@oisincoveney/pipeline 1.15.3 → 1.16.1

package/dist/config.d.ts

@@ -9,6 +9,7 @@ declare const NODE_KINDS: readonly ["agent", "command", "builtin", "group", "par
 declare const HOOK_EVENTS: readonly ["workflow.start", "workflow.success", "workflow.failure", "workflow.complete", "node.start", "node.success", "node.error", "node.finish", "gate.failure"];
 declare const GATE_KINDS: readonly ["acceptance", "artifact", "builtin", "changed_files", "command", "json_schema", "verdict"];
 declare const SCHEDULE_BASELINES: readonly ["epic", "pipe"];
+declare const SCHEDULING_ROLES: readonly ["coverage", "implementation"];
 type PipelineConfigErrorCode = "PIPELINE_CONFIG_LEGACY_UNSUPPORTED" | "PIPELINE_CONFIG_MISSING" | "PIPELINE_CONFIG_PARSE_ERROR" | "PIPELINE_CONFIG_VALIDATION_ERROR";
 interface PipelineConfigIssue {
   message: string;
@@ -291,6 +292,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     rules: z.ZodOptional<z.ZodArray<z.ZodString>>;
     runner: z.ZodString;
+    scheduling_roles: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+      coverage: "coverage";
+      implementation: "implementation";
+    }>>>;
     skills: z.ZodOptional<z.ZodArray<z.ZodString>>;
     tools: z.ZodOptional<z.ZodArray<z.ZodEnum<{
       read: "read";
@@ -379,6 +384,7 @@ type WorkflowNodeKind = (typeof NODE_KINDS)[number];
 type HookEvent = (typeof HOOK_EVENTS)[number];
 type GateKind = (typeof GATE_KINDS)[number];
 type ScheduleBaseline = (typeof SCHEDULE_BASELINES)[number];
+type SchedulingRole = (typeof SCHEDULING_ROLES)[number];
 interface PipelineConfigParts {
   pipeline: string;
   profiles: string;
@@ -393,4 +399,4 @@ declare function parsePipelineConfigYaml(source: string, sourcePath?: string, pr
 declare function parsePipelineConfigParts(sources: PipelineConfigParts, projectRoot?: string, sourcePaths?: PipelineConfigParts, options?: PipelineConfigValidationOptions): PipelineConfig;
 declare function validatePipelineConfig(rawConfig: PipelineConfig, projectRoot?: string, options?: PipelineConfigValidationOptions): PipelineConfig;
 //#endregion
-export { GateKind, HookEvent, PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, PipelineConfig, PipelineConfigError, PipelineConfigErrorCode, PipelineConfigIssue, PipelineConfigParts, PipelineConfigValidationOptions, RUNNERS_CONFIG_PATH, RunnerType, ScheduleBaseline, WorkflowNodeKind, loadPipelineConfig, parsePipelineConfigParts, parsePipelineConfigYaml, tryLoadPipelineConfig, validatePipelineConfig, workflowSchema };
+export { GateKind, HookEvent, PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, PipelineConfig, PipelineConfigError, PipelineConfigErrorCode, PipelineConfigIssue, PipelineConfigParts, PipelineConfigValidationOptions, RUNNERS_CONFIG_PATH, RunnerType, ScheduleBaseline, SchedulingRole, WorkflowNodeKind, loadPipelineConfig, parsePipelineConfigParts, parsePipelineConfigYaml, tryLoadPipelineConfig, validatePipelineConfig, workflowSchema };

package/dist/config.js

@@ -55,6 +55,7 @@ const RETRY_REASONS = [
 	"timeout"
 ];
 const SCHEDULE_BASELINES = ["epic", "pipe"];
+const SCHEDULING_ROLES = ["coverage", "implementation"];
 const PIPELINE_GATEWAY_SERVER_ID = "pipeline-gateway";
 var PipelineConfigError = class extends Error {
 	code;
@@ -227,6 +228,7 @@ const profileSchema = z.object({
 	output: outputSchema.optional(),
 	rules: z.array(z.string()).optional(),
 	runner: z.string(),
+	scheduling_roles: z.array(z.enum(SCHEDULING_ROLES)).optional(),
 	skills: z.array(z.string()).optional(),
 	tools: z.array(z.enum(TOOL_NAMES)).optional()
 }).strict();

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { PipelineConfigError, loadPipelineConfig, tryLoadPipelineConfig } from "./config.js";
-import { configureGatewayHosts, localGatewayStatus, renderGatewayConfig, runGatewayDoctor, startLocalGateway } from "./mcp/gateway.js";
 import { compileWorkflowPlan } from "./workflow-planner.js";
 import { formatInstallCommandsResult, installCommands, parseCommandHost } from "./install-commands.js";
+import { configureGatewayHosts, localGatewayStatus, renderGatewayConfig, runGatewayDoctor, startLocalGateway } from "./mcp/gateway.js";
 import { createOrchestratorLaunchPlan, createRunnerLaunchPlan } from "./runner.js";
 import { formatConfigError, runPipelineFromConfig } from "./pipeline-runtime.js";
 import { runKubernetesRunnerJob } from "./kubernetes-runner.js";

package/dist/install-commands.js

@@ -1,6 +1,5 @@
 import { resolveFileReference } from "./path-refs.js";
 import { loadPipelineConfig } from "./config.js";
-import { codexNativeMcpConfig } from "./mcp/native-config.js";
 import { compileWorkflowPlan } from "./workflow-planner.js";
 import { existsSync, readFileSync } from "node:fs";
 import { basename, dirname, join, relative } from "node:path";
@@ -407,7 +406,6 @@ function codexTomlAgentDefinition(config, cwd, id, profile) {
 	};
 	const skillConfig = codexSkillConfig(config, cwd, profile);
 	const agentConfig = {
-		name: id,
 		description: profile.description ?? id,
 		...profileWithResolvedModel.model ? { model: profileWithResolvedModel.model } : {},
 		...profile.filesystem?.mode ? { sandbox_mode: profile.filesystem.mode } : {},
@@ -424,7 +422,6 @@ function codexTomlAgentDefinition(config, cwd, id, profile) {
 			"",
 			codexAgentInstructions(cwd, profile)
 		].join("\n"),
-		...codexNativeMcpConfig(config, profile),
 		skills: { config: skillConfig }
 	};
 	const mcpConfig = "mcp_servers" in agentConfig ? agentConfig : {

package/dist/mcp/gateway.js

@@ -5,7 +5,7 @@ import { execa } from "execa";
 //#region src/mcp/gateway.ts
 const PIPELINE_GATEWAY_SERVER_ID = "pipeline-gateway";
 const DEFAULT_LOCAL_GATEWAY_URL = "http://127.0.0.1:4483/mcp";
-const LEGACY_CODEX_MCP_RE = /\[mcp_servers\.(?!pipeline-gateway\])/;
+const LEGACY_CODEX_MCP_RE = /\[mcp_servers\./;
 const LEGACY_OPENCODE_MCP_RE = /"mcp"\s*:\s*{(?!\s*"pipeline-gateway")/s;
 const LEGACY_PIPELINE_MCP_RE = /path:\s*\.mcp\.json|uvx\s+mcpm|mcpm\s+run/;
 var PipelineMcpGatewayError = class extends Error {
@@ -53,9 +53,11 @@ function renderGatewayConfig(config) {
 function renderCodexGatewayConfig(config) {
 	const gateway = configuredGateway(config);
 	return [
-		"[mcp_servers.pipeline-gateway]",
-		`url = ${JSON.stringify(gatewayUrl(gateway))}`,
-		`bearer_token_env_var = ${JSON.stringify(gateway.token_env)}`,
+		"# Generated by @oisincoveney/pipeline.",
+		"# Codex pipeline runs receive MCP gateway config through runtime launch args.",
+		"# Persistent Codex MCP config is intentionally left empty to avoid startup-time MCP fan-out.",
+		`# gateway_url = ${JSON.stringify(gatewayUrl(gateway))}`,
+		`# token_env = ${JSON.stringify(gateway.token_env)}`,
 		""
 	].join("\n");
 }

package/dist/mcp/launch-plan.js

@@ -94,4 +94,4 @@ function tomlKey(key) {
 	return TOML_BARE_KEY_PATTERN.test(key) ? key : JSON.stringify(key);
 }
 //#endregion
-export { buildMcpLaunchPlan, isRemoteMcpServer, tomlValue };
+export { buildMcpLaunchPlan, tomlValue };

package/dist/pipeline-init.js

@@ -462,6 +462,7 @@ profiles:
         max_attempts: 1
   pipeline-code-writer:
     runner: codex
+    scheduling_roles: [implementation]
     description: Implement production code until the failing tests pass.
     instructions:
       path: .pipeline/prompts/code-writer.md
@@ -479,6 +480,7 @@ profiles:
       format: text
   pipeline-acceptance-reviewer:
     runner: codex
+    scheduling_roles: [coverage]
     description: Audit the finished change against every acceptance criterion.
     instructions:
       path: .pipeline/prompts/acceptance-reviewer.md
@@ -500,6 +502,7 @@ profiles:
         max_attempts: 1
   pipeline-thermo-nuclear-reviewer:
     runner: codex
+    scheduling_roles: [coverage]
     description: Perform the final thermo-nuclear code quality review of the integration branch.
     instructions:
       path: .agents/skills/critique/SKILL.md
@@ -520,6 +523,7 @@ profiles:
         max_attempts: 1
   pipeline-verifier:
     runner: codex
+    scheduling_roles: [coverage]
     description: Verify checks, implementation fit, and final evidence.
     instructions:
       path: .pipeline/prompts/verifier.md
@@ -720,7 +724,7 @@ const SCAFFOLD_FILES = {
 		"",
 		"Generate exactly one workflow named `root`. Do not embed `default`, `epic-drain`, `infra`, `track`, or other configured workflow copies. Use explicit generated agent, builtin, command, parallel, or group nodes. Do not use `kind: workflow`.",
 		"",
-		"Use the provided backlog work units as the source of truth when present. Assign each work unit to explicit generated agent nodes with only its `task_context.id`, use only allowed configured profiles, and ensure implementation work has downstream acceptance, verification, or review coverage. Do not invent profiles or node-level skill overrides.",
+		"Use the provided backlog work units as the source of truth when present. Assign each work unit to explicit generated agent nodes with only its `task_context.id`, use only allowed configured profiles, and ensure profiles with the `implementation` scheduling role have downstream profiles with the `coverage` scheduling role. Do not invent profiles or node-level skill overrides.",
 		"Do not copy backlog descriptions or acceptance criteria into output; the scheduler hydrates them from the assigned `task_context.id` after parsing.",
 		"Preserve Backlog dependency ids as schedule needs edges. A node assigned a dependent work unit must depend on the nodes assigned its prerequisite work units, directly or through an explicit path.",
 		"",

package/dist/schedule-planner.js

@@ -376,7 +376,7 @@ function plannerPrompt(entrypointId, task, baseline, config, planningContext) {
 		"Every agent node must declare one configured profile id. Do not invent profile ids or node-level skill overrides.",
 		"Assign each backlog work unit to explicit generated agent nodes with task_context.id. The scheduler hydrates title, description, and acceptance_criteria after parsing.",
 		"Do not copy backlog descriptions or acceptance criteria into task_context output.",
-		"Implementation work must have downstream acceptance, verification, or review coverage in the generated DAG.",
+		"Profiles with the implementation scheduling role must have downstream profiles with the coverage scheduling role in the generated DAG.",
 		"Preserve Backlog dependency ids as schedule needs edges. A node assigned a dependent work unit must depend on the nodes assigned its prerequisite work units, directly or through an explicit path.",
 		"Shape the graph by intent, not by ticket count. Do not create a full RED/GREEN/ACCEPTANCE/VERIFY chain for each backlog ticket unless each step needs ticket-specific evidence.",
 		"Only add needs edges for real dependencies, shared constraints, or verification/review fan-in.",
@@ -385,7 +385,7 @@ function plannerPrompt(entrypointId, task, baseline, config, planningContext) {
 		"Only serialize ticket nodes when the backlog, a shared migration/schema/API dependency, or implementation risk requires it.",
 		"",
 		"Allowed profiles:",
-		...Object.keys(config.profiles).sort().map((id) => `- ${id}`),
+		...Object.keys(config.profiles).sort().map((id) => allowedProfilePromptLine(config, id)),
 		"",
 		"Gate recipes:",
 		"- Prefer preserving valid gates from the baseline workflows instead of recreating them.",
@@ -403,6 +403,13 @@ function plannerPrompt(entrypointId, task, baseline, config, planningContext) {
 		stringify(baseline)
 	].join("\n");
 }
+function allowedProfilePromptLine(config, id) {
+	const roles = effectiveSchedulingRoles(config, id);
+	return roles.length > 0 ? `- ${id} (scheduling_roles: ${roles.join(", ")})` : `- ${id}`;
+}
+function effectiveSchedulingRoles(config, profileId) {
+	return [...new Set(config.profiles[profileId]?.scheduling_roles ?? [])].sort();
+}
 function canonicalizeGeneratedScheduleIds(artifact) {
 	return {
 		...artifact,
@@ -451,9 +458,9 @@ function validateScheduleArtifact(config, artifact, planningContext) {
 		...workflowReferenceNodeIssues(artifact),
 		...workflowAssignedWorkUnitIssues(artifact, planningContext.workUnits),
 		...missingAssignedWorkUnitIssues(artifact, planningContext.workUnits),
-		...workUnitDependencyIssues(artifact, planningContext.workUnits),
+		...workUnitDependencyIssues(config, artifact, planningContext.workUnits),
 		...invalidWorkflowPrimitiveIssues(config, artifact),
-		...implementationCoverageIssues(artifact)
+		...implementationCoverageIssues(config, artifact)
 	];
 	if (issues.length > 0) throw new ScheduleArtifactError(["Invalid generated schedule:", ...issues.map((issue) => `- ${issue}`)].join("\n"));
 }
@@ -514,7 +521,7 @@ function missingAssignedWorkUnitIssues(artifact, workUnits) {
 	const missing = workUnits.map((unit) => unit.id).filter((id) => !assigned.has(id));
 	return missing.length > 0 ? [`missing assigned backlog work units: ${missing.join(", ")}`] : [];
 }
-function workUnitDependencyIssues(artifact, workUnits) {
+function workUnitDependencyIssues(config, artifact, workUnits) {
 	if (workUnits.length === 0) return [];
 	const workUnitIds = new Set(workUnits.map((unit) => unit.id));
 	const dependenciesByUnit = new Map(workUnits.map((unit) => [unit.id, (unit.dependencies ?? []).filter((id) => workUnitIds.has(id))]));
@@ -522,7 +529,7 @@ function workUnitDependencyIssues(artifact, workUnits) {
 		const nodes = workflow.nodes.flatMap(flattenWorkflowNode);
 		const dependentsByNeed = workflowDependentsByNeed(nodes);
 		const nodesByWorkUnit = nodesByAssignedWorkUnit(nodes);
-		return nodes.filter(isImplementationNode).flatMap((node) => {
+		return nodes.filter((node) => isImplementationNode(config, node)).flatMap((node) => {
 			const dependentId = node.task_context?.id;
 			if (!dependentId) return [];
 			return (dependenciesByUnit.get(dependentId) ?? []).flatMap((prerequisiteId) => {
@@ -564,14 +571,15 @@ function invalidWorkflowPrimitiveIssues(config, artifact) {
 		return [];
 	});
 }
-function implementationCoverageIssues(artifact) {
+function implementationCoverageIssues(config, artifact) {
 	return Object.entries(artifact.workflows).flatMap(([workflowId, workflow]) => {
-		const dependentsByNeed = workflowDependentsByNeed(workflow.nodes);
-		return workflow.nodes.filter(isImplementationNode).filter((node) => !hasDownstreamCoverage(node.id, dependentsByNeed)).map((node) => `implementation node '${workflowId}.${node.id}' is without downstream verification or review`);
+		const nodes = workflow.nodes.flatMap(flattenWorkflowNode);
+		const dependentsByNeed = workflowDependentsByNeed(nodes);
+		return nodes.filter((node) => isImplementationNode(config, node)).filter((node) => !hasDownstreamCoverage(config, node.id, dependentsByNeed)).map((node) => `implementation node '${workflowId}.${node.id}' is without downstream verification or review`);
 	});
 }
-function isImplementationNode(node) {
-	return node.kind === "agent" && node.profile === "pipeline-code-writer";
+function isImplementationNode(config, node) {
+	return hasSchedulingRole(config, node, "implementation");
 }
 function workflowDependentsByNeed(nodes) {
 	const dependentsByNeed = /* @__PURE__ */ new Map();
@@ -582,25 +590,24 @@ function workflowDependentsByNeed(nodes) {
 	}
 	return dependentsByNeed;
 }
-function hasDownstreamCoverage(nodeId, dependentsByNeed) {
+function hasDownstreamCoverage(config, nodeId, dependentsByNeed) {
 	const queue = [...dependentsByNeed.get(nodeId) ?? []];
 	const seen = /* @__PURE__ */ new Set();
 	while (queue.length > 0) {
 		const node = queue.shift();
 		if (!node || seen.has(node.id)) continue;
 		seen.add(node.id);
-		if (isCoverageNode(node)) return true;
+		if (isCoverageNode(config, node)) return true;
 		queue.push(...dependentsByNeed.get(node.id) ?? []);
 	}
 	return false;
 }
-function isCoverageNode(node) {
+function isCoverageNode(config, node) {
+	return hasSchedulingRole(config, node, "coverage");
+}
+function hasSchedulingRole(config, node, role) {
 	if (node.kind !== "agent") return false;
-	return [
-		"pipeline-acceptance-reviewer",
-		"pipeline-thermo-nuclear-reviewer",
-		"pipeline-verifier"
-	].includes(node.profile);
+	return config.profiles[node.profile]?.scheduling_roles?.includes(role) ?? false;
 }
 function allWorkflowNodes(workflows) {
 	return Object.values(workflows).flatMap((workflow) => workflow.nodes.flatMap(flattenWorkflowNode));

package/docs/mcp-gateway.md

@@ -86,4 +86,6 @@ Use an off-the-shelf aggregator when possible:
 Use `pipe mcp gateway doctor` to check required environment variables, gateway
 health, local ToolHive availability for local mode, and legacy direct MCP
 entries. Use `pipe mcp gateway configure-host` to rewrite project or global
-Codex/OpenCode host config to gateway-only with a backup.
+host config with a backup. For Codex, this removes persistent MCP entries and
+leaves gateway metadata as comments because the runtime injects the gateway
+with `--config` only for pipeline-launched agents.

package/docs/operator-guide.md

@@ -412,12 +412,17 @@ pipe mcp gateway local-status
 pipe mcp gateway local-start
 ```
 
-`configure-host` rewrites Codex/OpenCode config to the gateway-only shape:
+`configure-host` removes persistent Codex MCP config and records the gateway
+metadata as comments. Codex pipeline runs receive the gateway through runtime
+launch arguments so ordinary Codex sessions do not start pipeline MCP clients at
+startup:
 
 ```toml
-[mcp_servers.pipeline-gateway]
-url = "https://gateway.example/mcp"
-bearer_token_env_var = "PIPELINE_MCP_GATEWAY_TOKEN"
+# Generated by @oisincoveney/pipeline.
+# Codex pipeline runs receive MCP gateway config through runtime launch args.
+# Persistent Codex MCP config is intentionally left empty to avoid startup-time MCP fan-out.
+# gateway_url = "https://gateway.example/mcp"
+# token_env = "PIPELINE_MCP_GATEWAY_TOKEN"
 ```
 
 OpenCode receives:

package/package.json

@@ -99,7 +99,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "1.15.3",
+  "version": "1.16.1",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/dist/mcp/native-config.js

@@ -1,21 +0,0 @@
-import { gatewayServerForProfile } from "./gateway.js";
-import { isRemoteMcpServer } from "./launch-plan.js";
-//#region src/mcp/native-config.ts
-function codexNativeMcpConfig(config, profile) {
-	const mcpServers = Object.fromEntries(Object.entries(gatewayServerForProfile(config, profile)).map(([id, server]) => [id, codexNativeMcpServerConfig(server)]));
-	return Object.keys(mcpServers).length > 0 ? { mcp_servers: mcpServers } : {};
-}
-function codexNativeMcpServerConfig(server) {
-	if (isRemoteMcpServer(server)) return {
-		...server.bearer_token_env_var ? { bearer_token_env_var: server.bearer_token_env_var } : {},
-		...server.headers ? { http_headers: server.headers } : {},
-		url: server.url
-	};
-	return {
-		...server.args ? { args: server.args } : {},
-		command: server.command,
-		...server.env ? { env: server.env } : {}
-	};
-}
-//#endregion
-export { codexNativeMcpConfig };