@oisincoveney/pipeline 1.16.2 → 1.18.0

package/README.md

@@ -39,17 +39,16 @@ MCP is the Momokaya remote endpoint
 
 The default GitHub MCP registration uses GitHub's official container in
 read-only mode and reads `GITHUB_PERSONAL_ACCESS_TOKEN` from the environment.
-The Momokaya Qdrant endpoint is protected by Traefik HTTP Basic auth. Set
-`MEMORY_MCP_BASIC_AUTH` to the base64 `user:password` payload before running
-`pipe init` if you want init to register that remote server with MCPM:
+The Momokaya gateway endpoint is protected by Traefik HTTP Basic auth. Set
+`PIPELINE_MCP_GATEWAY_AUTHORIZATION` to the full HTTP `Authorization` header
+value before starting Codex or OpenCode:
 
 ```shell
-export MEMORY_MCP_BASIC_AUTH="$(printf '%s' 'user:password' | base64)"
+export PIPELINE_MCP_GATEWAY_AUTHORIZATION="Basic $(printf '%s' 'user:password' | base64)"
 ```
 
-When `MEMORY_MCP_BASIC_AUTH` is not set, `pipe init` still writes the default
-scaffold and keeps the generated `qdrant` MCP entry, but skips immediate MCPM
-registration for that private endpoint.
+`pipe init` writes project-level Codex and OpenCode config that points at the
+singleton `pipeline-gateway` MCP server.
 
 Check local prerequisites and config health:
 

package/dist/commands/pipeline-command.js

@@ -0,0 +1,28 @@
+//#region src/commands/pipeline-command.ts
+const BUILTIN_PIPE_COMMANDS = new Set([
+	"run",
+	"pipe",
+	"validate",
+	"explain-plan",
+	"doctor",
+	"init",
+	"install-commands",
+	"mcp",
+	"runner-job"
+]);
+function registerConfiguredEntrypointCommands(program, config, runEntrypoint) {
+	const registered = /* @__PURE__ */ new Set();
+	if (!config) return registered;
+	const reservedCommands = new Set(program.commands.map((command) => command.name()));
+	for (const [id, entrypoint] of Object.entries(config.entrypoints)) {
+		if (reservedCommands.has(id)) continue;
+		program.command(id).description(entrypoint.description ?? `Run the ${id} workflow`).argument("<description...>", "task description").action(async (descriptionParts) => {
+			await runEntrypoint(id, descriptionParts.join(" "));
+		});
+		registered.add(id);
+		reservedCommands.add(id);
+	}
+	return registered;
+}
+//#endregion
+export { BUILTIN_PIPE_COMMANDS, registerConfiguredEntrypointCommands };

package/dist/commands/runner-job-command.js

@@ -0,0 +1,10 @@
+import { runRunnerJob } from "../runner-job/run.js";
+//#region src/commands/runner-job-command.ts
+function registerRunnerJobCommand(program) {
+	program.command("runner-job").description("Run an in-pod pipeline runner job from the console payload").action(async () => {
+		const exitCode = await runRunnerJob();
+		process.exitCode = exitCode;
+	});
+}
+//#endregion
+export { registerRunnerJobCommand };

package/dist/config.d.ts

@@ -239,7 +239,7 @@ declare const configSchema: z.ZodObject<{
       local: "local";
     }>;
     provider: z.ZodLiteral<"toolhive">;
-    token_env: z.ZodDefault<z.ZodString>;
+    authorization_env: z.ZodDefault<z.ZodString>;
     url: z.ZodOptional<z.ZodString>;
     url_env: z.ZodDefault<z.ZodString>;
   }, z.core.$strict>>;
@@ -309,6 +309,20 @@ declare const configSchema: z.ZodObject<{
       task: "task";
     }>>>;
   }, z.core.$strict>>>;
+  runner_job: z.ZodDefault<z.ZodObject<{
+    environment: z.ZodDefault<z.ZodObject<{
+      setup: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        command: z.ZodString;
+        required: z.ZodDefault<z.ZodBoolean>;
+      }, z.core.$strict>>>;
+      smoke: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        command: z.ZodString;
+        required: z.ZodDefault<z.ZodBoolean>;
+      }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+  }, z.core.$strict>>;
   rules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     path: z.ZodString;
   }, z.core.$strict>>>;

package/dist/config.js

@@ -132,7 +132,7 @@ const mcpGatewaySchema = z.object({
 	default_profile: z.string().min(1).optional(),
 	mode: z.enum(["hosted", "local"]),
 	provider: z.literal("toolhive"),
-	token_env: z.string().min(1).default("MEMORY_MCP_BASIC_AUTH"),
+	authorization_env: z.string().min(1).default("PIPELINE_MCP_GATEWAY_AUTHORIZATION"),
 	url: z.string().url().refine((value) => ["http:", "https:"].includes(new URL(value).protocol), { message: "MCP gateway url must use http or https" }).optional(),
 	url_env: z.string().min(1).default("PIPELINE_MCP_GATEWAY_URL")
 }).strict();
@@ -361,6 +361,19 @@ const workflowSchema = z.object({
 	execution: workflowExecutionSchema.optional(),
 	nodes: z.array(workflowNodeSchema)
 }).strict();
+const runnerJobCommandSchema = z.object({
+	args: z.array(z.string()).default([]),
+	command: z.string().min(1),
+	required: z.boolean().default(true)
+}).strict();
+const runnerJobEnvironmentSchema = z.object({
+	setup: z.array(runnerJobCommandSchema).default([]),
+	smoke: z.array(runnerJobCommandSchema).default([])
+}).strict();
+const runnerJobConfigSchema = z.object({ environment: runnerJobEnvironmentSchema.default({
+	setup: [],
+	smoke: []
+}) }).strict();
 const runnersFileSchema = z.object({
 	runners: strictRecord(runnerSchema).default({}),
 	version: z.literal(1)
@@ -381,6 +394,10 @@ const pipelineFileSchema = z.object({
 		on: {}
 	}),
 	orchestrator: orchestratorSchema,
+	runner_job: runnerJobConfigSchema.default({ environment: {
+		setup: [],
+		smoke: []
+	} }),
 	schedules: strictRecord(schedulePolicySchema).default({}),
 	task_context: taskContextResolverSchema.optional(),
 	workflows: strictRecord(workflowSchema).default({}),
@@ -397,6 +414,10 @@ const configSchema = z.object({
 	mcp_servers: strictRecord(mcpServerSchema).default({}),
 	orchestrator: orchestratorSchema,
 	profiles: strictRecord(profileSchema).default({}),
+	runner_job: runnerJobConfigSchema.default({ environment: {
+		setup: [],
+		smoke: []
+	} }),
 	rules: strictRecord(pathRefSchema).default({}),
 	runners: strictRecord(runnerSchema).default({}),
 	schedules: strictRecord(schedulePolicySchema).default({}),
@@ -519,6 +540,7 @@ function parsePipelineConfigParts(sources, projectRoot, sourcePaths = {
 		mcp_servers: profiles.mcp_servers,
 		orchestrator: pipeline.orchestrator,
 		profiles: profiles.profiles,
+		runner_job: pipeline.runner_job,
 		rules: profiles.rules,
 		runners: runners.runners,
 		schedules: pipeline.schedules,

package/dist/index.js

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 import { PipelineConfigError, loadPipelineConfig, tryLoadPipelineConfig } from "./config.js";
-import { compileWorkflowPlan } from "./workflow-planner.js";
-import { formatInstallCommandsResult, installCommands, parseCommandHost } from "./install-commands.js";
+import { BUILTIN_PIPE_COMMANDS, registerConfiguredEntrypointCommands } from "./commands/pipeline-command.js";
 import { configureGatewayHosts, localGatewayStatus, renderGatewayConfig, runGatewayDoctor, startLocalGateway } from "./mcp/gateway.js";
 import { createOrchestratorLaunchPlan, createRunnerLaunchPlan } from "./runner.js";
+import { compileWorkflowPlan } from "./workflow-planner.js";
 import { formatConfigError, runPipelineFromConfig } from "./pipeline-runtime.js";
-import { runKubernetesRunnerJob } from "./kubernetes-runner.js";
-import { formatPipelineInitResult, initPipelineProject } from "./pipeline-init.js";
 import { compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact } from "./schedule-planner.js";
+import { registerRunnerJobCommand } from "./commands/runner-job-command.js";
+import { formatInstallCommandsResult, installCommands, parseCommandHost } from "./install-commands.js";
+import { formatPipelineInitResult, initPipelineProject } from "./pipeline-init.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -190,17 +191,6 @@ function truncateMiddle(text, maxLength) {
 	const keep = Math.floor((maxLength - 32) / 2);
 	return `${text.slice(0, keep)}\n... truncated ...\n${text.slice(-keep)}`;
 }
-const BUILTIN_PIPE_COMMANDS = new Set([
-	"run",
-	"pipe",
-	"validate",
-	"explain-plan",
-	"doctor",
-	"init",
-	"install-commands",
-	"mcp",
-	"runner-job"
-]);
 function createCliProgram() {
 	const configuredPipeline = tryLoadConfiguredEntrypoints(process.env.PIPELINE_TARGET_PATH ?? process.cwd());
 	const program = new Command();
@@ -284,11 +274,8 @@ function createCliProgram() {
 		});
 		console.log(formatInstallCommandsResult(result));
 	});
-	program.command("runner-job").description("Run an in-pod pipeline runner job from the console payload").action(async () => {
-		const exitCode = await runKubernetesRunnerJob();
-		process.exitCode = exitCode;
-	});
-	const configuredEntrypointCommands = registerConfiguredEntrypointCommands(program, configuredPipeline);
+	registerRunnerJobCommand(program);
+	const configuredEntrypointCommands = registerConfiguredEntrypointCommands(program, configuredPipeline, (entrypoint, task) => pipe(task, { entrypoint }));
 	if (configuredEntrypointCommands.size > 0) program.configureHelp({ subcommandTerm(command) {
 		if (configuredEntrypointCommands.has(command.name())) return command.name();
 		return Help.prototype.subcommandTerm.call(this, command);
@@ -303,20 +290,6 @@ function tryLoadConfiguredEntrypoints(cwd) {
 		throw err;
 	}
 }
-function registerConfiguredEntrypointCommands(program, config) {
-	const registered = /* @__PURE__ */ new Set();
-	if (!config) return registered;
-	const reservedCommands = new Set(program.commands.map((command) => command.name()));
-	for (const [id, entrypoint] of Object.entries(config.entrypoints)) {
-		if (reservedCommands.has(id)) continue;
-		program.command(id).description(entrypoint.description ?? `Run the ${id} workflow`).argument("<description...>", "task description").action(async (descriptionParts) => {
-			await pipe(descriptionParts.join(" "), { entrypoint: id });
-		});
-		registered.add(id);
-		reservedCommands.add(id);
-	}
-	return registered;
-}
 function parseGatewayHostScope(value) {
 	if (value === "project" || value === "global") return value;
 	throw new Error("scope must be project or global");
@@ -527,7 +500,6 @@ function formatWorkflowPlanNode(node, config, worktreePath) {
 		`kind=${node.kind}`,
 		`needs=${node.needs.join(",") || "none"}`,
 		launch ? `runner=${launch.runnerId}` : "",
-		launch ? `strategy=${launch.strategy}` : "",
 		node.gates?.length ? `gates=${node.gates.length}` : "gates=0",
 		node.artifacts?.length ? `artifacts=${node.artifacts.map((artifact) => artifact.path).join(",")}` : "artifacts=none"
 	].filter(Boolean).join(" ");
@@ -542,14 +514,12 @@ function resolveWorkflowSelection(config, workflowId, entrypointId) {
 }
 function formatOrchestratorPlan(config, worktreePath) {
 	const orchestrator = config.profiles[config.orchestrator.profile];
-	const launch = createOrchestratorLaunchPlan(config, {
-		nodeId: "orchestrator",
-		prompt: "<task>",
-		worktreePath
-	});
 	return [
-		`Orchestrator: runner=${launch.runnerId}`,
-		`strategy=${launch.strategy}`,
+		`Orchestrator: runner=${createOrchestratorLaunchPlan(config, {
+			nodeId: "orchestrator",
+			prompt: "<task>",
+			worktreePath
+		}).runnerId}`,
 		orchestrator.model ? `model=${orchestrator.model}` : "",
 		formatList("rules", orchestrator.rules),
 		formatList("skills", orchestrator.skills),

package/dist/install-commands.js

@@ -1,5 +1,6 @@
 import { resolveFileReference } from "./path-refs.js";
 import { loadPipelineConfig } from "./config.js";
+import { renderCodexGatewayConfig } from "./mcp/gateway.js";
 import { compileWorkflowPlan } from "./workflow-planner.js";
 import { existsSync, readFileSync } from "node:fs";
 import { basename, dirname, join, relative } from "node:path";
@@ -173,6 +174,8 @@ function entrypointDispatchBlock(host, config, id, entrypoint) {
 		`Generate a schedule for entrypoint \`${id}\` and the user task.`,
 		`The schedule policy is \`${entrypoint.schedule}\`.`,
 		`Run \`pipe run --entrypoint ${id} <task description>\` to generate and execute the schedule artifact.`,
+		"The pipeline CLI runtime is the deterministic graph scheduler for scheduled entrypoints.",
+		"It launches configured Codex/OpenCode agent subprocesses as soon as their dependencies pass.",
 		"Use `pipe run --schedule <schedule.yaml>` only when rerunning an existing schedule artifact."
 	].join("\n");
 }
@@ -358,7 +361,7 @@ function codexDefinitions(config, cwd) {
 		})),
 		projectAgentsMdDefinition(cwd, "codex"),
 		...nativeCodexProfiles.map(([id, profile]) => codexTomlAgentDefinition(config, cwd, id, profile)),
-		codexProjectConfigAgentDefinition()
+		codexProjectConfigAgentDefinition(config)
 	];
 }
 function projectAgentsMdDefinition(cwd, host) {
@@ -406,6 +409,7 @@ function codexTomlAgentDefinition(config, cwd, id, profile) {
 	};
 	const skillConfig = codexSkillConfig(config, cwd, profile);
 	const agentConfig = {
+		name: id,
 		description: profile.description ?? id,
 		...profileWithResolvedModel.model ? { model: profileWithResolvedModel.model } : {},
 		...profile.filesystem?.mode ? { sandbox_mode: profile.filesystem.mode } : {},
@@ -424,16 +428,12 @@ function codexTomlAgentDefinition(config, cwd, id, profile) {
 		].join("\n"),
 		skills: { config: skillConfig }
 	};
-	const mcpConfig = "mcp_servers" in agentConfig ? agentConfig : {
-		...agentConfig,
-		mcp_servers: {}
-	};
 	return {
 		content: [
 			"# Generated by @oisincoveney/pipeline.",
 			`${OWNER_YAML_MARKER_PREFIX}host=codex`,
 			"",
-			stringify(mcpConfig).trimEnd(),
+			stringify(agentConfig).trimEnd(),
 			""
 		].join("\n"),
 		host: "codex",
@@ -470,13 +470,14 @@ function codexSkillConfig(config, cwd, profile) {
 		}];
 	});
 }
-function codexProjectConfigAgentDefinition() {
+function codexProjectConfigAgentDefinition(config) {
 	return {
 		block: {
 			end: CODEX_AGENT_CONFIG_END,
 			start: CODEX_AGENT_CONFIG_START
 		},
 		content: [
+			...config.mcp_gateway ? [renderCodexGatewayConfig(config).trimEnd(), ""] : [],
 			CODEX_AGENT_CONFIG_START,
 			stringify({ agents: { max_depth: 1 } }).trimEnd(),
 			CODEX_AGENT_CONFIG_END,

package/dist/mcp/gateway.js

@@ -5,8 +5,7 @@ import { execa } from "execa";
 //#region src/mcp/gateway.ts
 const PIPELINE_GATEWAY_SERVER_ID = "pipeline-gateway";
 const DEFAULT_LOCAL_GATEWAY_URL = "http://127.0.0.1:4483/mcp";
-const AUTHORIZATION_ENV_RE = /\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g;
-const LEGACY_CODEX_MCP_RE = /\[mcp_servers\./;
+const LEGACY_CODEX_MCP_RE = /^\s*\[mcp_servers\.(?!pipeline-gateway(?:\]|\.env_http_headers\]))/m;
 const LEGACY_OPENCODE_MCP_RE = /"mcp"\s*:\s*{(?!\s*"pipeline-gateway")/s;
 const LEGACY_PIPELINE_MCP_RE = /path:\s*\.mcp\.json|uvx\s+mcpm|mcpm\s+run/;
 var PipelineMcpGatewayError = class extends Error {
@@ -48,7 +47,7 @@ function renderGatewayConfig(config) {
 		`mode: ${gateway.mode}`,
 		gateway.url ? `url: ${gateway.url}` : "",
 		`url_env: ${gateway.url_env}`,
-		`token_env: ${gateway.token_env}`,
+		`authorization_env: ${gateway.authorization_env}`,
 		gateway.default_profile ? `default_profile: ${gateway.default_profile}` : "",
 		`resolved_url: ${gatewayUrl(gateway)}`
 	].filter(Boolean).join("\n");
@@ -57,10 +56,12 @@ function renderCodexGatewayConfig(config) {
 	const gateway = configuredGateway(config);
 	return [
 		"# Generated by @oisincoveney/pipeline.",
-		"# Codex pipeline runs receive MCP gateway config through runtime launch args.",
-		"# Persistent Codex MCP config is intentionally left empty to avoid startup-time MCP fan-out.",
-		`# gateway_url = ${JSON.stringify(gatewayUrl(gateway))}`,
-		`# token_env = ${JSON.stringify(gateway.token_env)}`,
+		"",
+		`[mcp_servers.${PIPELINE_GATEWAY_SERVER_ID}]`,
+		`url = ${JSON.stringify(gatewayUrl(gateway))}`,
+		"",
+		`[mcp_servers.${PIPELINE_GATEWAY_SERVER_ID}.env_http_headers]`,
+		`Authorization = ${JSON.stringify(gateway.authorization_env)}`,
 		""
 	].join("\n");
 }
@@ -71,6 +72,7 @@ function renderOpenCodeGatewayConfig(config) {
 		mcp: { [PIPELINE_GATEWAY_SERVER_ID]: {
 			enabled: true,
 			headers: gatewayOpenCodeHeaders(gateway),
+			oauth: false,
 			type: "remote",
 			url: gatewayUrl(gateway)
 		} }
@@ -164,23 +166,18 @@ function checkGatewayUrl(gateway) {
 	}
 }
 function checkGatewayToken(gateway) {
-	return process.env[gateway.token_env] ? {
-		detail: gateway.token_env,
-		name: "gateway-token",
+	return process.env[gateway.authorization_env] ? {
+		detail: gateway.authorization_env,
+		name: "gateway-authorization",
 		passed: true
 	} : {
-		detail: `Set ${gateway.token_env}.`,
-		name: "gateway-token",
+		detail: `Set ${gateway.authorization_env}.`,
+		name: "gateway-authorization",
 		passed: false
 	};
 }
 function gatewayAuthorizationHeader(gateway) {
-	return `Basic {env:${gateway.token_env}}`;
-}
-function resolveHeaderEnvPlaceholders(value, env = process.env) {
-	return value.replace(AUTHORIZATION_ENV_RE, (_match, envVar) => {
-		return env[envVar] || `{env:${envVar}}`;
-	});
+	return `{env:${gateway.authorization_env}}`;
 }
 function gatewayOpenCodeHeaders(gateway) {
 	return { Authorization: gatewayAuthorizationHeader(gateway) };
@@ -254,7 +251,7 @@ async function checkGatewayHealth(gateway) {
 	}
 }
 async function firstHealthyGatewayResponse(url, gateway) {
-	const authorization = process.env[gateway.token_env] ? `Basic ${process.env[gateway.token_env]}` : void 0;
+	const authorization = process.env[gateway.authorization_env];
 	for (const healthUrl of gatewayHealthUrls(url)) {
 		const response = await fetch(healthUrl, {
 			headers: {
@@ -302,4 +299,4 @@ function legacyContentHit(cwd, path, pattern) {
 	return pattern.test(readFileSync(fullPath, "utf8")) ? path : void 0;
 }
 //#endregion
-export { configureGatewayHosts, gatewayServerForProfile, localGatewayStatus, renderGatewayConfig, resolveHeaderEnvPlaceholders, runGatewayDoctor, startLocalGateway };
+export { configureGatewayHosts, gatewayServerForProfile, localGatewayStatus, renderCodexGatewayConfig, renderGatewayConfig, runGatewayDoctor, startLocalGateway };

package/dist/pipeline-init.js

@@ -287,10 +287,11 @@ runners:
   opencode:
     type: opencode
     command: opencode
+    model: opencode/deepseek-v4-flash-free
     capabilities:
       native_subagents: true
       rules: true
-      skills: false
+      skills: true
       mcp_servers: true
       tools: [read, list, grep, glob, bash, edit, write, task]
       filesystem: [read-only, workspace-write]
@@ -353,7 +354,7 @@ mcp_gateway:
   provider: toolhive
   mode: local
   url_env: PIPELINE_MCP_GATEWAY_URL
-  token_env: MEMORY_MCP_BASIC_AUTH
+  authorization_env: PIPELINE_MCP_GATEWAY_AUTHORIZATION
   default_profile: default
 
 profiles:
@@ -563,6 +564,106 @@ profiles:
       repair:
         enabled: true
         max_attempts: 1
+  pipeline-opencode-researcher:
+    runner: opencode
+    description: Research the requested task and produce structured findings with OpenCode.
+    instructions:
+      path: .pipeline/prompts/researcher.md
+    rules: [test-first]
+    skills: [research, spec, scope]
+    mcp_servers: [pipeline-gateway]
+    tools: [read, list, grep, glob, bash]
+    filesystem:
+      mode: read-only
+      allow: ["**/*"]
+      deny: ["node_modules/**", "dist/**", ".git/**"]
+    network:
+      mode: inherit
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/research.schema.json
+      repair:
+        enabled: true
+        max_attempts: 1
+  pipeline-opencode-test-writer:
+    runner: opencode
+    description: Add focused failing tests for the requested behavior with OpenCode.
+    instructions:
+      path: .pipeline/prompts/test-writer.md
+    rules: [test-first]
+    skills: [test]
+    mcp_servers: [pipeline-gateway]
+    tools: [read, list, grep, glob, bash, edit, write]
+    filesystem:
+      mode: workspace-write
+      allow: ["**/*"]
+      deny: ["node_modules/**", "dist/**", ".git/**"]
+    network:
+      mode: inherit
+    output:
+      format: text
+  pipeline-opencode-code-writer:
+    runner: opencode
+    scheduling_roles: [implementation]
+    description: Implement production code until the failing tests pass with OpenCode.
+    instructions:
+      path: .pipeline/prompts/code-writer.md
+    rules: [test-first]
+    skills: [trace, test, fix, library-first-development]
+    mcp_servers: [pipeline-gateway]
+    tools: [read, list, grep, glob, bash, edit, write]
+    filesystem:
+      mode: workspace-write
+      allow: ["**/*"]
+      deny: ["node_modules/**", "dist/**", ".git/**"]
+    network:
+      mode: inherit
+    output:
+      format: text
+  pipeline-opencode-acceptance-reviewer:
+    runner: opencode
+    scheduling_roles: [coverage]
+    description: Audit the finished change against every acceptance criterion with OpenCode.
+    instructions:
+      path: .pipeline/prompts/acceptance-reviewer.md
+    rules: [verification]
+    skills: [critique, doubt]
+    mcp_servers: [pipeline-gateway]
+    tools: [read, list, grep, glob, bash]
+    filesystem:
+      mode: read-only
+      allow: ["**/*"]
+      deny: ["node_modules/**", "dist/**", ".git/**"]
+    network:
+      mode: inherit
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/acceptance.schema.json
+      repair:
+        enabled: true
+        max_attempts: 1
+  pipeline-opencode-verifier:
+    runner: opencode
+    scheduling_roles: [coverage]
+    description: Verify checks, implementation fit, and final evidence with OpenCode.
+    instructions:
+      path: .pipeline/prompts/verifier.md
+    rules: [verification]
+    skills: [verify, critique, secure, optimize]
+    mcp_servers: [pipeline-gateway]
+    tools: [read, list, grep, glob, bash]
+    filesystem:
+      mode: read-only
+      allow: ["**/*"]
+      deny: ["node_modules/**", "dist/**", ".git/**"]
+    network:
+      mode: inherit
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/verify.schema.json
+      repair:
+        enabled: true
+        max_attempts: 1
 `;
 const VERDICT_SCHEMA = z.enum(["PASS", "FAIL"]);
 const STRING_ARRAY_SCHEMA = z.array(z.string());

package/dist/runner-event-sink.js

@@ -87,6 +87,20 @@ function createRunnerEventSink(options) {
 				workflowId
 			});
 		},
+		recordRunnerJobPhase(phase, message, output) {
+			queue.push({
+				...nextEnvelope(),
+				log: {
+					level: "info",
+					message,
+					output: {
+						phase,
+						...output
+					}
+				},
+				type: "runner.job.phase"
+			});
+		},
 		recordRuntimeEvent,
 		recordSchemaValidationFailure(message, issues, workflowId) {
 			queue.push({

package/dist/runner-job/delivery.js

@@ -0,0 +1,57 @@
+import { execa } from "execa";
+//#region src/runner-job/delivery.ts
+const GITHUB_HTTPS_REPOSITORY_RE = /^https:\/\/github\.com\/([^/]+\/[^/.]+)(?:\.git)?$/;
+const GITHUB_SSH_REPOSITORY_RE = /^git@github\.com:([^/]+\/[^/.]+)(?:\.git)?$/;
+const createPullRequest = async (options) => {
+	if (!options.payload.delivery.pullRequest) return null;
+	const repository = options.payload.repository;
+	const env = compactEnv(options.env);
+	const runCommand = options.runCommand ?? runDeliveryCommand;
+	const branch = (await runCommand("git", ["branch", "--show-current"], {
+		cwd: options.worktreePath,
+		env,
+		stdin: "ignore"
+	})).stdout.trim();
+	if (!branch) throw new Error("Pull request delivery requires a checked-out branch");
+	const headOwner = options.env.PIPELINE_PR_HEAD_OWNER?.trim() || "oisin-bot";
+	const repositoryName = githubRepositoryName(repository.url);
+	await runCommand("git", [
+		"push",
+		"--set-upstream",
+		"origin",
+		branch
+	], {
+		cwd: options.worktreePath,
+		env,
+		stdin: "ignore"
+	});
+	const url = (await runCommand("gh", [
+		"pr",
+		"create",
+		"--fill",
+		"--base",
+		repository.baseBranch,
+		"--head",
+		`${headOwner}:${branch}`,
+		"--repo",
+		repositoryName
+	], {
+		cwd: options.worktreePath,
+		env,
+		stdin: "ignore"
+	})).stdout.trim();
+	return url ? { url } : null;
+};
+const runDeliveryCommand = (command, args, options) => execa(command, args, options);
+function compactEnv(env) {
+	return Object.fromEntries(Object.entries(env).filter((entry) => Boolean(entry[1])));
+}
+function githubRepositoryName(repositoryUrl) {
+	const httpsMatch = repositoryUrl.match(GITHUB_HTTPS_REPOSITORY_RE);
+	if (httpsMatch?.[1]) return httpsMatch[1];
+	const sshMatch = repositoryUrl.match(GITHUB_SSH_REPOSITORY_RE);
+	if (sshMatch?.[1]) return sshMatch[1];
+	throw new Error("Pull request delivery requires a GitHub repository URL");
+}
+//#endregion
+export { createPullRequest };

package/dist/runner-job/devspace.js

@@ -0,0 +1,34 @@
+import { loadPipelineConfig } from "../config.js";
+import { execa } from "execa";
+//#region src/runner-job/devspace.ts
+function assertRunnerDevspaceReady(worktreePath) {
+	return { config: loadPipelineConfig(worktreePath, { allowMissingLintFileReferences: true }) };
+}
+async function runRunnerDevspaceSmoke(options) {
+	const smoke = options.config.runner_job.environment.smoke;
+	if (smoke.length === 0) return "skipped";
+	const runCommand = options.runCommand ?? runDevspaceCommand;
+	for (const command of smoke) await runCommand(command.command, command.args, {
+		cwd: options.worktreePath,
+		env: compactEnv(options.env),
+		stdin: "ignore"
+	});
+	return "ran";
+}
+async function runRunnerEnvironmentSetup(options) {
+	const setup = options.config.runner_job.environment.setup;
+	if (setup.length === 0) return "skipped";
+	const runCommand = options.runCommand ?? runDevspaceCommand;
+	for (const command of setup) await runCommand(command.command, command.args, {
+		cwd: options.worktreePath,
+		env: compactEnv(options.env),
+		stdin: "ignore"
+	});
+	return "ran";
+}
+const runDevspaceCommand = (command, args, options) => execa(command, args, options);
+function compactEnv(env) {
+	return Object.fromEntries(Object.entries(env).filter((entry) => Boolean(entry[1])));
+}
+//#endregion
+export { assertRunnerDevspaceReady, runRunnerDevspaceSmoke, runRunnerEnvironmentSetup };