@oisincoveney/pipeline 2.7.0 → 2.8.1

package/defaults/pipeline.yaml

@@ -2,6 +2,31 @@ version: 1
 default_workflow: inspect
 orchestrator:
   profile: moka-orchestrator
+# PIPE-83 architecture hardening — ON by default so moka actually uses it.
+# context_handoff: nodes pass curated NodeHandoffs downstream instead of raw
+# transitive transcripts (kills the re-hydration latency/quality leak).
+context_handoff:
+  enabled: true
+# repo_map: prepend a tree-sitter + PageRank ranked code map to agent prompts,
+# seeded by the node's task + handoff artifacts, within token_budget.
+repo_map:
+  enabled: true
+# durability: journal each terminal node result so a killed run resumes from the
+# last passed node without re-running (or re-spending tokens on) finished work.
+durability:
+  enabled: true
+# best_of_n / parallel_worktrees: the verifier-pattern dial. Schedule generation
+# + selection are validated/tested, BUT a live end-to-end run (2026-06-16) proved
+# the EXECUTION is not yet production-ready, so it stays OFF by default (on-by-
+# default made real runs hang). Two runtime gaps remain — see PIPE-83.14:
+#   1. The leased opencode server is rooted at the main worktree and throws
+#      "Unexpected server error" when a candidate session runs with directory set
+#      to its isolated worktree → candidates exit 70, retries exhaust, green loops.
+#      Fix: lease a per-worktree opencode server for each candidate.
+#   2. The winning candidate's file changes live in its worktree and are never
+#      merged back to the main tree, so downstream nodes wouldn't see them.
+# Enable explicitly (best_of_n.enabled + n:2 + categories:[green] + parallel_
+# worktrees.enabled) once those land; n=2 also ~doubles green-node spend.
 token_budget:
   default_context_window: 200000
   max_context_pct: 50

package/dist/argo-graph.js

@@ -1,5 +1,6 @@
 import { uniqueStrings } from "./strings.js";
 import { z } from "zod";
+import { Data } from "effect";
 //#region src/argo-graph.ts
 const argoExecutableTaskSchema = z.object({
 	dependencies: z.array(z.string().min(1)),
@@ -18,14 +19,13 @@ const argoExecutionGraphSchema = z.object({
 * lowered to an Argo DAG task. Callers should surface this as a validation
 * failure before attempting a cluster submission.
 */
-var ArgoGraphCompilerError = class extends Error {
-	kind;
-	nodeId;
+var ArgoGraphCompilerError = class extends Data.TaggedError("ArgoGraphCompilerError") {
 	constructor(kind, nodeId) {
-		super(`Argo graph compiler: node kind '${kind}' on node '${nodeId}' cannot be lowered to an Argo DAG task`);
-		this.name = "ArgoGraphCompilerError";
-		this.kind = kind;
-		this.nodeId = nodeId;
+		super({
+			kind,
+			nodeId,
+			message: `Argo graph compiler: node kind '${kind}' on node '${nodeId}' cannot be lowered to an Argo DAG task`
+		});
 	}
 };
 function compileArgoExecutionGraph(plan) {

package/dist/argo-submit.d.ts

@@ -1,7 +1,7 @@
 import { PipelineConfig } from "./config/schemas.js";
+import { CoreApi, KubernetesArgoIoDependencies, WorkflowApi } from "./runtime/services/kubernetes-argo-service.js";
 import { workflowSubmitResultSchema } from "./workflow-submit-contract.js";
 import { z } from "zod";
-import { CoreV1Api, CustomObjectsApi, KubeConfig } from "@kubernetes/client-node";
 
 //#region src/argo-submit.d.ts
 declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
@@ -36,11 +36,9 @@ type SubmitRunnerArgoWorkflowOptions = z.input<typeof submitRunnerArgoWorkflowOp
 };
 type SubmitRunnerArgoWorkflowResult = z.infer<typeof workflowSubmitResultSchema>;
 type CommandScheduleOptions = z.input<typeof commandScheduleOptionsSchema>;
-type CoreApi = Pick<CoreV1Api, "createNamespacedConfigMap">;
-type WorkflowApi = Pick<CustomObjectsApi, "createNamespacedCustomObject">;
 interface SubmitRunnerArgoWorkflowDependencies {
   coreApi?: CoreApi;
-  kubeConfig?: KubeConfig;
+  kubeConfig?: KubernetesArgoIoDependencies["kubeConfig"];
   workflowApi?: WorkflowApi;
 }
 declare function submitRunnerArgoWorkflow(rawOptions: SubmitRunnerArgoWorkflowOptions, dependencies?: SubmitRunnerArgoWorkflowDependencies): Promise<SubmitRunnerArgoWorkflowResult>;

package/dist/argo-submit.js

@@ -4,11 +4,12 @@ import { buildRunnerArgoWorkflowManifest, runnerArgoWorkflowManifestSchema } fro
 import { normalizeRunnerRepositoryForSubmit } from "./git-remote-url.js";
 import { compileScheduleArtifact, parseScheduleArtifact } from "./planning/generate.js";
 import { parseRunnerCommandPayload, runnerCommandPayloadSchema } from "./runner-command-contract.js";
+import { KubernetesArgoService, KubernetesArgoServiceLive } from "./runtime/services/kubernetes-argo-service.js";
 import { workflowSubmitResultSchema } from "./workflow-submit-contract.js";
 import { stringify } from "yaml";
 import { z } from "zod";
+import { Effect } from "effect";
 import { randomBytes } from "node:crypto";
-import { CoreV1Api, CustomObjectsApi, KubeConfig } from "@kubernetes/client-node";
 //#region src/argo-submit.ts
 const scheduleIdSchema = z.string().regex(/^[a-z][a-z0-9-]*$/);
 const configMapSchema = z.object({
@@ -48,7 +49,10 @@ const commandScheduleOptionsSchema = z.object({
 	scheduleId: scheduleIdSchema.optional(),
 	task: z.string().min(1)
 }).strict();
-async function submitRunnerArgoWorkflow(rawOptions, dependencies = {}) {
+function submitRunnerArgoWorkflow(rawOptions, dependencies = {}) {
+	return Effect.runPromise(Effect.provide(Effect.suspend(() => submitRunnerArgoWorkflowEffect(rawOptions, dependencies)), KubernetesArgoServiceLive));
+}
+function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 	const { config, ...schemaOptions } = rawOptions;
 	const options = submitRunnerArgoWorkflowOptionsSchema.parse(schemaOptions);
 	const { payload, payloadJson } = normalizeRunnerPayloadForSubmit({
@@ -60,7 +64,7 @@ async function submitRunnerArgoWorkflow(rawOptions, dependencies = {}) {
 	const scheduleArtifactConfigMapName = `pipeline-schedule-${randomBytes(6).toString("hex")}`;
 	const taskDescriptorConfigMapName = `pipeline-task-descriptors-${randomBytes(6).toString("hex")}`;
 	if (payload.workflow.id !== compiled.workflowId) throw new Error(`Runner payload workflow '${payload.workflow.id}' does not match schedule workflow '${compiled.workflowId}'`);
-	const graph = compileSubmitArgoGraph(compiled);
+	const graphEffect = compileSubmitArgoGraph(compiled).pipe(Effect.mapError((error) => /* @__PURE__ */ new Error(`Schedule '${compiled.workflowId}' cannot be submitted: ${error.message}`)));
 	const labels = {
 		"pipeline.oisin.dev/project": payload.run.project,
 		"pipeline.oisin.dev/run-id": payload.run.id,
@@ -91,64 +95,72 @@ async function submitRunnerArgoWorkflow(rawOptions, dependencies = {}) {
 		serviceAccountName: options.serviceAccountName,
 		taskDescriptorConfigMapName
 	});
-	const { coreApi, workflowApi } = apiClients(options, dependencies);
-	await coreApi.createNamespacedConfigMap({
-		body: configMapSchema.parse({
-			apiVersion: "v1",
-			data: { "payload.json": payloadJson },
-			kind: "ConfigMap",
-			metadata: {
-				labels,
-				name: payloadConfigMapName,
-				namespace: options.namespace
-			}
-		}),
-		namespace: options.namespace
-	});
-	await coreApi.createNamespacedConfigMap({
-		body: configMapSchema.parse({
-			apiVersion: "v1",
-			data: Object.fromEntries(graph.tasks.map((task) => [`${task.taskName}.json`, `${JSON.stringify(buildRunnerTaskDescriptor(task.nodeId))}\n`])),
-			kind: "ConfigMap",
-			metadata: {
-				labels,
-				name: taskDescriptorConfigMapName,
-				namespace: options.namespace
-			}
-		}),
-		namespace: options.namespace
-	});
-	await coreApi.createNamespacedConfigMap({
-		body: configMapSchema.parse({
-			apiVersion: "v1",
-			data: { "schedule.yaml": options.scheduleYaml },
-			kind: "ConfigMap",
-			metadata: {
-				labels,
-				name: scheduleArtifactConfigMapName,
-				namespace: options.namespace
-			}
-		}),
-		namespace: options.namespace
-	});
-	const response = await workflowApi.createNamespacedCustomObject({
-		body: runnerArgoWorkflowManifestSchema.parse(workflow),
-		group: "argoproj.io",
-		namespace: options.namespace,
-		plural: "workflows",
-		version: "v1alpha1"
-	});
-	const created = z.object({ metadata: z.object({
-		name: z.string().min(1).optional(),
-		uid: z.string().min(1).optional()
-	}).passthrough() }).passthrough().parse(response);
-	return workflowSubmitResultSchema.parse({
-		namespace: options.namespace,
-		payloadConfigMapName,
-		scheduleConfigMapName: scheduleArtifactConfigMapName,
-		taskDescriptorConfigMapName,
-		workflowName: created.metadata.name ?? workflow.metadata.name,
-		workflowUid: created.metadata.uid
+	return Effect.gen(function* () {
+		const service = yield* KubernetesArgoService;
+		const graph = yield* graphEffect;
+		yield* service.createConfigMap({
+			body: configMapSchema.parse({
+				apiVersion: "v1",
+				data: { "payload.json": payloadJson },
+				kind: "ConfigMap",
+				metadata: {
+					labels,
+					name: payloadConfigMapName,
+					namespace: options.namespace
+				}
+			}),
+			dependencies,
+			namespace: options.namespace,
+			options
+		});
+		yield* service.createConfigMap({
+			body: configMapSchema.parse({
+				apiVersion: "v1",
+				data: Object.fromEntries(graph.tasks.map((task) => [`${task.taskName}.json`, `${JSON.stringify(buildRunnerTaskDescriptor(task.nodeId))}\n`])),
+				kind: "ConfigMap",
+				metadata: {
+					labels,
+					name: taskDescriptorConfigMapName,
+					namespace: options.namespace
+				}
+			}),
+			dependencies,
+			namespace: options.namespace,
+			options
+		});
+		yield* service.createConfigMap({
+			body: configMapSchema.parse({
+				apiVersion: "v1",
+				data: { "schedule.yaml": options.scheduleYaml },
+				kind: "ConfigMap",
+				metadata: {
+					labels,
+					name: scheduleArtifactConfigMapName,
+					namespace: options.namespace
+				}
+			}),
+			dependencies,
+			namespace: options.namespace,
+			options
+		});
+		const response = yield* service.createWorkflow({
+			body: runnerArgoWorkflowManifestSchema.parse(workflow),
+			dependencies,
+			namespace: options.namespace,
+			options
+		});
+		const created = z.object({ metadata: z.object({
+			name: z.string().min(1).optional(),
+			uid: z.string().min(1).optional()
+		}).passthrough() }).passthrough().parse(response);
+		return workflowSubmitResultSchema.parse({
+			namespace: options.namespace,
+			payloadConfigMapName,
+			scheduleConfigMapName: scheduleArtifactConfigMapName,
+			taskDescriptorConfigMapName,
+			workflowName: created.metadata.name ?? workflow.metadata.name,
+			workflowUid: created.metadata.uid
+		});
 	});
 }
 function buildCommandScheduleYaml(rawOptions) {
@@ -182,25 +194,13 @@ function normalizeRunnerPayloadForSubmit(input) {
 	};
 }
 function compileSubmitArgoGraph(compiled) {
-	try {
-		return compileArgoExecutionGraph(compiled.plan);
-	} catch (err) {
-		if (err instanceof ArgoGraphCompilerError) throw new Error(`Schedule '${compiled.workflowId}' cannot be submitted: ${err.message}`);
-		throw err;
-	}
-}
-function apiClients(options, dependencies) {
-	if (dependencies.coreApi && dependencies.workflowApi) return {
-		coreApi: dependencies.coreApi,
-		workflowApi: dependencies.workflowApi
-	};
-	const kubeConfig = dependencies.kubeConfig ?? new KubeConfig();
-	if (!dependencies.kubeConfig) if (options.kubeconfigPath) kubeConfig.loadFromFile(options.kubeconfigPath);
-	else kubeConfig.loadFromDefault();
-	return {
-		coreApi: dependencies.coreApi ?? kubeConfig.makeApiClient(CoreV1Api),
-		workflowApi: dependencies.workflowApi ?? kubeConfig.makeApiClient(CustomObjectsApi)
-	};
+	return Effect.try({
+		try: () => compileArgoExecutionGraph(compiled.plan),
+		catch: (error) => {
+			if (error instanceof ArgoGraphCompilerError) return error;
+			throw error;
+		}
+	});
 }
 //#endregion
 export { buildCommandScheduleYaml, submitRunnerArgoWorkflow };

package/dist/bench/eval-report.js

@@ -0,0 +1,27 @@
+//#region src/bench/eval-report.ts
+function buildEvalReport(results) {
+	const variants = [...new Set(results.map((r) => r.variant))].sort();
+	return {
+		tasks: new Set(results.map((r) => r.task)).size,
+		variants: variants.map((variant) => summarizeVariant(variant, results.filter((r) => r.variant === variant)))
+	};
+}
+function summarizeVariant(variant, runs) {
+	const resolved = runs.filter((r) => r.resolved).length;
+	const totalWall = runs.reduce((sum, r) => sum + r.wallMs, 0);
+	return {
+		avgWallMs: runs.length ? Math.round(totalWall / runs.length) : 0,
+		count: runs.length,
+		resolutionRate: runs.length ? resolved / runs.length : 0,
+		resolved,
+		totalCostTokens: runs.reduce((sum, r) => sum + r.costTokens, 0),
+		variant
+	};
+}
+function renderEvalReport(report) {
+	const lines = [`Eval over ${report.tasks} task(s):`, "variant | resolved | rate | tokens | avg ms"];
+	for (const v of report.variants) lines.push(`${v.variant} | ${v.resolved}/${v.count} | ${(v.resolutionRate * 100).toFixed(0)}% | ${v.totalCostTokens} | ${v.avgWallMs}`);
+	return lines.join("\n");
+}
+//#endregion
+export { buildEvalReport, renderEvalReport };

package/dist/cli/program.js

@@ -7,8 +7,11 @@ import { compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifac
 import { loadMokaGlobalConfig } from "../moka-global-config.js";
 import { defaultClusterDoctorNamespace, runClusterDoctor } from "../cluster-doctor.js";
 import { formatCodexAuthSyncResult, syncLocalCodexAuth } from "../codex-auth-sync.js";
+import { registerBenchCommand } from "../commands/bench-command.js";
 import { registerConfiguredEntrypointCommands } from "../commands/pipeline-command.js";
 import { configureGatewayHosts, localGatewayStatus, reconcileGateway, renderGatewayConfig, runGatewayDoctor, startLocalGateway } from "../mcp/gateway.js";
+import { generateRuntimeRunId } from "../runtime/context/context.js";
+import "../runtime/context/index.js";
 import { runPipelineFromConfig } from "../pipeline-runtime.js";
 import { registerRunnerCommandCommand } from "../commands/runner-command-command.js";
 import { formatConfigLintWarning, lintPipelineConfig } from "../config/lint.js";
@@ -47,7 +50,14 @@ function quick(description, options = {}) {
 		entrypoint: "quick"
 	});
 }
-async function runConfiguredPipeline(inputs) {
+function withRunId(inputs) {
+	return {
+		...inputs,
+		runId: inputs.runId ?? generateRuntimeRunId()
+	};
+}
+async function runConfiguredPipeline(rawInputs) {
+	const inputs = withRunId(rawInputs);
 	const config = loadPipelineConfig(inputs.worktreePath, { allowMissingLintFileReferences: true });
 	if (inputs.schedule) {
 		const compiled = compileScheduleArtifact(config, parseScheduleArtifact(readFileSync(inputs.schedule, "utf8"), inputs.schedule), inputs.worktreePath);
@@ -70,6 +80,7 @@ async function runConfiguredPipeline(inputs) {
 		const result = await generateScheduleArtifact({
 			config,
 			entrypointId: scheduledEntrypoint,
+			runId: inputs.runId,
 			task: inputs.task,
 			worktreePath: inputs.worktreePath
 		});
@@ -94,6 +105,7 @@ async function runAndPrintPipeline(inputs) {
 		config: inputs.config,
 		reporter,
 		entrypoint: inputs.entrypoint,
+		runId: inputs.runId,
 		task: inputs.task,
 		workflowId: inputs.workflow,
 		worktreePath: inputs.worktreePath
@@ -177,8 +189,11 @@ function createCliProgram() {
 		const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
 		console.log(await localGatewayStatus(cwd));
 	});
-	program.command("init").description("Initialize package-owned pipeline support without repo-local config").action(async () => {
-		const result = await initPipelineProject({ cwd: process.env.PIPELINE_TARGET_PATH ?? process.cwd() });
+	program.command("init").description("Initialize package-owned pipeline support without repo-local config").addOption(new Option("--skill-scope <scope>", "where to install default skills: project (repo-local copy) or personal (one inherited user/global install)").choices(["project", "personal"]).default("project")).action(async (flags) => {
+		const result = await initPipelineProject({
+			cwd: process.env.PIPELINE_TARGET_PATH ?? process.cwd(),
+			scope: flags.skillScope
+		});
 		console.log(formatPipelineInitResult(result));
 	});
 	program.command("install-commands").description("Install generated slash-command adapters into this repository").addOption(new Option("--host <host>", "host command set to install").choices([
@@ -207,6 +222,7 @@ function createCliProgram() {
 		if (result.workflowUid) console.log(`Workflow UID: ${result.workflowUid}`);
 	});
 	registerRunnerCommandCommand(program);
+	registerBenchCommand(program);
 	const configuredEntrypointCommands = registerConfiguredEntrypointCommands(program, omitConfiguredEntrypoints(configuredPipeline, ["execute", "quick"]), async (entrypoint, task, _opts) => {
 		await execute(task, { entrypoint });
 	});

package/dist/cluster-doctor.js

@@ -1,5 +1,6 @@
+import { KubernetesArgoService, KubernetesArgoServiceLive } from "./runtime/services/kubernetes-argo-service.js";
 import { loadMokaGlobalConfig } from "./moka-global-config.js";
-import { execa } from "execa";
+import { Effect } from "effect";
 //#region src/cluster-doctor.ts
 const DEFAULT_NAMESPACE = "momokaya-pipeline";
 const DEFAULT_RESOURCES = {
@@ -13,41 +14,46 @@ const DEFAULT_RESOURCES = {
 	serviceAccountName: "pipeline-runner"
 };
 const FORBIDDEN_RE = /forbidden/i;
-async function runClusterDoctor(options = {}) {
+function runClusterDoctor(options = {}) {
+	return Effect.runPromise(Effect.provide(Effect.suspend(() => runClusterDoctorEffect(options)), KubernetesArgoServiceLive));
+}
+function runClusterDoctorEffect(options = {}) {
 	const resources = clusterResources();
 	const namespace = options.namespace ?? DEFAULT_NAMESPACE;
 	const kubectlOptions = {
 		kubeContext: options.kubeContext,
 		kubeconfigPath: options.kubeconfigPath
 	};
-	const checks = await Promise.all([
-		checkKubectlNamespace(namespace, kubectlOptions),
-		...secretChecks(namespace, kubectlOptions, resources),
-		checkExternalSecret(namespace, resources.eventAuthExternalSecretName, resources.externalSecretRemoteRef, kubectlOptions),
-		checkClusterSecretStore("openbao", kubectlOptions),
-		checkServiceAccount(namespace, resources.serviceAccountName, kubectlOptions),
-		checkWorkflowSubmitPermission(namespace, {
-			resource: "workflows.argoproj.io",
-			verb: "create",
-			...kubectlOptions
-		}),
-		checkClusterResource("argo-workflow-crd", [
-			"get",
-			"crd",
-			"workflows.argoproj.io"
-		], kubectlOptions),
-		checkClusterResource("argo-workflow-controller", [
-			"get",
-			"pods",
-			"-A",
-			"-l",
-			"app=workflow-controller"
-		], kubectlOptions)
-	]);
-	return {
-		checks,
-		passed: checks.every((check) => check.passed)
-	};
+	return Effect.gen(function* () {
+		const checks = yield* Effect.all([
+			checkKubectlNamespace(namespace, kubectlOptions),
+			...secretChecks(namespace, kubectlOptions, resources),
+			checkExternalSecret(namespace, resources.eventAuthExternalSecretName, resources.externalSecretRemoteRef, kubectlOptions),
+			checkClusterSecretStore("openbao", kubectlOptions),
+			checkServiceAccount(namespace, resources.serviceAccountName, kubectlOptions),
+			checkWorkflowSubmitPermission(namespace, {
+				resource: "workflows.argoproj.io",
+				verb: "create",
+				...kubectlOptions
+			}),
+			checkClusterResource("argo-workflow-crd", [
+				"get",
+				"crd",
+				"workflows.argoproj.io"
+			], kubectlOptions),
+			checkClusterResource("argo-workflow-controller", [
+				"get",
+				"pods",
+				"-A",
+				"-l",
+				"app=workflow-controller"
+			], kubectlOptions)
+		], { concurrency: "unbounded" });
+		return {
+			checks,
+			passed: checks.every((check) => check.passed)
+		};
+	});
 }
 function defaultClusterDoctorNamespace() {
 	return DEFAULT_NAMESPACE;
@@ -89,9 +95,8 @@ function checkKubectlNamespace(namespace, kubectlOptions) {
 		namespace
 	], `Namespace ${namespace} missing or inaccessible.`, kubectlOptions);
 }
-async function checkNamespacedResource(name, args, missingDetail, kubectlOptions) {
-	const result = await kubectl(args, kubectlOptions);
-	return result.ok ? {
+function checkNamespacedResource(name, args, missingDetail, kubectlOptions) {
+	return kubectl(args, kubectlOptions).pipe(Effect.map((result) => result.ok ? {
 		detail: "present",
 		name,
 		passed: true
@@ -99,10 +104,10 @@ async function checkNamespacedResource(name, args, missingDetail, kubectlOptions
 		detail: inaccessibleOrMissingDetail(name, missingDetail, result),
 		name,
 		passed: false
-	};
+	}));
 }
-async function checkExternalSecret(namespace, name, remoteRef, kubectlOptions) {
-	const result = await kubectl([
+function checkExternalSecret(namespace, name, remoteRef, kubectlOptions) {
+	return kubectl([
 		"get",
 		"externalsecret",
 		name,
@@ -110,34 +115,36 @@ async function checkExternalSecret(namespace, name, remoteRef, kubectlOptions) {
 		namespace,
 		"-o",
 		"json"
-	], kubectlOptions);
-	if (!result.ok) {
-		const missingDetail = `ExternalSecret ${name} missing in ${namespace}; expected it to sync ${remoteRef}.`;
-		return {
-			detail: inaccessibleOrMissingDetail(`externalsecret/${name}`, missingDetail, result),
-			name: `externalsecret/${name}`,
-			passed: false
-		};
-	}
-	return readyConditionCheck(`externalsecret/${name}`, result.stdout);
-}
-async function checkClusterSecretStore(name, kubectlOptions) {
-	const result = await kubectl([
+	], kubectlOptions).pipe(Effect.map((result) => {
+		if (!result.ok) {
+			const missingDetail = `ExternalSecret ${name} missing in ${namespace}; expected it to sync ${remoteRef}.`;
+			return {
+				detail: inaccessibleOrMissingDetail(`externalsecret/${name}`, missingDetail, result),
+				name: `externalsecret/${name}`,
+				passed: false
+			};
+		}
+		return readyConditionCheck(`externalsecret/${name}`, result.stdout);
+	}));
+}
+function checkClusterSecretStore(name, kubectlOptions) {
+	return kubectl([
 		"get",
 		"clustersecretstore",
 		name,
 		"-o",
 		"json"
-	], kubectlOptions);
-	if (!result.ok) {
-		const missingDetail = `ClusterSecretStore/${name} missing or inaccessible; OpenBao/ESO readiness is an external prerequisite.`;
-		return {
-			detail: inaccessibleOrMissingDetail(`clustersecretstore/${name}`, missingDetail, result),
-			name: `clustersecretstore/${name}`,
-			passed: false
-		};
-	}
-	return readyConditionCheck(`clustersecretstore/${name}`, result.stdout);
+	], kubectlOptions).pipe(Effect.map((result) => {
+		if (!result.ok) {
+			const missingDetail = `ClusterSecretStore/${name} missing or inaccessible; OpenBao/ESO readiness is an external prerequisite.`;
+			return {
+				detail: inaccessibleOrMissingDetail(`clustersecretstore/${name}`, missingDetail, result),
+				name: `clustersecretstore/${name}`,
+				passed: false
+			};
+		}
+		return readyConditionCheck(`clustersecretstore/${name}`, result.stdout);
+	}));
 }
 function checkServiceAccount(namespace, name, kubectlOptions) {
 	return checkNamespacedResource(`serviceaccount/${name}`, [
@@ -148,15 +155,15 @@ function checkServiceAccount(namespace, name, kubectlOptions) {
 		namespace
 	], `ServiceAccount ${name} missing in ${namespace}; runner pods must use this account for workflow execution.`, kubectlOptions);
 }
-async function checkWorkflowSubmitPermission(namespace, options) {
-	return (await kubectl([
+function checkWorkflowSubmitPermission(namespace, options) {
+	return kubectl([
 		"auth",
 		"can-i",
 		options.verb,
 		options.resource,
 		"-n",
 		namespace
-	], options)).stdout.trim() === "yes" ? {
+	], options).pipe(Effect.map((result) => result.stdout.trim() === "yes" ? {
 		detail: `current kube identity can ${options.verb} ${options.resource}`,
 		name: "rbac/workflow-create",
 		passed: true
@@ -164,11 +171,10 @@ async function checkWorkflowSubmitPermission(namespace, options) {
 		detail: `current kube identity cannot ${options.verb} ${options.resource}; check submitter RBAC for Workflow creation.`,
 		name: "rbac/workflow-create",
 		passed: false
-	};
+	}));
 }
-async function checkClusterResource(name, args, kubectlOptions) {
-	const result = await kubectl(args, kubectlOptions);
-	return result.ok ? {
+function checkClusterResource(name, args, kubectlOptions) {
+	return kubectl(args, kubectlOptions).pipe(Effect.map((result) => result.ok ? {
 		detail: "present",
 		name,
 		passed: true
@@ -176,46 +182,28 @@ async function checkClusterResource(name, args, kubectlOptions) {
 		detail: isForbidden(result) ? inaccessibleDetail(name, result) : result.stderr || "missing or inaccessible",
 		name,
 		passed: false
-	};
+	}));
+}
+function findReadyCondition(source) {
+	return parseJson(source).status?.conditions?.find((condition) => condition.type === "Ready");
+}
+function readyDetail(ready, passed) {
+	const fallback = passed ? "Ready=True" : "Ready condition is missing or not True";
+	return ready?.message || fallback;
 }
 function readyConditionCheck(name, source) {
-	const ready = parseJson(source).status?.conditions?.find((condition) => condition.type === "Ready");
-	return ready?.status === "True" ? {
-		detail: ready.message || "Ready=True",
-		name,
-		passed: true
-	} : {
-		detail: ready?.message || "Ready condition is missing or not True",
+	const ready = findReadyCondition(source);
+	const passed = ready?.status === "True";
+	return {
+		detail: readyDetail(ready, passed),
 		name,
-		passed: false
+		passed
 	};
 }
-async function kubectl(args, options) {
-	try {
-		const result = await execa("kubectl", kubectlArgs(args, options.kubeContext), {
-			env: options.kubeconfigPath ? { KUBECONFIG: options.kubeconfigPath } : void 0,
-			stdin: "ignore"
-		});
-		return {
-			ok: true,
-			stderr: result.stderr,
-			stdout: result.stdout
-		};
-	} catch (err) {
-		const error = err;
-		return {
-			ok: false,
-			stderr: (error.stderr || error.shortMessage || "kubectl failed").trim(),
-			stdout: (error.stdout || "").trim()
-		};
-	}
-}
-function kubectlArgs(args, kubeContext) {
-	return kubeContext ? [
-		"--context",
-		kubeContext,
-		...args
-	] : args;
+function kubectl(args, options) {
+	return Effect.gen(function* () {
+		return yield* (yield* KubernetesArgoService).kubectl(args, options);
+	});
 }
 function inaccessibleOrMissingDetail(name, missingDetail, result) {
 	return isForbidden(result) ? inaccessibleDetail(name, result) : missingDetail;

package/dist/commands/bench-command.js

@@ -0,0 +1,18 @@
+import { buildEvalReport, renderEvalReport } from "../bench/eval-report.js";
+import { readFileSync } from "node:fs";
+//#region src/commands/bench-command.ts
+/**
+* PIPE-83.6: `moka bench` — score a flat single-agent baseline vs the pipeline
+* (and ablations) over a recorded run set. Runs are produced by executing the
+* bench task set (bench/tasks) through `moka run` for each variant and recording
+* one EvalRunResult per task+variant; this command turns those records into the
+* comparison report.
+*/
+function registerBenchCommand(program) {
+	program.command("bench").description("Score a flat single-agent baseline vs the pipeline over recorded bench runs").requiredOption("--results <path>", "JSON file: array of { task, variant, resolved, costTokens, wallMs }").action((options) => {
+		const records = JSON.parse(readFileSync(options.results, "utf8"));
+		process.stdout.write(`${renderEvalReport(buildEvalReport(records))}\n`);
+	});
+}
+//#endregion
+export { registerBenchCommand };