@oisincoveney/pipeline 1.19.1 → 1.21.0

package/README.md

@@ -1,16 +1,15 @@
 # @oisincoveney/pipeline
 
-Config-driven multi-agent pipeline runner for repository work. The source of
-truth is three YAML files: `.pipeline/runners.yaml` declares runner adapters,
-`.pipeline/profiles.yaml` declares reusable profiles and their grants, and
-`.pipeline/pipeline.yaml` declares orchestration, workflows, gates, hooks, and
-artifacts.
+Config-driven multi-agent pipeline runner for repository work. Runtime config is
+owned by the installed `@oisincoveney/pipeline` package. Repo-local `.pipeline`
+paths are runtime artifact locations only; they are not the runtime config
+source.
 
 ## Requirements
 
 - Bun 1.1 or newer
 - Node.js 22.13 or newer
-- `npx`, `backlog`, `uvx`, and Docker on `PATH` for default skills and MCP setup
+- `npx`, `backlog`, `uvx`, and Docker on `PATH` for default skills and MCP gateway setup
 - At least one configured runner CLI on `PATH`: `codex`, `opencode`, `kimi`,
   `pi`, or a declared command runner
 
@@ -22,33 +21,31 @@ bun install --frozen-lockfile
 
 ## Start A Repository
 
-Scaffold the default YAML workflow:
+Initialize package-owned pipeline support:
 
 ```shell
 pipe init
 ```
 
 `pipe init` installs default project skills with
-`npx skills add oisincoveney/skills` and registers default MCP servers with the
-MCPM CLI from https://mcpm.sh/. Default profiles point at the installed
-`.agents/skills/<skill>/SKILL.md` files in the target repository. The package
-invokes MCPM through `uvx --python 3.12 mcpm`, so generated `.mcp.json` entries
-do not depend on a globally installed `mcpm` binary. The default Qdrant/memory
-MCP is the Momokaya remote endpoint
-`https://memory-mcp.momokaya.ee/mcp/`.
-
-The default GitHub MCP registration uses GitHub's official container in
-read-only mode and reads `GITHUB_PERSONAL_ACCESS_TOKEN` from the environment.
-The Momokaya gateway endpoint is protected by Traefik HTTP Basic auth. Set
-`PIPELINE_MCP_GATEWAY_AUTHORIZATION` to the full HTTP `Authorization` header
-value before starting Codex or OpenCode:
+`npx skills add oisincoveney/skills`, then writes generated Codex and OpenCode
+command surfaces plus their singleton `pipeline-gateway` MCP entries. It does
+not create repo-local `.pipeline` config files.
+
+The default MCP gateway can run locally or point at the hosted Momokaya
+gateway. Set `PIPELINE_MCP_GATEWAY_AUTHORIZATION` to the full HTTP
+`Authorization` header value before starting Codex or OpenCode when using a
+protected gateway:
 
 ```shell
 export PIPELINE_MCP_GATEWAY_AUTHORIZATION="Basic $(printf '%s' 'user:password' | base64)"
 ```
 
-`pipe init` writes project-level Codex and OpenCode config that points at the
-singleton `pipeline-gateway` MCP server.
+To refresh or check generated host files later, use:
+
+```shell
+pipe install-commands --host all --check
+```
 
 Check local prerequisites and config health:
 
@@ -124,8 +121,11 @@ storage, Kueue discovery, and UI rendering. This package owns the in-container
 translation, authenticated event posting, signal cancellation, and final event
 flushing.
 
-The console starts the image with `OISIN_PIPELINE_RUNNER_PAYLOAD_JSON` and the
-runner-side event token. The payload contract is documented in
+The console starts the image with the payload as a mounted ConfigMap file and
+the event auth token as a mounted Secret file. The runner reads the payload
+from `--payload-file` and reads the event auth token from the file path
+specified in `events.authTokenFile`. No environment variables are used for
+payload or auth token delivery. The payload contract is documented in
 [`docs/pipeline-console-runner-contract.md`](docs/pipeline-console-runner-contract.md).
 The executable contract is exported from
 `@oisincoveney/pipeline/runner-job-contract` for payload construction,
@@ -133,9 +133,12 @@ validation, contract-version checks, and JSON Schema generation.
 Use `PIPELINE_TARGET_PATH=/path/to/worktree` when the checked-out target repo is
 mounted somewhere other than the process working directory.
 
-## Minimal YAML
+## Custom YAML Parts
 
-`.pipeline/runners.yaml`:
+Runtime execution uses package-owned defaults. Tests and advanced embedding code
+can still parse explicit YAML parts with `parsePipelineConfigParts()`.
+
+`runners`:
 
 ```yaml
 version: 1
@@ -153,7 +156,7 @@ runners:
       output_formats: [text, json, jsonl, json_schema]
 ```
 
-`.pipeline/profiles.yaml`:
+`profiles`:
 
 ```yaml
 version: 1
@@ -179,7 +182,7 @@ profiles:
       format: text
 ```
 
-`.pipeline/pipeline.yaml`:
+Example workflow shape:
 
 ```yaml
 version: 1
@@ -212,14 +215,12 @@ workflows:
             builtin: typecheck
 ```
 
-Projects can also declare `entrypoints` in `.pipeline/pipeline.yaml` to expose
-stable app or CLI names that resolve to workflows or schedule policies. Direct
-`--workflow` selection remains available and takes precedence over `--entrypoint`
-when both are set.
+Package-owned defaults declare `entrypoints` that expose stable app or CLI names
+resolving to workflows or schedule policies. Direct `--workflow` selection
+remains available and takes precedence over `--entrypoint` when both are set.
 
-The default scaffold includes a full research, red, green, verify, learn
-workflow. See `docs/config-architecture.md` for a complete example and the host
-support matrix.
+The package defaults include a full research, red, green, verify, learn
+workflow. See `docs/config-architecture.md` for the host support matrix.
 
 ### Structural Parallelism
 
@@ -289,22 +290,22 @@ branches share a base SHA, and merges passing branches into an integration
 branch in declaration order. It reports merge conflicts; it does not resolve
 them automatically.
 
-Default profile skills are installed into `.agents/skills` by `pipe init`.
-Runtime MCP projection and host-specific isolation policy live in `src/mcp`; see
-[`docs/mcp-host-isolation.md`](docs/mcp-host-isolation.md) and
+Default profile skills and generated host resources are installed by
+`pipe init`. Runtime MCP projection and host-specific isolation policy live in
+`src/mcp`; see [`docs/mcp-host-isolation.md`](docs/mcp-host-isolation.md) and
 [`docs/mcp-gateway.md`](docs/mcp-gateway.md).
 
 ## Generated Host Resources
 
-Generate native host files from the YAML config:
+Generate native host files during setup:
 
 ```shell
-pipe install-commands --host all
+pipe init
 ```
 
-Generated resources are derived from the three config files; they are not
-separate sources of truth. Host resources use exact native agents when the node
-runner matches the host. OpenCode also uses native subagents for cross-runner
+Generated resources are derived from package-owned config; they are not separate
+sources of truth. Host resources use exact native agents when the node runner
+matches the host. OpenCode also uses native subagents for cross-runner
 model-backed nodes when the runner/profile provides an OpenCode-compatible
 `model` or `host_models.opencode` value. Otherwise generated instructions
 dispatch to that runner's CLI instead of inventing a host model.
@@ -333,8 +334,8 @@ runners:
 
 ## Runtime Guarantees
 
-- `pipe run` fails without `.pipeline/pipeline.yaml`,
-  `.pipeline/profiles.yaml`, and `.pipeline/runners.yaml`.
+- `pipe run` loads package-owned `@oisincoveney/pipeline` config even when the
+  repository has no repo-local `.pipeline` config files.
 - Multi-agent workflows execute as separate agent boundaries; nodes are not
   merged into one prompt.
 - Native subagent strategy is preferred when the selected runner can represent
@@ -410,3 +411,6 @@ bun run check
 bun run test
 bun run build:cli
 ```
+
+
+Runner Kubernetes Jobs can be generated with `buildRunnerJobK8sManifest` from `@oisincoveney/pipeline/runner-job-k8s`.

package/dist/commands/pipeline-command.js

@@ -12,7 +12,6 @@ const BUILTIN_PIPE_COMMANDS = new Set([
 ]);
 function registerConfiguredEntrypointCommands(program, config, runEntrypoint) {
 	const registered = /* @__PURE__ */ new Set();
-	if (!config) return registered;
 	const reservedCommands = new Set(program.commands.map((command) => command.name()));
 	for (const [id, entrypoint] of Object.entries(config.entrypoints)) {
 		if (reservedCommands.has(id)) continue;

package/dist/commands/runner-job-command.js

@@ -1,8 +1,12 @@
 import { runRunnerJob } from "../runner-job/run.js";
 //#region src/commands/runner-job-command.ts
 function registerRunnerJobCommand(program) {
-	program.command("runner-job").description("Run an in-pod pipeline runner job from the console payload").action(async () => {
-		const exitCode = await runRunnerJob();
+	program.command("runner-job").description("Run an in-pod pipeline runner job from the console payload").option("--payload-file <path>", "Path to the runner job payload JSON file").option("--orchestrator <name>", "Orchestrator runner (codex|opencode)").argument("[orchestrator]", "Orchestrator runner (codex|opencode)").action(async (orchestratorArg, options) => {
+		const orchestrator = orchestratorArg ?? options.orchestrator;
+		const exitCode = await runRunnerJob({
+			payloadFile: options.payloadFile,
+			orchestrator
+		});
 		process.exitCode = exitCode;
 	});
 }

package/dist/config.d.ts

@@ -10,7 +10,13 @@ declare const HOOK_EVENTS: readonly ["workflow.start", "workflow.success", "work
 declare const GATE_KINDS: readonly ["acceptance", "artifact", "builtin", "changed_files", "command", "json_schema", "verdict"];
 declare const SCHEDULE_BASELINES: readonly ["epic", "pipe"];
 declare const SCHEDULING_ROLES: readonly ["coverage", "implementation"];
-type PipelineConfigErrorCode = "PIPELINE_CONFIG_LEGACY_UNSUPPORTED" | "PIPELINE_CONFIG_MISSING" | "PIPELINE_CONFIG_PARSE_ERROR" | "PIPELINE_CONFIG_VALIDATION_ERROR";
+declare const MCP_GATEWAY_BACKEND_LOCALITIES: readonly ["repo-local", "repo-scoped-remote", "shared-remote"];
+declare const MCP_GATEWAY_WORKSPACE_PATH_SOURCES: readonly ["PIPELINE_TARGET_PATH", "cwd"];
+declare const DEFAULT_RUNNER_JOB_GIT_COMMITTER: {
+  readonly email: "git@oisin.ee";
+  readonly name: "oisin-bot";
+};
+type PipelineConfigErrorCode = "PIPELINE_CONFIG_LEGACY_UNSUPPORTED" | "PIPELINE_CONFIG_PARSE_ERROR" | "PIPELINE_CONFIG_VALIDATION_ERROR";
 interface PipelineConfigIssue {
   message: string;
   path?: string;
@@ -233,6 +239,19 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
   }, z.core.$strict>>;
   mcp_gateway: z.ZodOptional<z.ZodObject<{
+    backends: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+      locality: z.ZodEnum<{
+        "repo-local": "repo-local";
+        "repo-scoped-remote": "repo-scoped-remote";
+        "shared-remote": "shared-remote";
+      }>;
+      required: z.ZodDefault<z.ZodBoolean>;
+      tool_prefixes: z.ZodArray<z.ZodString>;
+      workspace_path_source: z.ZodOptional<z.ZodEnum<{
+        PIPELINE_TARGET_PATH: "PIPELINE_TARGET_PATH";
+        cwd: "cwd";
+      }>>;
+    }, z.core.$strict>>>;
     default_profile: z.ZodOptional<z.ZodString>;
     mode: z.ZodEnum<{
       hosted: "hosted";
@@ -298,6 +317,7 @@ declare const configSchema: z.ZodObject<{
       implementation: "implementation";
     }>>>;
     skills: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    timeout_ms: z.ZodOptional<z.ZodNumber>;
     tools: z.ZodOptional<z.ZodArray<z.ZodEnum<{
       read: "read";
       list: "list";
@@ -322,6 +342,12 @@ declare const configSchema: z.ZodObject<{
         required: z.ZodDefault<z.ZodBoolean>;
       }, z.core.$strict>>>;
     }, z.core.$strict>>;
+    git: z.ZodDefault<z.ZodObject<{
+      committer: z.ZodDefault<z.ZodObject<{
+        email: z.ZodDefault<z.ZodString>;
+        name: z.ZodDefault<z.ZodString>;
+      }, z.core.$strict>>;
+    }, z.core.$strict>>;
   }, z.core.$strict>>;
   rules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     path: z.ZodString;
@@ -400,6 +426,8 @@ type HookEvent = (typeof HOOK_EVENTS)[number];
 type GateKind = (typeof GATE_KINDS)[number];
 type ScheduleBaseline = (typeof SCHEDULE_BASELINES)[number];
 type SchedulingRole = (typeof SCHEDULING_ROLES)[number];
+type McpGatewayBackendLocality = (typeof MCP_GATEWAY_BACKEND_LOCALITIES)[number];
+type McpGatewayWorkspacePathSource = (typeof MCP_GATEWAY_WORKSPACE_PATH_SOURCES)[number];
 interface PipelineConfigParts {
   pipeline: string;
   profiles: string;
@@ -409,9 +437,9 @@ interface PipelineConfigValidationOptions {
   allowMissingLintFileReferences?: boolean;
 }
 declare function loadPipelineConfig(projectRoot: string, options?: PipelineConfigValidationOptions): PipelineConfig;
-declare function tryLoadPipelineConfig(projectRoot: string, options?: PipelineConfigValidationOptions): PipelineConfig | null;
+declare function loadPackagePipelineConfig(projectRoot: string, options?: PipelineConfigValidationOptions): PipelineConfig;
 declare function parsePipelineConfigYaml(source: string, sourcePath?: string, projectRoot?: string): PipelineConfig;
 declare function parsePipelineConfigParts(sources: PipelineConfigParts, projectRoot?: string, sourcePaths?: PipelineConfigParts, options?: PipelineConfigValidationOptions): PipelineConfig;
 declare function validatePipelineConfig(rawConfig: PipelineConfig, projectRoot?: string, options?: PipelineConfigValidationOptions): PipelineConfig;
 //#endregion
-export { GateKind, HookEvent, PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, PipelineConfig, PipelineConfigError, PipelineConfigErrorCode, PipelineConfigIssue, PipelineConfigParts, PipelineConfigValidationOptions, RUNNERS_CONFIG_PATH, RunnerType, ScheduleBaseline, SchedulingRole, WorkflowNodeKind, loadPipelineConfig, parsePipelineConfigParts, parsePipelineConfigYaml, tryLoadPipelineConfig, validatePipelineConfig, workflowSchema };
+export { DEFAULT_RUNNER_JOB_GIT_COMMITTER, GateKind, HookEvent, McpGatewayBackendLocality, McpGatewayWorkspacePathSource, PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, PipelineConfig, PipelineConfigError, PipelineConfigErrorCode, PipelineConfigIssue, PipelineConfigParts, PipelineConfigValidationOptions, RUNNERS_CONFIG_PATH, RunnerType, ScheduleBaseline, SchedulingRole, WorkflowNodeKind, loadPackagePipelineConfig, loadPipelineConfig, parsePipelineConfigParts, parsePipelineConfigYaml, validatePipelineConfig, workflowSchema };

package/dist/config.js

@@ -1,13 +1,12 @@
 import { resolveFileReference } from "./path-refs.js";
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { standardOutputSchemaNameFromPath } from "./standard-output-schemas.js";
+import { existsSync } from "node:fs";
 import { parseDocument } from "yaml";
 import { z } from "zod";
 //#region src/config.ts
 const PIPELINE_CONFIG_PATH = ".pipeline/pipeline.yaml";
 const RUNNERS_CONFIG_PATH = ".pipeline/runners.yaml";
 const PROFILES_CONFIG_PATH = ".pipeline/profiles.yaml";
-const LEGACY_CONFIG_PATH = ".pipeline/config.toml";
 const ID_RE = /^[a-z][a-z0-9-]*$/;
 const RUNNER_TYPES = [
 	"codex",
@@ -56,7 +55,17 @@ const RETRY_REASONS = [
 ];
 const SCHEDULE_BASELINES = ["epic", "pipe"];
 const SCHEDULING_ROLES = ["coverage", "implementation"];
+const MCP_GATEWAY_BACKEND_LOCALITIES = [
+	"repo-local",
+	"repo-scoped-remote",
+	"shared-remote"
+];
+const MCP_GATEWAY_WORKSPACE_PATH_SOURCES = ["PIPELINE_TARGET_PATH", "cwd"];
 const PIPELINE_GATEWAY_SERVER_ID = "pipeline-gateway";
+const DEFAULT_RUNNER_JOB_GIT_COMMITTER = {
+	email: "git@oisin.ee",
+	name: "oisin-bot"
+};
 const PACKAGE_DEFAULT_RUNNERS_YAML = `version: 1
 runners:
   codex:
@@ -73,7 +82,7 @@ runners:
       output_formats: [text, json, jsonl, json_schema]
   opencode:
     type: opencode
-    model: default
+    model: openai/gpt-5.5
     capabilities:
       native_subagents: true
       rules: true
@@ -102,6 +111,29 @@ mcp_gateway:
   url_env: PIPELINE_MCP_GATEWAY_URL
   authorization_env: PIPELINE_MCP_GATEWAY_AUTHORIZATION
   default_profile: default
+  backends:
+    context7:
+      locality: shared-remote
+      tool_prefixes: [context7]
+    uidotsh:
+      locality: shared-remote
+      tool_prefixes: [uidotsh]
+    qdrant:
+      locality: repo-scoped-remote
+      tool_prefixes: [qdrant]
+    fallow:
+      locality: repo-local
+      workspace_path_source: PIPELINE_TARGET_PATH
+      required: false
+      tool_prefixes: [fallow]
+    serena:
+      locality: repo-local
+      workspace_path_source: PIPELINE_TARGET_PATH
+      tool_prefixes: [serena]
+    backlog:
+      locality: repo-local
+      workspace_path_source: PIPELINE_TARGET_PATH
+      tool_prefixes: [backlog]
 profiles:
   orchestrator:
     runner: codex
@@ -113,11 +145,16 @@ profiles:
   pipeline-researcher:
     runner: codex
     description: Research the requested task and produce structured findings.
-    instructions: { inline: "Inspect first-party source, tests, docs, and task context before proposing changes." }
+    instructions: { inline: "Inspect first-party source, tests, docs, and task context for the current task only. Produce concise findings with file references and stop; do not perform open-ended repository exploration." }
+    timeout_ms: 900000
     mcp_servers: [pipeline-gateway]
     tools: [read, list, grep, glob, bash]
     filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
     network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/research.schema.json
+      repair: { enabled: true, max_attempts: 1 }
   pipeline-inspector:
     runner: codex
     description: Inspect the repository without modifying files.
@@ -136,12 +173,17 @@ profiles:
     network: { mode: inherit }
   pipeline-test-writer:
     runner: codex
+    scheduling_roles: [implementation]
     description: Add focused failing tests for the requested behavior.
-    instructions: { inline: "Add focused failing tests for the requested behavior only. Do not change production code." }
+    instructions: { inline: "Add focused failing tests for the requested behavior only. Do not change production code. Return only valid JSON with top-level changes and verification. Every changes entry must include summary, why, and files. Include risks, followups, and lessons when present. Do not use Markdown fences or prose outside the JSON object." }
     mcp_servers: [pipeline-gateway]
     tools: [read, list, grep, glob, bash, edit, write]
     filesystem: { mode: workspace-write, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
     network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/implementation.schema.json
+      repair: { enabled: true, max_attempts: 1 }
   pipeline-epic-router:
     runner: codex
     description: Route epic sub-tickets into fixed implementation tracks.
@@ -154,20 +196,28 @@ profiles:
     runner: codex
     scheduling_roles: [implementation]
     description: Implement production code until the failing tests pass.
-    instructions: { inline: "Implement the smallest production change that satisfies the failing tests." }
+    instructions: { inline: "Implement the smallest production change that satisfies the failing tests. Return only valid JSON with top-level changes and verification. Every changes entry must include summary, why, and files. Include risks, followups, and lessons when present. Do not use Markdown fences or prose outside the JSON object." }
     mcp_servers: [pipeline-gateway]
     tools: [read, list, grep, glob, bash, edit, write]
     filesystem: { mode: workspace-write, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
     network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/implementation.schema.json
+      repair: { enabled: true, max_attempts: 1 }
   pipeline-acceptance-reviewer:
     runner: codex
     scheduling_roles: [coverage]
     description: Audit the finished change against every acceptance criterion.
-    instructions: { inline: "Audit the completed change against each canonical acceptance criterion independently." }
+    instructions: { inline: 'Audit the completed change against each canonical acceptance criterion independently. Return only valid JSON with top-level "verdict", "evidence", "acceptance", and optional "violations". Each "acceptance" entry must include "id", "verdict", and non-empty "evidence". Do not use Markdown fences or prose outside the JSON object.' }
     mcp_servers: [pipeline-gateway]
     tools: [read, list, grep, glob, bash]
     filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
     network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/acceptance.schema.json
+      repair: { enabled: true, max_attempts: 1 }
   pipeline-thermo-nuclear-reviewer:
     runner: codex
     scheduling_roles: [coverage]
@@ -177,15 +227,23 @@ profiles:
     tools: [read, list, grep, glob, bash]
     filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
     network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/review.schema.json
+      repair: { enabled: true, max_attempts: 1 }
   pipeline-verifier:
     runner: codex
     scheduling_roles: [coverage]
     description: Verify checks, implementation fit, and final evidence.
-    instructions: { inline: "Verify checks, implementation fit, and final evidence." }
+    instructions: { inline: 'Verify checks, implementation fit, and final evidence. Return only valid JSON with top-level "verdict", "evidence", and optional "violations". Do not use Markdown fences or prose outside the JSON object.' }
     mcp_servers: [pipeline-gateway]
     tools: [read, list, grep, glob, bash]
     filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
     network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/verify.schema.json
+      repair: { enabled: true, max_attempts: 1 }
   pipeline-learner:
     runner: codex
     description: Store durable lessons from the completed run.
@@ -194,6 +252,10 @@ profiles:
     tools: [read, list, grep, glob, bash]
     filesystem: { mode: read-only, allow: ["**/*"], deny: ["node_modules/**", "dist/**", ".git/**"] }
     network: { mode: inherit }
+    output:
+      format: json_schema
+      schema_path: .pipeline/schemas/learn.schema.json
+      repair: { enabled: true, max_attempts: 1 }
 `;
 const PACKAGE_DEFAULT_PIPELINE_YAML = `version: 1
 default_workflow: default
@@ -213,7 +275,7 @@ hooks:
   functions:
     generated-defaults-audit:
       kind: command
-      command: [node, -e, "process.exit(0)"]
+      command: [node, -e, "const fs=require('node:fs'); fs.writeFileSync(process.env.PIPELINE_HOOK_RESULT, JSON.stringify({status:'pass',summary:'Generated defaults audit passed'}));"]
       trusted: true
       timeout_ms: 5000
       output_limit_bytes: 4096
@@ -340,6 +402,10 @@ workflows:
         kind: agent
         profile: pipeline-thermo-nuclear-reviewer
         needs: [merge]
+        gates:
+          - id: review-verdict
+            kind: verdict
+            target: stdout
 `;
 var PipelineConfigError = class extends Error {
 	code;
@@ -412,7 +478,28 @@ const mcpServerSchema = z.object({
 		path: ["bearer_token_env_var"]
 	});
 });
+const mcpGatewayBackendSchema = z.object({
+	locality: z.enum(MCP_GATEWAY_BACKEND_LOCALITIES),
+	required: z.boolean().default(true),
+	tool_prefixes: z.array(z.string().min(1)).min(1),
+	workspace_path_source: z.enum(MCP_GATEWAY_WORKSPACE_PATH_SOURCES).optional()
+}).strict().superRefine((backend, ctx) => {
+	if (backend.locality === "repo-local") {
+		if (!backend.workspace_path_source) ctx.addIssue({
+			code: "custom",
+			message: "repo-local gateway backend must declare workspace_path_source as PIPELINE_TARGET_PATH or cwd",
+			path: ["workspace_path_source"]
+		});
+		return;
+	}
+	if (backend.workspace_path_source) ctx.addIssue({
+		code: "custom",
+		message: "workspace_path_source is only valid for repo-local gateway backends",
+		path: ["workspace_path_source"]
+	});
+});
 const mcpGatewaySchema = z.object({
+	backends: strictRecord(mcpGatewayBackendSchema).default({}),
 	default_profile: z.string().min(1).optional(),
 	mode: z.enum(["hosted", "local"]),
 	provider: z.literal("toolhive"),
@@ -515,6 +602,7 @@ const profileSchema = z.object({
 	runner: z.string(),
 	scheduling_roles: z.array(z.enum(SCHEDULING_ROLES)).optional(),
 	skills: z.array(z.string()).optional(),
+	timeout_ms: z.number().int().positive().optional(),
 	tools: z.array(z.enum(TOOL_NAMES)).optional()
 }).strict();
 const orchestratorSchema = z.object({ profile: z.string() }).strict();
@@ -654,10 +742,18 @@ const runnerJobEnvironmentSchema = z.object({
 	setup: z.array(runnerJobCommandSchema).default([]),
 	smoke: z.array(runnerJobCommandSchema).default([])
 }).strict();
-const runnerJobConfigSchema = z.object({ environment: runnerJobEnvironmentSchema.default({
-	setup: [],
-	smoke: []
-}) }).strict();
+const runnerJobGitCommitterSchema = z.object({
+	email: z.string().email().default(DEFAULT_RUNNER_JOB_GIT_COMMITTER.email),
+	name: z.string().min(1).default(DEFAULT_RUNNER_JOB_GIT_COMMITTER.name)
+}).strict();
+const runnerJobGitSchema = z.object({ committer: runnerJobGitCommitterSchema.default(DEFAULT_RUNNER_JOB_GIT_COMMITTER) }).strict();
+const runnerJobConfigSchema = z.object({
+	environment: runnerJobEnvironmentSchema.default({
+		setup: [],
+		smoke: []
+	}),
+	git: runnerJobGitSchema.default({ committer: DEFAULT_RUNNER_JOB_GIT_COMMITTER })
+}).strict();
 const runnersFileSchema = z.object({
 	runners: strictRecord(runnerSchema).default({}),
 	version: z.literal(1)
@@ -678,10 +774,13 @@ const pipelineFileSchema = z.object({
 		on: {}
 	}),
 	orchestrator: orchestratorSchema,
-	runner_job: runnerJobConfigSchema.default({ environment: {
-		setup: [],
-		smoke: []
-	} }),
+	runner_job: runnerJobConfigSchema.default({
+		environment: {
+			setup: [],
+			smoke: []
+		},
+		git: { committer: DEFAULT_RUNNER_JOB_GIT_COMMITTER }
+	}),
 	schedules: strictRecord(schedulePolicySchema).default({}),
 	task_context: taskContextResolverSchema.optional(),
 	workflows: strictRecord(workflowSchema).default({}),
@@ -698,10 +797,13 @@ const configSchema = z.object({
 	mcp_servers: strictRecord(mcpServerSchema).default({}),
 	orchestrator: orchestratorSchema,
 	profiles: strictRecord(profileSchema).default({}),
-	runner_job: runnerJobConfigSchema.default({ environment: {
-		setup: [],
-		smoke: []
-	} }),
+	runner_job: runnerJobConfigSchema.default({
+		environment: {
+			setup: [],
+			smoke: []
+		},
+		git: { committer: DEFAULT_RUNNER_JOB_GIT_COMMITTER }
+	}),
 	rules: strictRecord(pathRefSchema).default({}),
 	runners: strictRecord(runnerSchema).default({}),
 	schedules: strictRecord(schedulePolicySchema).default({}),
@@ -769,39 +871,18 @@ function addConfigSchemaIssue(ctx, path, message) {
 	});
 }
 function loadPipelineConfig(projectRoot, options = {}) {
-	const paths = [
-		PIPELINE_CONFIG_PATH,
-		PROFILES_CONFIG_PATH,
-		RUNNERS_CONFIG_PATH
-	];
-	const missing = paths.filter((path) => !existsSync(join(projectRoot, path)));
-	if (missing.length > 0) {
-		if (existsSync(join(projectRoot, LEGACY_CONFIG_PATH))) throw new PipelineConfigError("PIPELINE_CONFIG_LEGACY_UNSUPPORTED", `${LEGACY_CONFIG_PATH} is not supported by the v1 pipeline config. Create ${PIPELINE_CONFIG_PATH}.`, [{
-			path: LEGACY_CONFIG_PATH,
-			message: "legacy TOML config found"
-		}]);
-		if (missing.length === paths.length) return parsePipelineConfigParts({
-			pipeline: PACKAGE_DEFAULT_PIPELINE_YAML,
-			profiles: PACKAGE_DEFAULT_PROFILES_YAML,
-			runners: PACKAGE_DEFAULT_RUNNERS_YAML
-		}, projectRoot, {
-			pipeline: "@oisincoveney/pipeline/defaults/pipeline.yaml",
-			profiles: "@oisincoveney/pipeline/defaults/profiles.yaml",
-			runners: "@oisincoveney/pipeline/defaults/runners.yaml"
-		}, options);
-		throw new PipelineConfigError("PIPELINE_CONFIG_MISSING", `Missing required pipeline config files: ${missing.join(", ")}`, missing.map((path) => ({
-			path,
-			message: "file does not exist"
-		})));
-	}
-	return parsePipelineConfigParts({
-		pipeline: readFileSync(join(projectRoot, PIPELINE_CONFIG_PATH), "utf8"),
-		profiles: readFileSync(join(projectRoot, PROFILES_CONFIG_PATH), "utf8"),
-		runners: readFileSync(join(projectRoot, RUNNERS_CONFIG_PATH), "utf8")
-	}, projectRoot, void 0, options);
+	return loadPackagePipelineConfig(projectRoot, options);
 }
-function tryLoadPipelineConfig(projectRoot, options = {}) {
-	return loadPipelineConfig(projectRoot, options);
+function loadPackagePipelineConfig(projectRoot, options = {}) {
+	return parsePipelineConfigParts({
+		pipeline: PACKAGE_DEFAULT_PIPELINE_YAML,
+		profiles: PACKAGE_DEFAULT_PROFILES_YAML,
+		runners: PACKAGE_DEFAULT_RUNNERS_YAML
+	}, projectRoot, {
+		pipeline: "@oisincoveney/pipeline/defaults/pipeline.yaml",
+		profiles: "@oisincoveney/pipeline/defaults/profiles.yaml",
+		runners: "@oisincoveney/pipeline/defaults/runners.yaml"
+	}, options);
 }
 function parsePipelineConfigYaml(source, sourcePath = PIPELINE_CONFIG_PATH, projectRoot) {
 	return parsePipelineConfigParts({
@@ -946,10 +1027,13 @@ function validateActor(label, path, actor, runner, config, issues, projectRoot,
 	validatePath(`${path}.instructions.path`, actor.instructions.path, projectRoot, issues, options);
 	validateReferences(`${path}.rules`, actor.rules, config.rules, "rule", issues);
 	validateReferences(`${path}.skills`, actor.skills, config.skills, "skill", issues);
-	validateReferences(`${path}.mcp_servers`, actor.mcp_servers, config.mcp_gateway ? {
-		...config.mcp_servers,
-		[PIPELINE_GATEWAY_SERVER_ID]: {}
-	} : config.mcp_servers, "MCP server", issues);
+	validateReferences(`${path}.mcp_servers`, actor.mcp_servers, config.mcp_gateway ? { [PIPELINE_GATEWAY_SERVER_ID]: {} } : config.mcp_servers, "MCP server", issues);
+	if (config.mcp_gateway) {
+		for (const serverId of actor.mcp_servers ?? []) if (serverId !== PIPELINE_GATEWAY_SERVER_ID) issues.push({
+			path: `${path}.mcp_servers`,
+			message: `${path}.mcp_servers must only reference ${PIPELINE_GATEWAY_SERVER_ID} when mcp_gateway is configured`
+		});
+	}
 	validateBooleanCapability(`${path}.rules`, actor.rules, runner.capabilities.rules, "rules", issues);
 	validateBooleanCapability(`${path}.skills`, actor.skills, runner.capabilities.skills, "skills", issues);
 	validateBooleanCapability(`${path}.mcp_servers`, actor.mcp_servers, runner.capabilities.mcp_servers, "MCP servers", issues);
@@ -1048,6 +1132,7 @@ function validateListCapability(path, requested, supported, label, issues) {
 }
 function validatePath(path, value, projectRoot, issues, options = {}) {
 	if (!(value && projectRoot)) return;
+	if (standardOutputSchemaNameFromPath(value)) return;
 	if (!existsSync(resolveFileReference(projectRoot, value))) {
 		if (options.allowMissingLintFileReferences && isLintableMissingFileReferencePath(path)) return;
 		issues.push({
@@ -1066,4 +1151,4 @@ function validationError(issues) {
 	return new PipelineConfigError("PIPELINE_CONFIG_VALIDATION_ERROR", ["Invalid pipeline config:", ...issues.map((issue) => issue.path ? `- ${issue.path}: ${issue.message}` : `- ${issue.message}`)].join("\n"), issues);
 }
 //#endregion
-export { PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, PipelineConfigError, RUNNERS_CONFIG_PATH, loadPipelineConfig, parsePipelineConfigParts, parsePipelineConfigYaml, tryLoadPipelineConfig, validatePipelineConfig, workflowSchema };
+export { DEFAULT_RUNNER_JOB_GIT_COMMITTER, PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, PipelineConfigError, RUNNERS_CONFIG_PATH, loadPackagePipelineConfig, loadPipelineConfig, parsePipelineConfigParts, parsePipelineConfigYaml, validatePipelineConfig, workflowSchema };