@oisincoveney/pipeline 1.18.0 → 1.18.1

package/dist/config.d.ts

@@ -223,8 +223,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        deny: "deny";
         "trusted-only": "trusted-only";
+        deny: "deny";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -279,10 +279,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -340,10 +340,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
+        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;

package/dist/runner-job/run.js

@@ -1,6 +1,6 @@
 import { PipelineConfigError } from "../config.js";
 import { runPipelineFromConfig } from "../pipeline-runtime.js";
-import { RUNNER_PAYLOAD_ENV, parseRunnerJobPayloadWithIssues, resolveRunnerEventSinkAuthToken } from "../runner-job-contract.js";
+import { RUNNER_PAYLOAD_ENV, parseRunnerJobPayloadWithIssues } from "../runner-job-contract.js";
 import { createRunnerEventSink } from "../runner-event-sink.js";
 import { compileScheduleArtifact, generateScheduleArtifact } from "../schedule-planner.js";
 import { createPullRequest } from "./delivery.js";
@@ -14,8 +14,6 @@ const EXIT_FAIL = 1;
 const EXIT_CANCELLED = 130;
 const EXIT_VALIDATION = 64;
 const EXIT_STARTUP = 70;
-const RUNNER_EVENT_SINK_URL_ENV = "OISIN_PIPELINE_EVENT_SINK_URL";
-const RUNNER_EVENT_SINK_AUTH_HEADER_ENV = "OISIN_PIPELINE_EVENT_AUTH_HEADER";
 const RUNNER_SCHEDULE_ENTRYPOINT = "pipe";
 async function runRunnerJob(options = {}) {
 	const prepared = prepareRunnerJob(options);
@@ -30,6 +28,7 @@ async function runRunnerJob(options = {}) {
 	let signalFinalResultRecorded = false;
 	const sink = createRunnerSink({
 		env,
+		events: payload.events,
 		fetch: options.fetch,
 		runId: payload.run.id
 	});
@@ -209,6 +208,7 @@ async function reportPreparedValidationFailure(failure, options) {
 	if (failure.recoverable) {
 		const sink = createRunnerSink({
 			env: failure.env,
+			events: failure.recoverable.events,
 			fetch: options.fetch,
 			runId: failure.recoverable.run.id
 		});
@@ -217,26 +217,23 @@ async function reportPreparedValidationFailure(failure, options) {
 	}
 	return EXIT_VALIDATION;
 }
-function resolveAuthToken(env, stderr) {
-	try {
-		return resolveRunnerEventSinkAuthToken({ env });
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		stderr.write(`${message}\n`);
+function resolveAuthToken(authTokenEnv, env, stderr) {
+	const token = env[authTokenEnv]?.trim();
+	if (!token) {
+		stderr.write(`Runner event auth token is required. Set ${authTokenEnv}.\n`);
 		return null;
 	}
+	return token;
 }
 function createRunnerSink(options) {
-	const url = options.env[RUNNER_EVENT_SINK_URL_ENV]?.trim();
-	if (!url) return createNoopRunnerEventSink();
-	const authToken = resolveAuthToken(options.env, { write: () => true });
+	const authToken = resolveAuthToken(options.events.authTokenEnv, options.env, { write: () => true });
 	if (!authToken) return createNoopRunnerEventSink();
 	return createRunnerEventSink({
-		authHeader: options.env[RUNNER_EVENT_SINK_AUTH_HEADER_ENV]?.trim() || "Authorization",
+		authHeader: options.events.authHeader,
 		authToken,
 		fetch: options.fetch,
 		runId: options.runId,
-		url
+		url: options.events.url
 	});
 }
 function createNoopRunnerEventSink() {

package/dist/runner-job-contract.d.ts

@@ -38,6 +38,11 @@ declare const runnerRepositoryContextSchema: z.ZodObject<{
 declare const runnerDeliverySchema: z.ZodObject<{
   pullRequest: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strict>;
+declare const runnerEventsSchema: z.ZodObject<{
+  authHeader: z.ZodDefault<z.ZodString>;
+  authTokenEnv: z.ZodString;
+  url: z.ZodString;
+}, z.core.$strict>;
 declare const runnerMomokayaContextSchema: z.ZodObject<{
   automationNamespace: z.ZodOptional<z.ZodString>;
   previewEnabled: z.ZodBoolean;
@@ -48,6 +53,11 @@ declare const runnerJobPayloadSchema: z.ZodObject<{
   delivery: z.ZodDefault<z.ZodObject<{
     pullRequest: z.ZodDefault<z.ZodBoolean>;
   }, z.core.$strict>>;
+  events: z.ZodObject<{
+    authHeader: z.ZodDefault<z.ZodString>;
+    authTokenEnv: z.ZodString;
+    url: z.ZodString;
+  }, z.core.$strict>;
   momokaya: z.ZodOptional<z.ZodObject<{
     automationNamespace: z.ZodOptional<z.ZodString>;
     previewEnabled: z.ZodBoolean;
@@ -75,6 +85,7 @@ declare const runnerJobPayloadSchema: z.ZodObject<{
   }, z.core.$strict>], "kind">;
 }, z.core.$strict>;
 type RunnerDelivery = z.infer<typeof runnerDeliverySchema>;
+type RunnerEvents = z.infer<typeof runnerEventsSchema>;
 type RunnerJobPayload = z.infer<typeof runnerJobPayloadSchema>;
 type RunnerMomokayaContext = z.infer<typeof runnerMomokayaContextSchema>;
 type RunnerRepositoryContext = z.infer<typeof runnerRepositoryContextSchema>;
@@ -87,6 +98,11 @@ declare const runnerJobPayloadJsonSchema: z.core.ZodStandardJSONSchemaPayload<z.
   delivery: z.ZodDefault<z.ZodObject<{
     pullRequest: z.ZodDefault<z.ZodBoolean>;
   }, z.core.$strict>>;
+  events: z.ZodObject<{
+    authHeader: z.ZodDefault<z.ZodString>;
+    authTokenEnv: z.ZodString;
+    url: z.ZodString;
+  }, z.core.$strict>;
   momokaya: z.ZodOptional<z.ZodObject<{
     automationNamespace: z.ZodOptional<z.ZodString>;
     previewEnabled: z.ZodBoolean;
@@ -119,6 +135,7 @@ interface RunnerJobPayloadValidationIssue {
   path: string;
 }
 interface RecoverableRunnerJobPayloadEnvelope {
+  events: RunnerEvents;
   run: RunnerRunIdentity;
 }
 declare class RunnerJobPayloadValidationError extends Error {
@@ -135,12 +152,14 @@ type RunnerJobPayloadParseResult = {
 };
 interface BuildRunnerJobPayloadOptions {
   delivery?: RunnerDelivery;
+  events: RunnerEvents;
   momokaya?: RunnerMomokayaContext;
   repository: RunnerRepositoryContext;
   run: RunnerRunIdentity;
   task: RunnerTask;
 }
 interface CreateRunnerJobPayloadEnvOptions {
+  events: RunnerEvents;
   project: string;
   repository: RunnerRepositoryContext;
   requestedBy?: string;
@@ -148,8 +167,8 @@ interface CreateRunnerJobPayloadEnvOptions {
   taskPrompt: string;
 }
 interface ResolveRunnerEventSinkAuthTokenOptions {
+  authTokenEnv: string;
   env?: Record<string, string | undefined>;
-  serviceAccountTokenPath?: string;
 }
 interface RunnerEventMappingContext {
   runId: string;
@@ -276,8 +295,8 @@ type RunnerEventRecord = (RunnerEventEnvelope & {
   finalResult: RunnerFinalResultDetails;
   type: "workflow.finish";
 });
-declare function resolveRunnerEventSinkAuthToken(options?: ResolveRunnerEventSinkAuthTokenOptions): string;
-declare function resolveRunnerEventSinkAuthHeader(options?: ResolveRunnerEventSinkAuthTokenOptions): string;
+declare function resolveRunnerEventSinkAuthToken(options: ResolveRunnerEventSinkAuthTokenOptions): string;
+declare function resolveRunnerEventSinkAuthHeader(options: ResolveRunnerEventSinkAuthTokenOptions): string;
 declare function createRunnerJobPayloadEnv(options: CreateRunnerJobPayloadEnvOptions): {
   name: typeof RUNNER_PAYLOAD_ENV;
   value: string;
@@ -287,4 +306,4 @@ declare function parseRunnerJobPayload(rawPayload: string): RunnerJobPayload;
 declare function parseRunnerJobPayloadWithIssues(rawPayload: string): RunnerJobPayloadParseResult;
 declare function mapRuntimeEventToRunnerEventRecords(event: PipelineRuntimeEvent, context: RunnerEventMappingContext): RunnerEventRecord[];
 //#endregion
-export { BuildRunnerJobPayloadOptions, CreateRunnerJobPayloadEnvOptions, RUNNER_JOB_CONTRACT_VERSION, RUNNER_PAYLOAD_ENV, RecoverableRunnerJobPayloadEnvelope, ResolveRunnerEventSinkAuthTokenOptions, RunnerArtifactDetails, RunnerArtifactStatus, RunnerDelivery, RunnerEventMappingContext, RunnerEventRecord, RunnerFinalResultDetails, RunnerGateDetails, RunnerGateStatus, RunnerHookResultDetails, RunnerJobPayload, RunnerJobPayloadParseResult, RunnerJobPayloadValidationError, RunnerJobPayloadValidationIssue, RunnerLogDetails, RunnerLogLevel, RunnerMomokayaContext, RunnerNodeDetails, RunnerNodeStatus, RunnerRepositoryContext, RunnerRunIdentity, RunnerTask, RunnerTaskPrompt, RunnerTaskTicket, RunnerWorkflowEdgeDetails, RunnerWorkflowEdgeRecordDetails, RunnerWorkflowNodeDetails, RunnerWorkflowPlanDetails, buildRunnerJobPayload, createRunnerJobPayloadEnv, mapRuntimeEventToRunnerEventRecords, parseRunnerJobPayload, parseRunnerJobPayloadWithIssues, resolveRunnerEventSinkAuthHeader, resolveRunnerEventSinkAuthToken, runnerDeliverySchema, runnerJobPayloadJsonSchema, runnerJobPayloadSchema, runnerMomokayaContextSchema, runnerRepositoryContextSchema, runnerRunIdentitySchema, runnerTaskPromptSchema, runnerTaskSchema, runnerTaskTicketSchema };
+export { BuildRunnerJobPayloadOptions, CreateRunnerJobPayloadEnvOptions, RUNNER_JOB_CONTRACT_VERSION, RUNNER_PAYLOAD_ENV, RecoverableRunnerJobPayloadEnvelope, ResolveRunnerEventSinkAuthTokenOptions, RunnerArtifactDetails, RunnerArtifactStatus, RunnerDelivery, RunnerEventMappingContext, RunnerEventRecord, RunnerEvents, RunnerFinalResultDetails, RunnerGateDetails, RunnerGateStatus, RunnerHookResultDetails, RunnerJobPayload, RunnerJobPayloadParseResult, RunnerJobPayloadValidationError, RunnerJobPayloadValidationIssue, RunnerLogDetails, RunnerLogLevel, RunnerMomokayaContext, RunnerNodeDetails, RunnerNodeStatus, RunnerRepositoryContext, RunnerRunIdentity, RunnerTask, RunnerTaskPrompt, RunnerTaskTicket, RunnerWorkflowEdgeDetails, RunnerWorkflowEdgeRecordDetails, RunnerWorkflowNodeDetails, RunnerWorkflowPlanDetails, buildRunnerJobPayload, createRunnerJobPayloadEnv, mapRuntimeEventToRunnerEventRecords, parseRunnerJobPayload, parseRunnerJobPayloadWithIssues, resolveRunnerEventSinkAuthHeader, resolveRunnerEventSinkAuthToken, runnerDeliverySchema, runnerEventsSchema, runnerJobPayloadJsonSchema, runnerJobPayloadSchema, runnerMomokayaContextSchema, runnerRepositoryContextSchema, runnerRunIdentitySchema, runnerTaskPromptSchema, runnerTaskSchema, runnerTaskTicketSchema };

package/dist/runner-job-contract.js

@@ -1,5 +1,4 @@
 import { parseJson } from "./safe-json.js";
-import { existsSync, readFileSync } from "node:fs";
 import { z } from "zod";
 //#region src/runner-job-contract.ts
 const RUNNER_PAYLOAD_ENV = "OISIN_PIPELINE_RUNNER_PAYLOAD_JSON";
@@ -27,6 +26,11 @@ const runnerRepositoryContextSchema = z.object({
 	url: z.string().url()
 }).strict();
 const runnerDeliverySchema = z.object({ pullRequest: z.boolean().default(false) }).strict();
+const runnerEventsSchema = z.object({
+	authHeader: z.string().min(1).default("Authorization"),
+	authTokenEnv: z.string().min(1),
+	url: z.string().url()
+}).strict();
 const runnerMomokayaContextSchema = z.object({
 	automationNamespace: z.string().min(1).optional(),
 	previewEnabled: z.boolean(),
@@ -35,6 +39,7 @@ const runnerMomokayaContextSchema = z.object({
 const runnerJobPayloadSchema = z.object({
 	contractVersion: z.literal("1", { error: "runner job payload contract version must be 1" }).default("1"),
 	delivery: runnerDeliverySchema.default({ pullRequest: false }),
+	events: runnerEventsSchema,
 	momokaya: runnerMomokayaContextSchema.optional(),
 	repository: runnerRepositoryContextSchema,
 	run: runnerRunIdentitySchema,
@@ -49,22 +54,12 @@ var RunnerJobPayloadValidationError = class extends Error {
 		this.issues = issues;
 	}
 };
-const EVENT_AUTH_TOKEN_ENV_KEYS = ["OISIN_PIPELINE_EVENT_AUTH_TOKEN", "PIPELINE_EVENT_API_TOKEN"];
-const DEFAULT_SERVICE_ACCOUNT_TOKEN_PATH = "/var/run/secrets/kubernetes.io/serviceaccount/token";
-function resolveRunnerEventSinkAuthToken(options = {}) {
-	const env = options.env ?? process.env;
-	for (const key of EVENT_AUTH_TOKEN_ENV_KEYS) {
-		const token = env[key]?.trim();
-		if (token) return token;
-	}
-	const tokenPath = options.serviceAccountTokenPath ?? DEFAULT_SERVICE_ACCOUNT_TOKEN_PATH;
-	if (existsSync(tokenPath)) {
-		const token = readFileSync(tokenPath, "utf8").trim();
-		if (token) return token;
-	}
-	throw new Error(`Runner event auth token is required. Set ${EVENT_AUTH_TOKEN_ENV_KEYS.join(" or ")}, or mount a readable Kubernetes service account token at ${tokenPath}.`);
+function resolveRunnerEventSinkAuthToken(options) {
+	const token = (options.env ?? process.env)[options.authTokenEnv]?.trim();
+	if (token) return token;
+	throw new Error(`Runner event auth token is required. Set ${options.authTokenEnv}.`);
 }
-function resolveRunnerEventSinkAuthHeader(options = {}) {
+function resolveRunnerEventSinkAuthHeader(options) {
 	return `Bearer ${resolveRunnerEventSinkAuthToken(options)}`;
 }
 function createRunnerJobPayloadEnv(options) {
@@ -74,6 +69,7 @@ function createRunnerJobPayloadEnv(options) {
 			project: options.project,
 			requestedBy: options.requestedBy
 		},
+		events: options.events,
 		repository: options.repository,
 		task: {
 			kind: "prompt",
@@ -89,6 +85,7 @@ function buildRunnerJobPayload(options) {
 	return runnerJobPayloadSchema.parse({
 		contractVersion: "1",
 		delivery: options.delivery,
+		events: options.events,
 		momokaya: options.momokaya,
 		repository: options.repository,
 		run: options.run,
@@ -393,8 +390,12 @@ function recoverablePayloadEnvelope(payload) {
 	const envelope = readRecord(payload);
 	if (!envelope) return {};
 	const run = runnerRunIdentitySchema.safeParse(envelope.run);
-	if (!run.success) return {};
-	return { recoverable: { run: run.data } };
+	const events = runnerEventsSchema.safeParse(envelope.events);
+	if (!(run.success && events.success)) return {};
+	return { recoverable: {
+		events: events.data,
+		run: run.data
+	} };
 }
 function omitUndefined(value) {
 	return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== void 0));
@@ -406,4 +407,4 @@ function assertNever(value) {
 	throw new Error(`Unhandled runtime event: ${String(value)}`);
 }
 //#endregion
-export { RUNNER_JOB_CONTRACT_VERSION, RUNNER_PAYLOAD_ENV, RunnerJobPayloadValidationError, buildRunnerJobPayload, createRunnerJobPayloadEnv, mapRuntimeEventToRunnerEventRecords, parseRunnerJobPayload, parseRunnerJobPayloadWithIssues, resolveRunnerEventSinkAuthHeader, resolveRunnerEventSinkAuthToken, runnerDeliverySchema, runnerJobPayloadJsonSchema, runnerJobPayloadSchema, runnerMomokayaContextSchema, runnerRepositoryContextSchema, runnerRunIdentitySchema, runnerTaskPromptSchema, runnerTaskSchema, runnerTaskTicketSchema };
+export { RUNNER_JOB_CONTRACT_VERSION, RUNNER_PAYLOAD_ENV, RunnerJobPayloadValidationError, buildRunnerJobPayload, createRunnerJobPayloadEnv, mapRuntimeEventToRunnerEventRecords, parseRunnerJobPayload, parseRunnerJobPayloadWithIssues, resolveRunnerEventSinkAuthHeader, resolveRunnerEventSinkAuthToken, runnerDeliverySchema, runnerEventsSchema, runnerJobPayloadJsonSchema, runnerJobPayloadSchema, runnerMomokayaContextSchema, runnerRepositoryContextSchema, runnerRunIdentitySchema, runnerTaskPromptSchema, runnerTaskSchema, runnerTaskTicketSchema };

package/docs/operator-guide.md

@@ -122,7 +122,8 @@ Host choices are `all`, `opencode`, and `codex`.
 Runs the in-pod backend worker entrypoint. The job reads
 `OISIN_PIPELINE_RUNNER_PAYLOAD_JSON`, prepares `PIPELINE_TARGET_PATH` or clones
 the requested repository into `/workspace`, generates a task-specific schedule,
-and appends runtime events to `OISIN_PIPELINE_EVENT_SINK_URL` when configured.
+and appends runtime events to the Console endpoint configured by payload
+`events.url`.
 
 The runner job does not call the Kubernetes API. Validation errors exit `64`,
 startup errors exit `70`, runtime failure exits `1`, cancellation exits `130`,
@@ -132,9 +133,8 @@ Local dry run:
 
 ```shell
 export PIPELINE_TARGET_PATH=/path/to/target/repo
-export OISIN_PIPELINE_EVENT_SINK_URL=http://127.0.0.1:3000/api/pipeline/runs/run-uid-1/events
-export OISIN_PIPELINE_EVENT_AUTH_TOKEN=dev-token
-export OISIN_PIPELINE_RUNNER_PAYLOAD_JSON='{"contractVersion":"1","run":{"id":"run-uid-1","project":"alpha","requestedBy":"@agent"},"repository":{"url":"https://github.com/oisin-ee/pipeline-runner.git","baseBranch":"main"},"task":{"kind":"prompt","prompt":"PIPE-38"},"delivery":{"pullRequest":false}}'
+export PIPELINE_EVENT_API_TOKEN=dev-token
+export OISIN_PIPELINE_RUNNER_PAYLOAD_JSON='{"contractVersion":"1","run":{"id":"run-uid-1","project":"alpha","requestedBy":"@agent"},"repository":{"url":"https://github.com/oisin-ee/pipeline-runner.git","baseBranch":"main"},"task":{"kind":"prompt","prompt":"PIPE-38"},"delivery":{"pullRequest":false},"events":{"url":"http://127.0.0.1:3000/api/pipeline/runner-events","authHeader":"Authorization","authTokenEnv":"PIPELINE_EVENT_API_TOKEN"}}'
 pipe runner-job
 ```
 
@@ -162,10 +162,8 @@ spec:
           image: ghcr.io/oisin-ee/pipeline-runner:latest
           env:
             - name: OISIN_PIPELINE_RUNNER_PAYLOAD_JSON
-              value: '{"contractVersion":"1","run":{"id":"run-uid-1","project":"alpha"},"repository":{"url":"https://github.com/oisin-ee/pipeline-runner.git","baseBranch":"main","sha":"0123456789abcdef0123456789abcdef01234567"},"task":{"kind":"prompt","prompt":"PIPE-38"},"delivery":{"pullRequest":true}}'
-            - name: OISIN_PIPELINE_EVENT_SINK_URL
-              value: https://console.example/api/pipeline/runs/run-uid-1/events
-            - name: OISIN_PIPELINE_EVENT_AUTH_TOKEN
+              value: '{"contractVersion":"1","run":{"id":"run-uid-1","project":"alpha"},"repository":{"url":"https://github.com/oisin-ee/pipeline-runner.git","baseBranch":"main","sha":"0123456789abcdef0123456789abcdef01234567"},"task":{"kind":"prompt","prompt":"PIPE-38"},"delivery":{"pullRequest":true},"events":{"url":"https://console.example/api/pipeline/runner-events","authHeader":"Authorization","authTokenEnv":"PIPELINE_EVENT_API_TOKEN"}}'
+            - name: PIPELINE_EVENT_API_TOKEN
               valueFrom:
                 secretKeyRef:
                   name: pipeline-runner-event-auth
@@ -175,9 +173,9 @@ spec:
 The runner image is configured in `pipeline-console` as
 `pipeline.runner.image`. Console runner settings include queue name, service
 account, CPU/memory requests and limits, active deadline, TTL, backoff limit,
-event sink URL, and auth header. The runner-side `OISIN_PIPELINE_EVENT_SINK_URL`
-and `OISIN_PIPELINE_EVENT_AUTH_TOKEN` or `PIPELINE_EVENT_API_TOKEN` must match
-the console API `PIPELINE_EVENT_API_TOKEN`.
+event sink URL, auth header, and the token environment variable name. The
+runner-side secret mounted at `events.authTokenEnv` must match the console API
+`PIPELINE_EVENT_API_TOKEN`.
 
 The runner payload contract lives at
 `@oisincoveney/pipeline/runner-job-contract`. `pipeline-console` should create

package/docs/pipeline-console-runner-contract.md

@@ -37,6 +37,11 @@ subpath exports `parseRunnerJobPayload`, `RUNNER_JOB_CONTRACT_VERSION`, and
   },
   "delivery": {
     "pullRequest": true
+  },
+  "events": {
+    "url": "https://console.example/api/pipeline/runner-events",
+    "authHeader": "Authorization",
+    "authTokenEnv": "PIPELINE_EVENT_API_TOKEN"
   }
 }
 ```
@@ -51,10 +56,12 @@ subpath exports `parseRunnerJobPayload`, `RUNNER_JOB_CONTRACT_VERSION`, and
 { "kind": "ticket", "id": "PC-27", "path": "tickets/PC-27.md" }
 ```
 
-Payloads describe repository and task intent only. They must not carry runner
-mechanics such as event sink URLs, workflow selectors, entrypoints, workspace
-modes, clone credential env names, repository owner/repo duplicates, or secrets.
-The runner clones `repository.url` into `/workspace`, checks out a
+Payloads describe run identity, repository/task intent, delivery intent, and the
+Console event destination. They must not carry workflow selectors, entrypoints,
+workspace modes, clone credential env names, repository owner/repo duplicates, or
+secrets. `events.authTokenEnv` names the environment variable containing the
+Console event API token; the token value itself stays in Kubernetes secrets. The
+runner clones `repository.url` into `/workspace`, checks out a
 `pipeline/<task-or-run>` branch from `repository.sha` when present or
 `origin/<repository.baseBranch>` otherwise, sets `PIPELINE_TARGET_PATH`, loads the
 repository `.pipeline` config, generates a task-specific `pipe` schedule, and
@@ -81,19 +88,9 @@ Console-created Jobs are labeled with `kueue.x-k8s.io/queue-name` and
 
 ## Event Batches
 
-Event routing is runner environment/config, not payload. Set
-`OISIN_PIPELINE_EVENT_SINK_URL` to the append endpoint. The runner sets the
-authorization header from `OISIN_PIPELINE_EVENT_AUTH_HEADER` when present,
-otherwise `Authorization`, and resolves the bearer token using this lookup order:
-
-1. `OISIN_PIPELINE_EVENT_AUTH_TOKEN`
-2. `PIPELINE_EVENT_API_TOKEN`
-3. `/var/run/secrets/kubernetes.io/serviceaccount/token`
-
-If the event sink URL or token is unavailable, the runner still executes with a
-no-op sink. If a configured terminal sink flush fails, the Job exits `70`.
-
-The runner posts authenticated JSON batches to `OISIN_PIPELINE_EVENT_SINK_URL`:
+Console supplies `events.url`, `events.authHeader`, and `events.authTokenEnv` in
+the runner payload. The runner reads the token from the named environment
+variable and posts progressive authenticated JSON batches to `events.url`:
 
 ```json
 {
@@ -113,9 +110,10 @@ Each event has a strictly increasing integer `sequence`, a string `type`, an
 `node`, `gate`, `artifact`, `log`, and `finalResult`. The console stores
 non-reserved top-level fields as event payload.
 
-If payload validation fails but the runner can recover the run identity, it posts
-a `runner.schema.validation` warning event when an event sink is configured, then
-posts `workflow.finish` with outcome `FAIL`, and exits `64`. If identity is not
+If a configured terminal sink flush fails, the Job exits `70`. If payload
+validation fails but the runner can recover the run identity and event config, it
+posts a `runner.schema.validation` warning event, then posts `workflow.finish`
+with outcome `FAIL`, and exits `64`. If identity or event config is not
 recoverable, it writes the validation error to stderr and exits `64` without
 posting events.
 

package/package.json

@@ -99,7 +99,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "1.18.0",
+  "version": "1.18.1",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",