none", "attachedOrgId": …, "orgs": [{ "orgId": …, "sources": […] }] }. The database mode leaves out the first two fields. pending means that the orchestrator has not authenticated with the Platform yet.

When the orchestrator is attached to the Platform and another org holds a source, the table output adds a note on stderr. The runs of that source use the other org’s contexts, secrets and trust policy. See which org a source belongs to.

kici-admin orchestrator status also shows the Platform org. See cluster and infrastructure.

org-settings — org-level security policy

kici-admin org-settings global-workflows show --org <id> [--format json|table]
kici-admin org-settings global-workflows allow-add <pattern> --org <id> [--source <routingKey>] [--format json|table]
kici-admin org-settings global-workflows allow-remove <pattern> --org <id> [--source <routingKey>] [--format json|table]
kici-admin org-settings global-workflows deny-add <pattern> --org <id> [--source <routingKey>] [--format json|table]
kici-admin org-settings global-workflows deny-remove <pattern> --org <id> [--source <routingKey>] [--format json|table]
kici-admin org-settings allow-http-npm true|false --org <id> [--format json|table]
kici-admin org-settings user-cache show --org <id> [--format json|table]
kici-admin org-settings user-cache set-quota <bytes> --org <id> [--format json|table]
kici-admin org-settings user-cache set-ttl <milliseconds> --org <id> [--format json|table]
kici-admin org-settings dispatch-ack show --org <id> [--format json|table]
kici-admin org-settings dispatch-ack set <milliseconds> --org <id> [--format json|table]
kici-admin org-settings dispatch-ack reset --org <id> [--format json|table]
kici-admin org-settings approval show --org <id> [--format json|table]
kici-admin org-settings approval set-expiry <seconds> --org <id> [--format json|table]
kici-admin org-settings approval set-self-approval true|false --org <id> [--format json|table]

Manages per-org global-workflow policy (workflow-author allow-list and source-repo deny-list). Settings are org-scoped — there is one row per customer_id regardless of how many webhook sources the org has. Each list entry can optionally pin to a specific source via --source <routingKey>. Calls the orchestrator admin API directly (not the Platform dashboard proxy) so it stays operable even when Platform is unavailable.

• --org <id> selects the org row. kici-admin org list prints the org ids.
• --source <routingKey> on *-add stores the entry pinned to that single webhook source. Omit for “any source in the org”.
• --source <routingKey> on *-remove matches a source-qualified entry. Omit to remove the unqualified entry.
• show prints the current settings row for the given org. Its Enabled (cluster-wide) line is informational — it reports the effective fleet-wide master switch (cluster_settings.global_workflows_enabled), which you set with kici-admin cluster-settings, not a per-org value.
• allow-add / allow-remove mutate the workflow-author allow-list.
• deny-add / deny-remove mutate the source-repo deny-list.

Accepted pattern shape

A <pattern> is a plain glob over a repository identifier (owner/name). An identifier is not a file path, so a leading dot carries no special meaning: myorg/* and ** both cover myorg/.github.

Negation forms are refused. Each of these is rejected at write time, on both lists:

• a leading ! — !myorg/x
• extglob negation — !(a|b)/x and myorg/!(secret)
• character-class negation — myorg/[^a]*
• a negative lookahead or lookbehind — (?!myorg/legacy)**, myorg/(?!secret)*, **(?<!secret)
• an empty or whitespace-only pattern

The list you add to already decides the direction: allow-add grants, deny-add blocks. A negated pattern inverts that direction inside one entry. On the allow-list it grants almost every repository; on the deny-list it blocks almost every repository. Either way the entry does the opposite of what it reads as. The assertions are the widest of the four forms. One can spell a whole repository identifier rather than a single character, so (?!myorg/legacy)** on the allow-list reads as “all but legacy” and allows every repository in every organization except that one.

myorg/[!a]* is not a negation and is accepted. The matcher reads [!a] as a literal class holding the two characters ! and a, so the pattern matches only the repositories whose name begins with one of them — a genuine restriction, and the exact inverse of myorg/[^a]*.

A pattern of one of these shapes that is already stored is not applied as a negation. The allow-list grants nothing for it, the deny-list blocks, and the orchestrator logs a warning naming the org and the pattern. Remove such an entry with allow-remove / deny-remove and write the repositories you mean.

allow-http-npm — permit non-https private npm registries

kici-admin org-settings allow-http-npm true --org <id>
kici-admin org-settings allow-http-npm false --org <id>

Toggles org_settings.allow_http_npm_registries. When false (the default), any workflow registries: entry whose URL is http://<non-loopback-host> is rejected at dispatch time. Loopback (localhost / 127.0.0.0/8 / ::1) and *.local hostnames are always allowed regardless of this toggle, so a developer iterating against a local Verdaccio container does not need to flip it.

Flip to true only when the org genuinely needs auth against a non-loopback http:// registry — most commonly an internal mirror reachable only inside a VPN where TLS termination happens at the network boundary. Flipping it widens the trust surface: an attacker on the network path between the agent and the registry can observe (and tamper with) both the install request and the auth header, since http:// carries no integrity protection. Prefer terminating TLS at the registry instead.

The toggle has no effect on the installEnv: channel (Option C) — committed .kici/.npmrc files are not URL-validated at the orchestrator. If you commit an http:// registry line in your .npmrc, that’s between you and npm.

See Private npm registries for the workflow-side configuration.

user-cache — per-org cache quota + entry TTL

kici-admin org-settings user-cache show --org <id> [--format json|table]
kici-admin org-settings user-cache set-quota <bytes> --org <id> [--format json|table]
kici-admin org-settings user-cache set-ttl <milliseconds> --org <id> [--format json|table]
kici-admin org-settings user-cache reset-quota --org <id> [--format json|table]
kici-admin org-settings user-cache reset-ttl --org <id> [--format json|table]

Reads and writes the per-org byte quota and per-entry TTL for the user-facing cache (ctx.cache / the declarative job-step cache:). These map to the NULLABLE columns org_settings.user_cache_quota_bytes and org_settings.user_cache_ttl_ms. When a column is NULL (the default), the orchestrator uses the cluster-wide default from KICI_USER_CACHE_QUOTA_BYTES (5 GiB) / KICI_USER_CACHE_TTL_MS (7 days); a positive-integer override takes precedence at cache-operation time.

• show prints the effective settings — a per-org override or (cluster default) when unset.
• set-quota <bytes> / set-ttl <milliseconds> set a per-org override (must be a positive integer).
• reset-quota / reset-ttl clear the override (write NULL) so the org falls back to the cluster default.

This is the cluster-configurable knob for “this one tenant needs a bigger cache budget / longer retention” without editing the orchestrator unit file or redeploying. See Storage layout: user cache for the eviction + TTL mechanics.

artifacts — per-org artifact quota, TTL, and size caps

kici-admin org-settings artifacts show --org <id> [--format json|table]
kici-admin org-settings artifacts set-quota <bytes> --org <id> [--format json|table]
kici-admin org-settings artifacts set-ttl <milliseconds> --org <id> [--format json|table]
kici-admin org-settings artifacts set-max-bytes <bytes> --org <id> [--format json|table]
kici-admin org-settings artifacts set-max-per-run <count> --org <id> [--format json|table]
kici-admin org-settings artifacts reset-quota --org <id> [--format json|table]
kici-admin org-settings artifacts reset-ttl --org <id> [--format json|table]
kici-admin org-settings artifacts reset-max-bytes --org <id> [--format json|table]
kici-admin org-settings artifacts reset-max-per-run --org <id> [--format json|table]

The four budget knobs for user-facing artifacts (ctx.artifacts.upload / download). Each maps to a NULLABLE org_settings column; NULL means the cluster-wide default applies.

Knob	Column	Cluster default (env var)
quota	artifact_quota_bytes	20 GiB (KICI_ARTIFACT_QUOTA_BYTES)
ttl	artifact_ttl_ms	30 days (KICI_ARTIFACT_TTL_MS)
max-bytes	artifact_max_bytes	1 GiB per artifact (KICI_ARTIFACT_MAX_BYTES)
max-per-run	artifact_max_per_run	50 artifacts (KICI_ARTIFACT_MAX_PER_RUN)

• show prints the effective settings — a per-org override or the cluster default when unset.
• Every set-* value must be a positive integer; reset-* writes NULL so the org falls back to the cluster default.

backup-freshness — per-org backup staleness WARN threshold

kici-admin org-settings backup-freshness show --org <id> [--format json|table]
kici-admin org-settings backup-freshness set --hours <n> --org <id> [--format json|table]
kici-admin org-settings backup-freshness reset --org <id> [--format json|table]

How old the newest backup_runs row may get before the diagnose backup check reports WARN. Maps to org_settings.backup_staleness_warn_hours; NULL means the cluster default from KICI_BACKUP_STALENESS_WARN_HOURS (24 hours) applies.

• set --hours <n> takes an integer of at least 1. Raise it for an org backed up weekly; lower it for one where a missed nightly dump matters within hours.
• reset clears the override.

ingest-concurrency — per-org webhook ingest cap

kici-admin org-settings ingest-concurrency show --org <id> [--format json|table]
kici-admin org-settings ingest-concurrency set <count> --org <id> [--format json|table]
kici-admin org-settings ingest-concurrency reset --org <id> [--format json|table]

The maximum number of concurrent webhook-processing pipelines the admission controller admits for this org before shedding with 429 + Retry-After. Maps to a NULLABLE org_settings column; NULL means the cluster default from KICI_INGEST_ORG_MAX_CONCURRENCY (32) applies.

Lower it to rein in a noisy tenant that is crowding out the rest of the cluster; raise it for a high-fan-in org whose bursts are legitimate. set takes an integer of at least 1.

queue-timeout — per-org dispatch-queue job timeout

kici-admin org-settings queue-timeout show --org <id> [--format json|table]
kici-admin org-settings queue-timeout set <milliseconds> --org <id> [--format json|table]
kici-admin org-settings queue-timeout reset --org <id> [--format json|table]

How long a job may sit queued before it expires. The deadline resolves as job.timeoutMs → this org override → the cluster default from KICI_QUEUE_TIMEOUT_MS (1 hour), so a workflow that sets its own job timeout always wins.

• set <milliseconds> takes an integer of at least 0; set 0 means indefinite (a queued job never expires).
• reset clears the override (writes NULL) so the org falls back to the cluster default.

cache-upload-settle — per-org build cache publish wait

kici-admin org-settings cache-upload-settle show --org <id> [--format json|table]
kici-admin org-settings cache-upload-settle set <milliseconds> --org <id> [--format json|table]
kici-admin org-settings cache-upload-settle reset --org <id> [--format json|table]

How long a build job’s success waits for the orchestrator to publish the cache that the build uploaded. The jobs that wait on the build read the published cache when the build succeeds. Without the wait, they can start before the publish finishes and install their dependencies themselves. The value resolves as this org override → the cluster default from KICI_CACHE_UPLOAD_SETTLE_TIMEOUT_MS (10 seconds).

• set <milliseconds> takes an integer of at least 0. set 0 turns the wait off.
• When the wait times out, the orchestrator logs Cache upload did not publish within the settle timeout and starts the waiting jobs without the cache.
• reset clears the override (writes NULL) so the org falls back to the cluster default.

reroute — per-org cross-peer reroute tunables

kici-admin org-settings reroute show --org <id> [--format json|table]
kici-admin org-settings reroute set --org <id> [--window <ms>] [--ack-timeout <ms>] [--max-hops <n>] [--spawn-max-attempts <n>] [--spawn-retry-backoff <ms>] [--format json|table]
kici-admin org-settings reroute reset --org <id> [--format json|table]

The knobs governing how a coordinator hands a job to a sibling peer that can actually run it, and how often a worker retries the agent spawn for a job it received. Each maps to a NULLABLE org_settings column; NULL means the cluster default applies.

Flag	Column	Cluster default (env var)
--window	reroute_spawn_window_ms	90 s (KICI_REROUTE_SPAWN_WINDOW_MS)
--ack-timeout	reroute_ack_timeout_ms	15 s (KICI_REROUTE_ACK_TIMEOUT_MS)
--max-hops	reroute_max_hops	3 hops (KICI_REROUTE_MAX_HOPS)
--spawn-max-attempts	reroute_spawn_max_attempts	3 attempts (KICI_REROUTE_SPAWN_MAX_ATTEMPTS)
--spawn-retry-backoff	reroute_spawn_retry_backoff_ms	5 s (KICI_REROUTE_SPAWN_RETRY_BACKOFF_MS)

• set requires at least one flag and accepts several at once. --window / --ack-timeout take integer milliseconds of at least 1000; --max-hops takes an integer of at least 1 and exists for loop prevention.
• --spawn-max-attempts takes an integer of at least 1: the number of agent spawns a worker attempts for one rerouted job before it gives the job back to its coordinator. --spawn-retry-backoff takes integer milliseconds of at least 0: the wait after a failed spawn before the next attempt. The coordinator sends both values to the worker with each rerouted job. When the worker’s scaler is deferring after failed launches (see Launch failures), the worker waits for the deferral to end. That wait does not use an attempt.
• reset clears every reroute override the orchestrator reports. Against an orchestrator that does not know the spawn-retry fields, it clears only the others.

See Multi-orchestrator clustering for the reroute protocol itself.

sandbox-allowlist — container-sandbox escape hatches

kici-admin org-settings sandbox-allowlist show --org <id> [--format json|table]
kici-admin org-settings sandbox-allowlist set-capabilities <capabilities> --org <id> [--format json|table]
kici-admin org-settings sandbox-allowlist allow-host-network true|false --org <id> [--format json|table]
kici-admin org-settings sandbox-allowlist reset --org <id> [--format json|table]

Gates the two escape hatches a container job (one with a container: image) can request through the SDK sandbox: field. The default is deny-all — an empty capability list and host networking off — and a non-allow-listed request fails the run at dispatch, naming the offending capability or knob, rather than being silently downgraded.

• set-capabilities <capabilities> replaces the allowed Linux capability list with a comma-separated set (e.g. NET_ADMIN,SYS_PTRACE). Passing an empty value clears the list back to deny-all.
• allow-host-network true|false toggles whether a workflow may request sandbox: { network: 'host' }.
• reset clears both at once — no capabilities, no host networking.

Every entry here widens the isolation boundary for the whole org, so grant the narrowest set that unblocks the workflow. See Execution isolation for what the sandbox otherwise enforces.

scaler-spawn-timeout — per-org scaler spawn deadline

kici-admin org-settings scaler-spawn-timeout show --org <id> [--format json|table]
kici-admin org-settings scaler-spawn-timeout set <milliseconds> --org <id> [--format json|table]
kici-admin org-settings scaler-spawn-timeout reset --org <id> [--format json|table]

The deadline for a single scaler spawn — image pull plus container create plus start. A hung runtime or registry that blows the deadline is aborted, so it can no longer pin its per-backend spawn-semaphore slot and head-of-line block every other queued spawn.

Maps to a NULLABLE org_settings column; NULL means the cluster default from KICI_SCALER_SPAWN_TIMEOUT_MS (300 s) applies. set takes an integer of at least 1000 milliseconds. Raise it for an org pulling very large images over a slow link; lower it to fail over faster when the registry is flaky.

dispatch-ack — per-org dispatch acknowledgment deadline

kici-admin org-settings dispatch-ack show --org <id> [--format json|table]
kici-admin org-settings dispatch-ack set <milliseconds> --org <id> [--format json|table]
kici-admin org-settings dispatch-ack reset --org <id> [--format json|table]

Reads and writes the per-org dispatch-acknowledgment deadline. This is how long the orchestrator waits for the agent to answer a dispatched job before it treats the dispatch as lost. The agent answers with an accept acknowledgment, a refusal, or a running status. On expiry the orchestrator requeues the job and disconnects the unresponsive agent, so a dispatch dropped in an agent’s socket teardown no longer strands the run until a timeout. The agent’s other running jobs get the same handling as when an agent loses its connection.

The value maps to the NULLABLE column org_settings.dispatch_ack_timeout_ms. When NULL (the default), the orchestrator uses the cluster-wide default from KICI_DISPATCH_ACK_TIMEOUT_MS (10 seconds); a per-org override of at least 1000 ms takes precedence at dispatch time.

• show prints the effective deadline — a per-org override or (cluster default) when unset.
• set <milliseconds> sets a per-org override (integer, minimum 1000).
• reset clears the override (writes NULL) so the org falls back to the cluster default.

Raise it for an org whose agents sit behind a high-latency network where the 10-second default is too tight; lower it to reclaim a stuck job faster when agents are local and fast.

approval — held-approval expiry and self-approval policy

kici-admin org-settings approval show --org <id> [--format json|table]
kici-admin org-settings approval set-expiry <seconds> --org <id> [--format json|table]
kici-admin org-settings approval set-self-approval true|false --org <id> [--format json|table]

Controls how held approval elements (workflow / job / step gates) behave for the org. Both settings have non-null defaults, so there is no “reset to cluster default” — a set replaces the current value.

• set-expiry <seconds> writes org_settings.approval_expiry_seconds (integer, minimum 1; default 86400 — one day). A held element that is not fully approved within this window expires and its run/job/step is rejected. A workflow’s own approval timeout overrides this per element.
• set-self-approval true|false writes org_settings.allow_self_approval (default true). When false, the user who triggered a run may not approve its own held elements, enforcing four-eyes review.
• show prints the effective expiry (seconds) and self-approval flag.

dashboard-writes — dashboard write policy matrix

kici-admin org-settings dashboard-writes show --org <id> [--category <name>] [--sensitivity <name>] [--format json|table]
kici-admin org-settings dashboard-writes set --org <id> --op <name>=<permissive|encrypted|disabled> [--op ...] [--category <name>] [--sensitivity <name>] [--enabled true|false] [--format json|table]
kici-admin org-settings dashboard-writes reset --org <id> [--format json|table]

Manages the per-orch dashboard write policy — the matrix of dashboard.* write operations the orchestrator will accept when proxied through Platform. Empty policy = every operation at its default posture: secrets.set encrypted, every other operation permissive.

• show prints the current policy. Filter to one category (Secrets, Variables, Contexts, Bindings, Held runs, DLQ, Attestations, Registrations, Topology, Fleet) or one sensitivity bucket (plaintext, authority, dispatch).
• set flips one or more operations. Pass --op <name>=<permissive|encrypted|disabled> (repeatable) for individual operations, or combine --category / --sensitivity with --enabled <bool> to flip every operation in the matching group at once; --enabled true sets each one to its default posture. secrets.set accepts only encrypted or disabled. The CLI prints the planned change before applying.
• reset returns every operation to its default posture.
• --org <id> selects the org row.

trust-policy — CI trust policy for fork pull requests

kici-admin trust-policy show --org <id> [--format json|table]
kici-admin trust-policy directory --org <id> [--format json|table]
kici-admin trust-policy set --org <id> [--fork-policy ignore|hold|allow] [--approval-expiry <duration>] [--format json|table]
kici-admin trust-policy directory-set --org <id> --user-id <id> --provider-username <name> --provider-user-id <id> --ci-trust none|read|write|admin [--provider <name>] [--format json|table]
kici-admin trust-policy directory-remove --org <id> --user-id <id> [--format json|table]

The org-wide switch deciding what happens to a pull request from a fork. --fork-policy takes one of three values:

• ignore — the orchestrator drops the event. It creates no run and posts no check status, and the contributor sees nothing on the pull request. This is what an org with no stored policy applies. show prints a warning under this value, and the delivery’s event-log row records the reason for each drop.
• hold — the run parks behind a security approval.
• allow — the pull request runs, with reduced privilege.

--approval-expiry sets how long a security hold waits for an approval before it expires. It takes a duration made of hours, minutes, and seconds, in that order and with no spaces: 72h, 30m, 90s, or 1h30m. The window is from 1 second to 1 year. A value outside that range, or one that is not a duration, stops the command with an error.

show prints the window as a duration, for example 72h or 1h30m.

A run uses the trust policy of its source’s org. On an orchestrator attached to the Platform, the dashboard manages the policy of the attached org. A source in another org, such as __default__, uses the policy of that org. When this split exists, the table output of show adds a note on stderr. For the attached org, the note names the orgs whose sources do not use this policy. For the other org, it says that its sources use this policy. --format json output does not change. See which org a source belongs to.

directory prints the stored approval directory — the identity links, member CI trust levels, and teams that /kici approve is resolved against. Use it to tell a stale directory from an absent one when an approval comment is refused.

Registering approvers on an independent orchestrator

Where a Platform is attached it owns the directory: it pushes the whole thing on every membership change, so link provider accounts and set CI trust levels in the dashboard. An independent orchestrator has no Platform and therefore no upstream authority, so the operator registers approvers directly:

kici-admin trust-policy directory-set \
  --org acme \
  --user-id alice \
  --provider-username alice \
  --provider-user-id 4242 \
  --ci-trust write

• --user-id is the KiCI user id the approval is attributed to. It is yours to choose on an independent orchestrator — it appears in the access log and on the security check, and it is the id --ci-trust is recorded against.
• --provider-user-id is the immutable provider-side numeric id (GitHub’s sender.id). It is required, because an approval comment is matched on this alone and never on the username — so renaming a provider account cannot be used to impersonate a registered member. A link with no numeric id could authorize nobody, so the CLI refuses to create one.
• --provider-username is display only.
• --provider defaults to github.
• --ci-trust grants the level: write or admin may release a security hold, read and none may not.

Re-running directory-set for the same --user-id replaces that member’s link rather than adding a second one, so moving someone to a new provider account also retires their old numeric id. directory-remove --user-id <id> revokes a member: every identity link they hold plus their CI trust level. Both verbs leave team memberships untouched.

set, directory-set, and directory-remove work on an independent orchestrator only. Wherever a Platform is attached, the Platform owns the trust policy and the approval directory, and the admin route refuses with 409; the CLI surfaces that message verbatim, so manage both from the dashboard instead. Every verb talks to the orchestrator admin API directly rather than the Platform dashboard proxy, so show and directory keep working when Platform is unavailable. They require the ci_trust.read / ci_trust.admin permissions — owner and admin only, never auditor, which sees trust-policy changes through access_log.read instead.

See CI security for the threat model behind these knobs.

held-run — answer a hold locally

kici-admin held-run lists and answers the runs this orchestrator is holding. It is the release surface for an independent orchestrator, which has no dashboard approval queue to click and cannot be reached by kici approve or the MCP tools — all three go through the Platform.

# What is this run waiting for, and who may answer it?
kici-admin held-run list --org org-1 --run-id run-abc

# Let it run.
kici-admin held-run approve --org org-1 --run-id run-abc

# Or cancel it.
kici-admin held-run reject --org org-1 --run-id run-abc --reason "wrong branch"

list prints one entry per pending hold: its id, the element it holds, its type and queue, when it expires, and the approvers its requirement names. Read the approver line first — a hold naming a specific user or team is only answerable by a token that requirement accepts.

A run can carry more than one hold, and each takes its own decision: a job gated by both a reviewer requirement and a security policy writes two rows. approve and reject take the same four disambiguators kici approve takes, and refuse to guess between two candidates:

Flag	Picks
--job <name>	the hold on that job
--step <index>	a step-scoped hold within --job
--hold-type <type>	reviewer, timer, concurrency, or security
--hold <id>	one hold by its own id, ignoring every other filter

Four properties worth knowing:

• All three verbs refuse with a 409 on a Platform-attached orchestrator. There the Platform authorizes each decision against the acting member’s org RBAC, and an orchestrator admin token carries none of it. The CLI surfaces that refusal verbatim.
• Approving lets the held work run; it does not make its contributor trusted. A released fork pull request resumes with the base branch’s lock file, no install or registry secrets, and an isolated cache write scope.
• By default the decision is attributed to the admin token, not to a person. The token’s subject (service:<token user id>) satisfies no {user} clause and belongs to no {team}. To answer such a hold, pass --as <user-id>: the decision is then attributed to that member, and team clauses resolve against the stored approval directory. The orchestrator accepts only an id you registered with kici-admin trust-policy directory-set and refuses any other id with a 400. The access-log row still names the admin token as the actor and records the member as approvedAsUserId.
• Step-scoped holds are refused. Answering one means notifying the waiting agent, and an independent orchestrator wires no such bridge; flipping the row without it would leave the agent waiting with nothing left to release or expire it.

list needs ci_trust.read; approve and reject need ci_trust.admin — the same permissions trust-policy takes, held by owner and admin only, and by no routing-key-scoped token. Every decision writes a held_run.approve or held_run.reject row to the access log; read them back with kici-admin access-log list --action held_run.approve.

Reference

kici-admin held-run

List and answer the runs this orchestrator is holding (independent orchestrators only — a Platform-attached orchestrator is answered from the dashboard)

Synopsis: kici-admin held-run

kici-admin held-run approve

Approve a held run, letting the held work RUN. It does not make the contributor trusted: an untrusted fork PR still resumes with the base-branch lock file, no install or registry secrets, and an isolated cache write scope

Synopsis: kici-admin held-run approve [options]

Options

Option	Default	Description
--org <id>		Org id
--run-id <id>		Run whose hold to approve
--job <name>		Match a hold by its job name
--step <index>		Match a step-scoped hold by its step index
--hold <id>		Match one hold by its own id (ignores every other filter)
--hold-type <type>		Narrow to holds of one type (reviewer | timer | concurrency | security)
--as <user-id>		Answer as this KiCI user id, so the decision satisfies the hold’s {user} / {team} clauses. Register the id first with kici-admin trust-policy directory-set

kici-admin held-run list

Print the pending holds for a run, with the approvers each one requires

Synopsis: kici-admin held-run list [options]

Options

Option	Default	Description
--org <id>		Org id
--run-id <id>		Run whose holds to list
--format <format>	table	Output format: json|table

kici-admin held-run reject

Reject a held run, cancelling the element it was holding

Synopsis: kici-admin held-run reject [options]

Options

Option	Default	Description
--org <id>		Org id
--run-id <id>		Run whose hold to reject
--reason <text>		Why the hold is being rejected
--job <name>		Match a hold by its job name
--step <index>		Match a step-scoped hold by its step index
--hold <id>		Match one hold by its own id (ignores every other filter)
--hold-type <type>		Narrow to holds of one type (reviewer | timer | concurrency | security)
--as <user-id>		Answer as this KiCI user id, so the decision satisfies the hold’s {user} / {team} clauses. Register the id first with kici-admin trust-policy directory-set

kici-admin org

Inspect the org ids this orchestrator holds data for

Synopsis: kici-admin org

kici-admin org list

List every org id this orchestrator holds data for, and the data that names it (the Platform connection, sources, contexts, secrets, org settings, trust policy, registrations)

Synopsis: kici-admin org list [options]

Options

Option	Default	Description
--database-url <url>		Use direct DB access instead of HTTP (offline mode)
--json		Emit JSON output

kici-admin org-settings

Manage org-level security settings

Synopsis: kici-admin org-settings

kici-admin org-settings allow-http-npm

Permit plain http:// npm registry URLs in workflow registries:. Default false; loopback / *.local are always allowed regardless.

Synopsis: kici-admin org-settings allow-http-npm <value> [options]

Arguments

Argument	Required	Variadic	Description
value	yes	no

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings allow-untrusted-dockerfile-builds

Permit an untrusted ref (fork PR) to build a job’s container image from a Dockerfile. Default false. The build is NOT sandboxed — it runs arbitrary RUN commands on the agent host’s container daemon.

Synopsis: kici-admin org-settings allow-untrusted-dockerfile-builds <value> [options]

Arguments

Argument	Required	Variadic	Description
value	yes	no

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings approval

Manage the per-org held-approval expiry + self-approval policy

Synopsis: kici-admin org-settings approval

kici-admin org-settings approval set-expiry

Set the per-org held-approval expiry (integer seconds, >= 1)

Synopsis: kici-admin org-settings approval set-expiry <seconds> [options]

Arguments

Argument	Required	Variadic	Description
seconds	yes	no

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings approval set-self-approval

Allow or forbid a run triggerer approving its own held elements (true|false)

Synopsis: kici-admin org-settings approval set-self-approval <value> [options]

Arguments

Argument	Required	Variadic	Description
value	yes	no

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings approval show

Print the current per-org approval policy

Synopsis: kici-admin org-settings approval show [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings artifacts

Manage per-org artifact quota / TTL / size cap / per-run cap (null = cluster default)

Synopsis: kici-admin org-settings artifacts

kici-admin org-settings artifacts reset-max-bytes

Clear the per-org artifact max-bytes override (fall back to the cluster default)

Synopsis: kici-admin org-settings artifacts reset-max-bytes [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings artifacts reset-max-per-run

Clear the per-org artifact max-per-run override (fall back to the cluster default)

Synopsis: kici-admin org-settings artifacts reset-max-per-run [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings artifacts reset-quota

Clear the per-org artifact quota override (fall back to the cluster default)

Synopsis: kici-admin org-settings artifacts reset-quota [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings artifacts reset-ttl

Clear the per-org artifact ttl override (fall back to the cluster default)

Synopsis: kici-admin org-settings artifacts reset-ttl [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings artifacts set-max-bytes

Set the per-org artifact max-bytes (positive integer bytes)

Synopsis: kici-admin org-settings artifacts set-max-bytes <value> [options]

Arguments

Argument	Required	Variadic	Description
value	yes	no

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings artifacts set-max-per-run

Set the per-org artifact max-per-run (positive integer artifacts)

Synopsis: kici-admin org-settings artifacts set-max-per-run <value> [options]

Arguments

Argument	Required	Variadic	Description
value	yes	no

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings artifacts set-quota

Set the per-org artifact quota (positive integer bytes)

Synopsis: kici-admin org-settings artifacts set-quota <value> [options]

Arguments

Argument	Required	Variadic	Description
value	yes	no

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings artifacts set-ttl

Set the per-org artifact ttl (positive integer milliseconds)

Synopsis: kici-admin org-settings artifacts set-ttl <value> [options]

Arguments

Argument	Required	Variadic	Description
value	yes	no

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings artifacts show

Print the current per-org artifact quota + TTL settings

Synopsis: kici-admin org-settings artifacts show [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings backup-freshness

Manage the per-org DB-backup freshness WARN threshold (null = cluster default)

Synopsis: kici-admin org-settings backup-freshness

kici-admin org-settings backup-freshness reset

Clear the per-org override (fall back to the cluster default)

Synopsis: kici-admin org-settings backup-freshness reset [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings backup-freshness set

Set the per-org backup-freshness WARN threshold in hours (>= 1)

Synopsis: kici-admin org-settings backup-freshness set [options]

Options

Option	Default	Description
--hours <n>		Threshold in hours (integer >= 1)
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings backup-freshness show

Print the current per-org backup-freshness threshold

Synopsis: kici-admin org-settings backup-freshness show [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings cache-upload-settle

Manage how long a build success waits for its cache upload to publish (null = cluster default)

Synopsis: kici-admin org-settings cache-upload-settle

kici-admin org-settings cache-upload-settle reset

Clear the per-org cache upload settle override (fall back to the cluster default)

Synopsis: kici-admin org-settings cache-upload-settle reset [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings cache-upload-settle set

Set the per-org cache upload settle timeout in milliseconds (0 = no wait)

Synopsis: kici-admin org-settings cache-upload-settle set <ms> [options]

Arguments

Argument	Required	Variadic	Description
ms	yes	no	Settle timeout in milliseconds (integer >= 0)

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings cache-upload-settle show

Print the current per-org cache upload settle timeout

Synopsis: kici-admin org-settings cache-upload-settle show [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings dashboard-writes

Manage per-orch dashboard write policy (which Platform-routed dashboard.* writes the orch accepts)

Synopsis: kici-admin org-settings dashboard-writes

kici-admin org-settings dashboard-writes reset

Reset every operation to its default posture.

Synopsis: kici-admin org-settings dashboard-writes reset [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings dashboard-writes set

Set one or more operations. Use —op =<permissive|encrypted|disabled> per operation. “encrypted” is valid only for secrets.set and variables.set; secrets.set does not accept “permissive”. Sugar: —category or —sensitivity + —enabled expands to the matching operations; —enabled true sets each one to its default posture.

Synopsis: kici-admin org-settings dashboard-writes set [options]

Options

Option	Default	Description
--org <id>		Org id
--op <op=state>		Single operation posture; repeatable (e.g. —op secrets.set=encrypted —op variables.set=disabled)
--category <name>		Apply —enabled to every operation in this category
--sensitivity <name>		Apply —enabled to every operation in this sensitivity bucket
--enabled <bool>		Pair with —category or —sensitivity to flip the whole group
--format <format>	table	Output format: json|table

kici-admin org-settings dashboard-writes show

Print the current dashboard-write policy.

Synopsis: kici-admin org-settings dashboard-writes show [options]

Options

Option	Default	Description
--org <id>		Org id
--category <name>		Filter to one category (Secrets|Variables|Environments|Bindings|“Held runs”|DLQ|Registrations|Topology)
--sensitivity <name>		Filter to one sensitivity bucket (plaintext|authority|dispatch)
--format <format>	table	Output format: json|table

kici-admin org-settings dispatch-ack

Manage the per-org dispatch-acknowledgment deadline (null = cluster default)

Synopsis: kici-admin org-settings dispatch-ack

kici-admin org-settings dispatch-ack reset

Clear the per-org dispatch-ack deadline override (fall back to the cluster default)

Synopsis: kici-admin org-settings dispatch-ack reset [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings dispatch-ack set

Set the per-org dispatch-acknowledgment deadline (integer milliseconds, >= 1000)

Synopsis: kici-admin org-settings dispatch-ack set <value> [options]

Arguments

Argument	Required	Variadic	Description
value	yes	no

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings dispatch-ack show

Print the current per-org dispatch-acknowledgment deadline

Synopsis: kici-admin org-settings dispatch-ack show [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings global-workflows

Manage per-org global workflow policy

Synopsis: kici-admin org-settings global-workflows

kici-admin org-settings global-workflows allow-add

Add a glob pattern to the workflow-author allow-list. Use —source to qualify the entry to one webhook source.

Synopsis: kici-admin org-settings global-workflows allow-add <pattern> [options]

Arguments

Argument	Required	Variadic	Description
pattern	yes	no

Options

Option	Default	Description
--org <id>		Org id
--source <routingKey>		Pin the entry to one webhook source (e.g. github:42). Omit for any source.
--format <format>	table	Output format: json|table

kici-admin org-settings global-workflows allow-remove

Remove a glob pattern from the workflow-author allow-list. Use —source to target a source-qualified entry.

Synopsis: kici-admin org-settings global-workflows allow-remove <pattern> [options]

Arguments

Argument	Required	Variadic	Description
pattern	yes	no

Options

Option	Default	Description
--org <id>		Org id
--source <routingKey>		Match an entry pinned to this routing key. Omit to match an unqualified entry.
--format <format>	table	Output format: json|table

kici-admin org-settings global-workflows deny-add

Add a glob pattern to the source-repo deny-list. Use —source to qualify the entry to one webhook source.

Synopsis: kici-admin org-settings global-workflows deny-add <pattern> [options]

Arguments

Argument	Required	Variadic	Description
pattern	yes	no

Options

Option	Default	Description
--org <id>		Org id
--source <routingKey>		Pin the entry to one webhook source (e.g. github:42). Omit for any source.
--format <format>	table	Output format: json|table

kici-admin org-settings global-workflows deny-remove

Remove a glob pattern from the source-repo deny-list. Use —source to target a source-qualified entry.

Synopsis: kici-admin org-settings global-workflows deny-remove <pattern> [options]

Arguments

Argument	Required	Variadic	Description
pattern	yes	no

Options

Option	Default	Description
--org <id>		Org id
--source <routingKey>		Match an entry pinned to this routing key. Omit to match an unqualified entry.
--format <format>	table	Output format: json|table

kici-admin org-settings global-workflows show

Print current global workflow settings for an org

Synopsis: kici-admin org-settings global-workflows show [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings ingest-concurrency

Manage the per-org webhook-ingest concurrency cap (null = cluster default)

Synopsis: kici-admin org-settings ingest-concurrency

kici-admin org-settings ingest-concurrency reset

Clear the per-org webhook-ingest concurrency override (fall back to the cluster default)

Synopsis: kici-admin org-settings ingest-concurrency reset [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings ingest-concurrency set

Set the per-org webhook-ingest concurrency cap (integer, >= 1)

Synopsis: kici-admin org-settings ingest-concurrency set <value> [options]

Arguments

Argument	Required	Variadic	Description
value	yes	no

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings ingest-concurrency show

Print the current per-org webhook-ingest concurrency cap

Synopsis: kici-admin org-settings ingest-concurrency show [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings queue-timeout

Manage the per-org dispatch-queue job timeout (null = cluster default)

Synopsis: kici-admin org-settings queue-timeout

kici-admin org-settings queue-timeout reset

Clear the per-org queue-timeout override (fall back to the cluster default)

Synopsis: kici-admin org-settings queue-timeout reset [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings queue-timeout set

Set the per-org queue timeout in milliseconds (0 = indefinite)

Synopsis: kici-admin org-settings queue-timeout set <ms> [options]

Arguments

Argument	Required	Variadic	Description
ms	yes	no	Queue timeout in milliseconds (integer >= 0)

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings queue-timeout show

Print the current per-org queue timeout

Synopsis: kici-admin org-settings queue-timeout show [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings reroute

Manage the per-org cross-peer reroute tunables (null = cluster default)

Synopsis: kici-admin org-settings reroute

kici-admin org-settings reroute reset

Clear every per-org reroute override (fall back to the cluster defaults)

Synopsis: kici-admin org-settings reroute reset [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings reroute set

Set one or more reroute tunables. At least one of —window / —ack-timeout / —max-hops / —spawn-max-attempts / —spawn-retry-backoff.

Synopsis: kici-admin org-settings reroute set [options]

Options

Option	Default	Description
--org <id>		Org id
--window <ms>		Spawn window (integer milliseconds, >= 1000)
--ack-timeout <ms>		Reroute ACK timeout (integer milliseconds, >= 1000)
--max-hops <n>		Maximum peer hops (integer >= 1)
--spawn-max-attempts <n>		Spawn attempts a worker makes for one rerouted job (integer >= 1)
--spawn-retry-backoff <ms>		Wait after a failed spawn before the next attempt (integer milliseconds, >= 0)
--format <format>	table	Output format: json|table

kici-admin org-settings reroute show

Print the current per-org reroute tunables

Synopsis: kici-admin org-settings reroute show [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings sandbox-allowlist

Manage the per-org container-sandbox escape-hatch allow-list (empty = deny all)

Synopsis: kici-admin org-settings sandbox-allowlist

kici-admin org-settings sandbox-allowlist allow-host-network

Allow (true) or deny (false) workflow-requested host networking

Synopsis: kici-admin org-settings sandbox-allowlist allow-host-network <value> [options]

Arguments

Argument	Required	Variadic	Description
value	yes	no

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings sandbox-allowlist reset

Clear the allow-list (deny all capabilities and host networking)

Synopsis: kici-admin org-settings sandbox-allowlist reset [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings sandbox-allowlist set-capabilities

Set the allowed capabilities (comma-separated, e.g. NET_ADMIN,SYS_PTRACE; empty clears)

Synopsis: kici-admin org-settings sandbox-allowlist set-capabilities <capabilities> [options]

Arguments

Argument	Required	Variadic	Description
capabilities	yes	no

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings sandbox-allowlist show

Print the current per-org sandbox capability + host-network allow-list

Synopsis: kici-admin org-settings sandbox-allowlist show [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings scaler-spawn-timeout

Manage the per-org scaler spawn deadline (null = cluster default)

Synopsis: kici-admin org-settings scaler-spawn-timeout

kici-admin org-settings scaler-spawn-timeout reset

Clear the per-org scaler spawn deadline override (fall back to the cluster default)

Synopsis: kici-admin org-settings scaler-spawn-timeout reset [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings scaler-spawn-timeout set

Set the per-org scaler spawn deadline (integer milliseconds, >= 1000)

Synopsis: kici-admin org-settings scaler-spawn-timeout set <value> [options]

Arguments

Argument	Required	Variadic	Description
value	yes	no

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings scaler-spawn-timeout show

Print the current per-org scaler spawn deadline

Synopsis: kici-admin org-settings scaler-spawn-timeout show [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings user-cache

Manage per-org user-facing cache quota + entry TTL (null = cluster default)

Synopsis: kici-admin org-settings user-cache

kici-admin org-settings user-cache reset-quota

Clear the per-org user-cache quota override (fall back to the cluster default)

Synopsis: kici-admin org-settings user-cache reset-quota [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings user-cache reset-ttl

Clear the per-org user-cache ttl override (fall back to the cluster default)

Synopsis: kici-admin org-settings user-cache reset-ttl [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings user-cache set-quota

Set the per-org user-cache quota (positive integer bytes)

Synopsis: kici-admin org-settings user-cache set-quota <value> [options]

Arguments

Argument	Required	Variadic	Description
value	yes	no

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings user-cache set-ttl

Set the per-org user-cache ttl (positive integer milliseconds)

Synopsis: kici-admin org-settings user-cache set-ttl <value> [options]

Arguments

Argument	Required	Variadic	Description
value	yes	no

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin org-settings user-cache show

Print the current per-org user-cache quota + TTL settings

Synopsis: kici-admin org-settings user-cache show [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin trust-policy

Show or set the org trust policy the orchestrator enforces, and read the cached approval directory it arrives with

Synopsis: kici-admin trust-policy

kici-admin trust-policy directory

Print the stored approval directory — identity links, member CI trust levels, and teams

Synopsis: kici-admin trust-policy directory [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table

kici-admin trust-policy directory-remove

Revoke a member: remove every identity link they hold and their CI trust level (independent orchestrators only)

Synopsis: kici-admin trust-policy directory-remove [options]

Options

Option	Default	Description
--org <id>		Org id
--user-id <id>		KiCI user id to revoke
--format <format>	table	Output format: json|table

kici-admin trust-policy directory-set

Register a member as an approver: link their provider account to a KiCI user id and set their CI trust level (independent orchestrators only — a Platform-attached orchestrator is managed from the dashboard)

Synopsis: kici-admin trust-policy directory-set [options]

Options

Option	Default	Description
--org <id>		Org id
--user-id <id>		KiCI user id the approval is attributed to
--provider-username <name>		Provider-side username (display only)
--provider-user-id <id>		Immutable provider-side numeric id (GitHub’s sender.id). Required: an approval comment is matched on this alone, never on the username
--ci-trust <level>		CI trust level to grant (none | read | write | admin); write or admin may approve
--provider <name>	github	Provider the link is for
--format <format>	table	Output format: json|table

kici-admin trust-policy set

Set the trust policy (independent orchestrators only — a Platform-attached orchestrator is managed from the dashboard). At least one flag required.

Synopsis: kici-admin trust-policy set [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table
--fork-policy <value>		Fork PR policy (ignore | hold | allow)
--approval-expiry <duration>		Security-hold approval expiry, e.g. 72h, 30m or 1h30m

kici-admin trust-policy show

Print the trust policy currently enforced for an org

Synopsis: kici-admin trust-policy show [options]

Options

Option	Default	Description
--org <id>		Org id
--format <format>	table	Output format: json|table