@oisincoveney/pipeline 3.15.2 → 3.15.4

package/defaults/profiles.yaml

@@ -155,7 +155,7 @@ profiles:
     scheduling_roles: [implementation]
     description: Add focused failing tests for the requested behavior.
     timeout_ms: 900000
-    instructions: { inline: "Add focused failing tests for the requested behavior only. Do not change production code. Only edit files matching test paths such as **/*.test.*, **/*.spec.*, **/*_test.*, **/__tests__/**, test/**, or tests/**. NEVER silence lint, type, complexity, or dead-code findings with suppression comments (no // fallow-ignore, // biome-ignore, eslint-disable, oxlint-disable, @ts-ignore, or @ts-expect-error); fix the underlying cause — if a gate flags your test, restructure the test (e.g. move restricted imports into shared support/fixture helpers) rather than suppressing it. Return only valid JSON with top-level changes and verification. Every changes entry must include summary, why, and files. Include risks, followups, and lessons when present. Do not use Markdown fences or prose outside the JSON object." }
+    instructions: { inline: "This scheduled node is already dispatched by Moka; do direct repository work inside the current workspace. Do not invoke `moka run`, `moka submit`, `$dispatch`, `$scope`, `$execute`, or any nested Moka/workflow supervisor from this node. Add focused failing tests for the requested behavior only. Do not change production code. Only edit files matching test paths such as **/*.test.*, **/*.spec.*, **/*_test.*, **/__tests__/**, test/**, or tests/**. Tool findings about lint, types, complexity, or dead code must be resolved at source; comments must not hide them. If a gate flags your test, restructure the test (e.g. move restricted imports into shared support/fixture helpers). Return only valid JSON with top-level changes and verification. Every changes entry must include summary, why, and files. Include risks, followups, and lessons when present. Do not use Markdown fences or prose outside the JSON object." }
     skills: [test]
     mcp_servers: [pipeline-gateway]
     tools: [read, list, grep, glob, bash, edit, write]
@@ -170,7 +170,7 @@ profiles:
     scheduling_roles: [implementation]
     description: Implement production code until the failing tests pass.
     timeout_ms: 900000
-    instructions: { inline: "Implement the smallest production change that satisfies the failing tests. NEVER silence lint, type, complexity, or dead-code findings with suppression comments (no // fallow-ignore, // biome-ignore, eslint-disable, oxlint-disable, @ts-ignore, or @ts-expect-error); fix the underlying cause — reduce complexity by extracting helpers, remove genuinely dead code, and migrate off deprecated APIs rather than suppressing the warning. Return only valid JSON with top-level changes and verification. Every changes entry must include summary, why, and files. Include risks, followups, and lessons when present. Do not use Markdown fences or prose outside the JSON object." }
+    instructions: { inline: "This scheduled node is already dispatched by Moka; do direct repository work inside the current workspace. Do not invoke `moka run`, `moka submit`, `$dispatch`, `$scope`, `$execute`, or any nested Moka/workflow supervisor from this node. Implement the smallest production change that makes the failing tests pass. Tool findings about lint, types, complexity, or dead code must be resolved at source; comments must not hide them. Reduce complexity by extracting helpers, remove genuinely dead code, and migrate off deprecated APIs rather than hiding the warning. Return only valid JSON with top-level changes and verification. Every changes entry must include summary, why, and files. Include risks, followups, and lessons when present. Do not use Markdown fences or prose outside the JSON object." }
     skills: [trace, test, fix, library-first-development]
     mcp_servers: [pipeline-gateway]
     tools: [read, list, grep, glob, bash, edit, write]

package/dist/argo-graph.js

@@ -1,8 +1,8 @@
 import { uniqueStrings } from "./strings.js";
 import { resolveExecutableDependencyIds } from "./planning/dependency-refs.js";
 import { terminalDependencyItems } from "./planning/graph.js";
-import { z } from "zod";
 import { Data } from "effect";
+import { z } from "zod";
 //#region src/argo-graph.ts
 const argoExecutableTaskSchema = z.object({
 	dependencies: z.array(z.string().min(1)),

package/dist/argo-submit.js

@@ -1,5 +1,5 @@
 import { ArgoGraphCompilerError, compileArgoExecutionGraph } from "./argo-graph.js";
-import { brokerAuthOptionSchema } from "./broker-auth.js";
+import { brokerAuthOptionSchema } from "./credentials/broker.js";
 import { compileScheduleArtifact, parseScheduleArtifact } from "./planning/generate.js";
 import { parseRunnerCommandPayload, runnerCommandPayloadSchema } from "./runner-command-contract.js";
 import { buildRunnerTaskDescriptor } from "./runner-command/task-descriptor.js";
@@ -8,8 +8,8 @@ import { normalizeRunnerRepositoryForSubmit } from "./git-remote-url.js";
 import { KubernetesArgoService, KubernetesArgoServiceLive } from "./runtime/services/kubernetes-argo-service.js";
 import { workflowSubmitResultSchema } from "./workflow-submit-contract.js";
 import { stringify } from "yaml";
-import { z } from "zod";
 import { Effect } from "effect";
+import { z } from "zod";
 import { randomBytes } from "node:crypto";
 //#region src/argo-submit.ts
 const scheduleIdSchema = z.string().regex(/^[a-z][a-z0-9-]*$/);

package/dist/argo-workflow.d.ts

@@ -1,4 +1,5 @@
 import { WorkflowExecutionPlan } from "./planning/compile.js";
+import { buildRunnerArgoWorkflowOptionsSchema } from "./remote/argo/model.js";
 import { z } from "zod";
 
 //#region src/argo-workflow.d.ts
@@ -59,7 +60,6 @@ declare const runnerArgoWorkflowManifestSchema: z.ZodObject<{
       }, z.core.$strict>>;
       dag: z.ZodOptional<z.ZodObject<{
         tasks: z.ZodArray<z.ZodObject<{
-          dependencies: z.ZodOptional<z.ZodArray<z.ZodString>>;
           arguments: z.ZodOptional<z.ZodObject<{
             artifacts: z.ZodOptional<z.ZodArray<z.ZodObject<{
               from: z.ZodOptional<z.ZodString>;
@@ -67,6 +67,7 @@ declare const runnerArgoWorkflowManifestSchema: z.ZodObject<{
               path: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>>;
           }, z.core.$strict>>;
+          dependencies: z.ZodOptional<z.ZodArray<z.ZodString>>;
           name: z.ZodString;
           template: z.ZodString;
         }, z.core.$strict>>;
@@ -127,45 +128,6 @@ declare const runnerArgoWorkflowManifestSchema: z.ZodObject<{
     }, z.core.$strict>>;
   }, z.core.$strict>;
 }, z.core.$strict>;
-declare const buildRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
-  activeDeadlineSeconds: z.ZodOptional<z.ZodNumber>;
-  eventAuthSecretKey: z.ZodOptional<z.ZodString>;
-  eventAuthSecretName: z.ZodOptional<z.ZodString>;
-  generateName: z.ZodOptional<z.ZodString>;
-  gitCredentialsSecretName: z.ZodOptional<z.ZodString>;
-  githubAuthSecretName: z.ZodOptional<z.ZodString>;
-  annotations: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>>;
-  image: z.ZodDefault<z.ZodString>;
-  imagePullPolicy: z.ZodDefault<z.ZodEnum<{
-    Always: "Always";
-    IfNotPresent: "IfNotPresent";
-    Never: "Never";
-  }>>;
-  imagePullSecretName: z.ZodOptional<z.ZodString>;
-  labels: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>>;
-  name: z.ZodOptional<z.ZodString>;
-  namespace: z.ZodString;
-  brokerAuth: z.ZodObject<{
-    secretKey: z.ZodDefault<z.ZodString>;
-    secretName: z.ZodString;
-    url: z.ZodDefault<z.ZodString>;
-  }, z.core.$strict>;
-  payloadConfigMapKey: z.ZodDefault<z.ZodString>;
-  payloadConfigMapName: z.ZodString;
-  resources: z.ZodOptional<z.ZodObject<{
-    limits: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    requests: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-  }, z.core.$strict>>;
-  scheduleConfigMapKey: z.ZodDefault<z.ZodString>;
-  scheduleConfigMapName: z.ZodString;
-  serviceAccountName: z.ZodDefault<z.ZodString>;
-  taskDescriptorConfigMapName: z.ZodString;
-  ttlStrategy: z.ZodOptional<z.ZodObject<{
-    secondsAfterCompletion: z.ZodOptional<z.ZodNumber>;
-    secondsAfterFailure: z.ZodOptional<z.ZodNumber>;
-    secondsAfterSuccess: z.ZodOptional<z.ZodNumber>;
-  }, z.core.$strict>>;
-}, z.core.$strict>;
 type ArgoWorkflowManifest = z.infer<typeof runnerArgoWorkflowManifestSchema>;
 type BuildRunnerArgoWorkflowOptions = z.input<typeof buildRunnerArgoWorkflowOptionsSchema> & {
   plan: WorkflowExecutionPlan;

package/dist/argo-workflow.js

@@ -1,457 +1,76 @@
 import { compileArgoExecutionGraph } from "./argo-graph.js";
-import { DEFAULT_RUNNER_TASK_DESCRIPTOR_PATH } from "./runner-command/task-descriptor.js";
+import { RUNNER_WORKFLOW_ENTRYPOINT, RUNNER_WORKFLOW_START_TASK } from "./remote/argo/policy.js";
+import { buildRunnerArgoWorkflowOptionsSchema, createRunnerArgoWorkflowManifestSchema } from "./remote/argo/model.js";
+import { runnerWorkflowStorage } from "./remote/argo/storage.js";
+import { runnerCommandTemplate, runnerFinalizerTemplate, runnerLifecycleTemplate } from "./remote/argo/templates.js";
 import { stringify } from "yaml";
-import { z } from "zod";
 //#region src/argo-workflow.ts
-const ARGO_WORKFLOW_API_VERSION = "argoproj.io/v1alpha1";
-const ARGO_WORKFLOW_KIND = "Workflow";
-const RUNNER_WORKFLOW_IMAGE = "ghcr.io/oisin-ee/pipeline-runner:latest";
-const RUNNER_WORKFLOW_SERVICE_ACCOUNT = "pipeline-runner";
-const RUNNER_WORKFLOW_ENTRYPOINT = "pipeline";
-const RUNNER_WORKFLOW_START_TASK = "workflow-start";
-const RUNNER_WORKFLOW_PAYLOAD_PATH = "/etc/pipeline/payload.json";
-const RUNNER_WORKFLOW_SCHEDULE_PATH = "/etc/pipeline/schedule.yaml";
-const RUNNER_GIT_CREDENTIALS_PATH = "/etc/pipeline/git-credentials";
-const RUNNER_RETRY_STRATEGY = {
-	expression: "lastRetry.status == 'Error' || (lastRetry.exitCode != '0' && lastRetry.exitCode != '1')",
-	limit: "3",
-	retryPolicy: "Always"
-};
-const RUNNER_OPENCODE_ENV = [
-	{
-		name: "CODEX_AUTH_PER_PROJECT_ACCOUNTS",
-		value: "0"
-	},
-	{
-		name: "PIPELINE_AGENT_TIMEOUT_MS",
-		value: "600000"
-	},
-	{
-		name: "PIPELINE_AGENT_IDLE_TIMEOUT_MS",
-		value: "180000"
-	},
-	{
-		name: "PIPELINE_DISABLED_MODELS",
-		value: "opencode-go/qwen3.7-max"
-	}
-];
-const DEFAULT_RUNNER_RESOURCES = {
-	limits: {
-		cpu: "4",
-		memory: "12Gi"
-	},
-	requests: {
-		cpu: "1",
-		memory: "5Gi"
-	}
-};
-const DEFAULT_RUNNER_DEADLINE_SECONDS = 5400;
-const kubernetesNameSchema = z.string().min(1);
-const labelValueSchema = z.string().min(1);
-const stringMapSchema = z.record(z.string().min(1), z.string().min(1));
-const configMapVolumeSchema = z.object({
-	items: z.array(z.object({
-		key: z.string().min(1),
-		path: z.string().min(1)
-	}).strict()),
-	name: kubernetesNameSchema
-}).strict();
-const secretVolumeSchema = z.object({
-	defaultMode: z.number().int().positive().optional(),
-	items: z.array(z.object({
-		key: z.string().min(1),
-		path: z.string().min(1)
-	}).strict()).optional(),
-	optional: z.boolean().optional(),
-	secretName: kubernetesNameSchema
-}).strict();
-const argoWorkflowVolumeSchema = z.object({
-	configMap: configMapVolumeSchema.optional(),
-	name: kubernetesNameSchema,
-	secret: secretVolumeSchema.optional()
-}).strict().refine((volume) => volume.configMap !== void 0 || volume.secret !== void 0, { message: "Workflow volumes must declare configMap or secret" });
-const argoWorkflowVolumeMountSchema = z.object({
-	mountPath: z.string().min(1),
-	name: kubernetesNameSchema,
-	readOnly: z.boolean().optional(),
-	subPath: z.string().min(1).optional()
-}).strict();
-const argoWorkflowResourceRequirementsSchema = z.object({
-	limits: stringMapSchema.optional(),
-	requests: stringMapSchema.optional()
-}).strict();
-const argoWorkflowArtifactSchema = z.object({
-	from: z.string().min(1).optional(),
-	name: z.string().min(1),
-	path: z.string().min(1).optional()
-}).strict();
-const argoWorkflowRetryStrategySchema = z.object({
-	expression: z.string().min(1).optional(),
-	limit: z.string().min(1).optional(),
-	retryPolicy: z.enum([
-		"Always",
-		"OnError",
-		"OnFailure",
-		"OnTransientError"
-	])
-}).strict();
-const argoWorkflowEnvVarSchema = z.union([z.object({
-	name: z.string().min(1),
-	value: z.string()
-}).strict(), z.object({
-	name: z.string().min(1),
-	valueFrom: z.object({ secretKeyRef: z.object({
-		key: z.string().min(1),
-		name: kubernetesNameSchema
-	}).strict() }).strict()
-}).strict()]);
-const argoWorkflowTemplateSchema = z.object({
-	container: z.object({
-		args: z.array(z.string().min(1)).min(1),
-		command: z.array(z.string().min(1)).min(1).optional(),
-		env: z.array(argoWorkflowEnvVarSchema).optional(),
-		image: z.string().min(1),
-		imagePullPolicy: z.enum([
-			"Always",
-			"IfNotPresent",
-			"Never"
-		]),
-		name: z.string().min(1).optional(),
-		resources: argoWorkflowResourceRequirementsSchema.optional(),
-		volumeMounts: z.array(argoWorkflowVolumeMountSchema)
-	}).strict().optional(),
-	dag: z.object({ tasks: z.array(z.object({
-		dependencies: z.array(z.string().min(1)).optional(),
-		arguments: z.object({ artifacts: z.array(argoWorkflowArtifactSchema).optional() }).strict().optional(),
-		name: z.string().min(1),
-		template: z.string().min(1)
-	}).strict()).min(1) }).strict().optional(),
-	inputs: z.object({
-		artifacts: z.array(argoWorkflowArtifactSchema).optional(),
-		parameters: z.array(z.object({ name: z.string().min(1) }).strict()).optional()
-	}).strict().optional(),
-	outputs: z.object({ artifacts: z.array(argoWorkflowArtifactSchema) }).strict().optional(),
-	activeDeadlineSeconds: z.number().int().positive().optional(),
-	name: z.string().min(1),
-	retryStrategy: argoWorkflowRetryStrategySchema.optional()
-}).strict().refine((template) => template.container !== void 0 || template.dag !== void 0, { message: "Workflow templates must declare container or dag" });
-const runnerArgoWorkflowManifestSchema = z.object({
-	apiVersion: z.literal(ARGO_WORKFLOW_API_VERSION),
-	kind: z.literal(ARGO_WORKFLOW_KIND),
-	metadata: z.object({
-		annotations: z.record(z.string().min(1), z.string().min(1)).optional(),
-		generateName: z.string().min(1).optional(),
-		labels: z.record(z.string().min(1), labelValueSchema).optional(),
-		name: z.string().min(1).optional(),
-		namespace: kubernetesNameSchema
-	}).strict().refine((metadata) => metadata.name !== void 0 || metadata.generateName !== void 0, { message: "Workflow metadata must declare name or generateName" }),
-	spec: z.object({
-		activeDeadlineSeconds: z.number().int().positive().optional(),
-		entrypoint: z.literal(RUNNER_WORKFLOW_ENTRYPOINT),
-		imagePullSecrets: z.array(z.object({ name: kubernetesNameSchema }).strict()).optional(),
-		podMetadata: z.object({ labels: z.record(z.string().min(1), labelValueSchema).optional() }).strict().optional(),
-		serviceAccountName: kubernetesNameSchema,
-		onExit: z.string().min(1).optional(),
-		templates: z.array(argoWorkflowTemplateSchema).min(2),
-		ttlStrategy: z.object({
-			secondsAfterCompletion: z.number().int().positive().optional(),
-			secondsAfterFailure: z.number().int().positive().optional(),
-			secondsAfterSuccess: z.number().int().positive().optional()
-		}).strict().optional(),
-		volumes: z.array(argoWorkflowVolumeSchema).min(1)
-	}).strict()
-}).strict();
-const buildRunnerArgoWorkflowOptionsSchema = z.object({
-	activeDeadlineSeconds: z.number().int().positive().optional(),
-	eventAuthSecretKey: z.string().min(1).optional(),
-	eventAuthSecretName: kubernetesNameSchema.optional(),
-	generateName: z.string().min(1).optional(),
-	gitCredentialsSecretName: kubernetesNameSchema.optional(),
-	githubAuthSecretName: kubernetesNameSchema.optional(),
-	annotations: z.record(z.string().min(1), z.string().min(1).optional()).default({}),
-	image: z.string().min(1).default(RUNNER_WORKFLOW_IMAGE),
-	imagePullPolicy: z.enum([
-		"Always",
-		"IfNotPresent",
-		"Never"
-	]).default("Always"),
-	imagePullSecretName: kubernetesNameSchema.optional(),
-	labels: z.record(z.string().min(1), z.string().min(1).optional()).default({}),
-	name: z.string().min(1).optional(),
-	namespace: kubernetesNameSchema,
-	brokerAuth: z.object({
-		secretKey: z.string().min(1).default("api-key"),
-		secretName: kubernetesNameSchema,
-		url: z.string().min(1).default("https://cliproxy.momokaya.ee")
-	}).strict(),
-	payloadConfigMapKey: z.string().min(1).default("payload.json"),
-	payloadConfigMapName: kubernetesNameSchema,
-	resources: argoWorkflowResourceRequirementsSchema.optional(),
-	scheduleConfigMapKey: z.string().min(1).default("schedule.yaml"),
-	scheduleConfigMapName: kubernetesNameSchema,
-	serviceAccountName: kubernetesNameSchema.default(RUNNER_WORKFLOW_SERVICE_ACCOUNT),
-	taskDescriptorConfigMapName: kubernetesNameSchema,
-	ttlStrategy: z.object({
-		secondsAfterCompletion: z.number().int().positive().optional(),
-		secondsAfterFailure: z.number().int().positive().optional(),
-		secondsAfterSuccess: z.number().int().positive().optional()
-	}).strict().optional()
-}).strict().refine((options) => options.name !== void 0 || options.generateName !== void 0, { message: "Runner Workflow options must declare name or generateName" });
+const runnerArgoWorkflowManifestSchema = createRunnerArgoWorkflowManifestSchema();
 function buildRunnerArgoWorkflowManifest(rawOptions) {
-	const { plan, ...schemaOptions } = rawOptions;
-	const options = {
-		...buildRunnerArgoWorkflowOptionsSchema.parse(schemaOptions),
-		plan
-	};
-	const graph = compileArgoExecutionGraph(plan);
-	const { volumeMounts, volumes } = runnerWorkflowStorage(options, graph.tasks);
+	const options = parsedBuildOptions(rawOptions);
+	const graph = compileArgoExecutionGraph(options.plan);
+	const storage = runnerWorkflowStorage(options, graph.tasks);
 	return runnerArgoWorkflowManifestSchema.parse({
-		apiVersion: ARGO_WORKFLOW_API_VERSION,
-		kind: ARGO_WORKFLOW_KIND,
-		metadata: {
-			annotations: compactRecord(options.annotations),
-			...options.name ? { name: options.name } : {},
-			...options.generateName ? { generateName: options.generateName } : {},
-			labels: compactRecord({
-				"pipeline.oisin.dev/source": "argo-workflow",
-				"pipeline.oisin.dev/workflow": plan.workflowId,
-				...options.labels
-			}),
-			namespace: options.namespace
-		},
-		spec: {
-			...options.activeDeadlineSeconds ? { activeDeadlineSeconds: options.activeDeadlineSeconds } : {},
-			entrypoint: RUNNER_WORKFLOW_ENTRYPOINT,
-			...options.imagePullSecretName ? { imagePullSecrets: [{ name: options.imagePullSecretName }] } : {},
-			onExit: "pipeline-finalizer",
-			serviceAccountName: options.serviceAccountName,
-			templates: [
-				{
-					dag: { tasks: [{
-						name: RUNNER_WORKFLOW_START_TASK,
-						template: RUNNER_WORKFLOW_START_TASK
-					}, ...graph.tasks.map((task) => ({
-						dependencies: [RUNNER_WORKFLOW_START_TASK, ...task.dependencies],
-						name: task.taskName,
-						template: task.templateName
-					}))] },
-					name: RUNNER_WORKFLOW_ENTRYPOINT
-				},
-				runnerLifecycleTemplate(options, volumeMounts),
-				...graph.tasks.map((task) => runnerCommandTemplate(task, options, volumeMounts)),
-				runnerFinalizerTemplate(options, volumeMounts)
-			],
-			...options.ttlStrategy ? { ttlStrategy: options.ttlStrategy } : {},
-			volumes
-		}
+		apiVersion: "argoproj.io/v1alpha1",
+		kind: "Workflow",
+		metadata: workflowMetadata(options),
+		spec: workflowSpec(options, graph.tasks, storage)
 	});
 }
 function stringifyRunnerArgoWorkflow(workflow) {
 	return stringify(runnerArgoWorkflowManifestSchema.parse(workflow));
 }
-function runnerWorkflowStorage(options, tasks) {
-	const volumes = [
-		{
-			configMap: {
-				items: [{
-					key: options.payloadConfigMapKey,
-					path: "payload.json"
-				}],
-				name: options.payloadConfigMapName
-			},
-			name: "runner-payload"
-		},
-		{
-			configMap: {
-				items: [{
-					key: options.scheduleConfigMapKey,
-					path: "schedule.yaml"
-				}],
-				name: options.scheduleConfigMapName
-			},
-			name: "runner-schedule"
-		},
-		{
-			configMap: {
-				items: tasks.map((task) => ({
-					key: `${task.taskName}.json`,
-					path: `${task.taskName}.json`
-				})),
-				name: options.taskDescriptorConfigMapName
-			},
-			name: "runner-task-descriptor"
-		}
-	];
-	const volumeMounts = [{
-		mountPath: RUNNER_WORKFLOW_PAYLOAD_PATH,
-		name: "runner-payload",
-		readOnly: true,
-		subPath: "payload.json"
-	}, {
-		mountPath: RUNNER_WORKFLOW_SCHEDULE_PATH,
-		name: "runner-schedule",
-		readOnly: true,
-		subPath: "schedule.yaml"
-	}];
-	if (options.eventAuthSecretName) {
-		volumes.push({
-			name: "runner-event-auth",
-			secret: {
-				...options.eventAuthSecretKey ? { items: [{
-					key: options.eventAuthSecretKey,
-					path: options.eventAuthSecretKey
-				}] } : {},
-				secretName: options.eventAuthSecretName
-			}
-		});
-		volumeMounts.push({
-			mountPath: "/etc/pipeline/event-auth",
-			name: "runner-event-auth",
-			readOnly: true
-		});
-	}
-	if (options.gitCredentialsSecretName) {
-		volumes.push({
-			name: "runner-git-credentials",
-			secret: {
-				defaultMode: 256,
-				secretName: options.gitCredentialsSecretName
-			}
-		});
-		volumeMounts.push({
-			mountPath: RUNNER_GIT_CREDENTIALS_PATH,
-			name: "runner-git-credentials",
-			readOnly: true
-		});
-	}
-	if (options.githubAuthSecretName) {
-		volumes.push({
-			name: "github-auth",
-			secret: {
-				items: [{
-					key: "hosts.yml",
-					path: "hosts.yml"
-				}],
-				secretName: options.githubAuthSecretName
-			}
-		});
-		volumeMounts.push({
-			mountPath: "/root/.config/gh/hosts.yml",
-			name: "github-auth",
-			readOnly: true,
-			subPath: "hosts.yml"
-		});
-	}
+function parsedBuildOptions(rawOptions) {
+	const { plan, ...schemaOptions } = rawOptions;
 	return {
-		volumeMounts: z.array(argoWorkflowVolumeMountSchema).parse(volumeMounts),
-		volumes: z.array(argoWorkflowVolumeSchema).parse(volumes)
+		...buildRunnerArgoWorkflowOptionsSchema.parse(schemaOptions),
+		plan
 	};
 }
-/**
-* The runner container env: static opencode/agent tuning plus BROKER_URL
-* (literal) and BROKER_API_KEY (sourced from the broker secret key, never
-* inlined into the manifest).
-*/
-function runnerContainerEnv(options) {
-	return [
-		...RUNNER_OPENCODE_ENV,
-		{
-			name: "BROKER_URL",
-			value: options.brokerAuth.url
-		},
-		{
-			name: "PIPELINE_BROKER_SECRET_NAME",
-			value: options.brokerAuth.secretName
-		},
-		{
-			name: "PIPELINE_BROKER_SECRET_KEY",
-			value: options.brokerAuth.secretKey
-		},
-		{
-			name: "BROKER_API_KEY",
-			valueFrom: { secretKeyRef: {
-				key: options.brokerAuth.secretKey,
-				name: options.brokerAuth.secretName
-			} }
-		}
-	];
-}
-function runnerLifecycleTemplate(options, volumeMounts) {
+function workflowMetadata(options) {
 	return {
-		container: {
-			args: [
-				"runner-lifecycle",
-				"--phase",
-				"workflow.start",
-				"--payload-file",
-				RUNNER_WORKFLOW_PAYLOAD_PATH,
-				"--schedule-file",
-				RUNNER_WORKFLOW_SCHEDULE_PATH
-			],
-			command: ["moka"],
-			env: runnerContainerEnv(options),
-			image: options.image,
-			imagePullPolicy: options.imagePullPolicy,
-			name: "runner",
-			resources: options.resources ?? DEFAULT_RUNNER_RESOURCES,
-			volumeMounts
-		},
-		name: RUNNER_WORKFLOW_START_TASK,
-		retryStrategy: { ...RUNNER_RETRY_STRATEGY },
-		activeDeadlineSeconds: DEFAULT_RUNNER_DEADLINE_SECONDS
+		annotations: compactRecord(options.annotations),
+		...options.name ? { name: options.name } : {},
+		...options.generateName ? { generateName: options.generateName } : {},
+		labels: compactRecord({
+			"pipeline.oisin.dev/source": "argo-workflow",
+			"pipeline.oisin.dev/workflow": options.plan.workflowId,
+			...options.labels
+		}),
+		namespace: options.namespace
 	};
 }
-function runnerCommandTemplate(task, options, volumeMounts) {
-	const taskVolumeMount = {
-		mountPath: DEFAULT_RUNNER_TASK_DESCRIPTOR_PATH,
-		name: "runner-task-descriptor",
-		readOnly: true,
-		subPath: `${task.taskName}.json`
-	};
+function workflowSpec(options, tasks, storage) {
 	return {
-		container: {
-			args: [
-				"runner-command",
-				"--payload-file",
-				RUNNER_WORKFLOW_PAYLOAD_PATH,
-				"--schedule-file",
-				RUNNER_WORKFLOW_SCHEDULE_PATH
-			],
-			command: ["moka"],
-			env: runnerContainerEnv(options),
-			image: options.image,
-			imagePullPolicy: options.imagePullPolicy,
-			name: "runner",
-			resources: options.resources ?? DEFAULT_RUNNER_RESOURCES,
-			volumeMounts: [...volumeMounts, taskVolumeMount]
-		},
-		name: task.templateName,
-		retryStrategy: { ...RUNNER_RETRY_STRATEGY },
-		activeDeadlineSeconds: DEFAULT_RUNNER_DEADLINE_SECONDS
+		...options.activeDeadlineSeconds ? { activeDeadlineSeconds: options.activeDeadlineSeconds } : {},
+		entrypoint: RUNNER_WORKFLOW_ENTRYPOINT,
+		...options.imagePullSecretName ? { imagePullSecrets: [{ name: options.imagePullSecretName }] } : {},
+		serviceAccountName: options.serviceAccountName,
+		onExit: "pipeline-finalizer",
+		templates: workflowTemplates(options, tasks, storage.volumeMounts),
+		...options.ttlStrategy ? { ttlStrategy: options.ttlStrategy } : {},
+		volumes: storage.volumes
 	};
 }
-function runnerFinalizerTemplate(options, volumeMounts) {
+function workflowTemplates(options, tasks, volumeMounts) {
+	return [
+		workflowDagTemplate(tasks),
+		runnerLifecycleTemplate(options, volumeMounts),
+		...tasks.map((task) => runnerCommandTemplate(task, options, volumeMounts)),
+		runnerFinalizerTemplate(options, volumeMounts)
+	];
+}
+function workflowDagTemplate(tasks) {
 	return {
-		container: {
-			args: [
-				"runner-finalize",
-				"--payload-file",
-				RUNNER_WORKFLOW_PAYLOAD_PATH,
-				"--schedule-file",
-				RUNNER_WORKFLOW_SCHEDULE_PATH,
-				"--argo-status",
-				"{{workflow.status}}"
-			],
-			command: ["moka"],
-			env: runnerContainerEnv(options),
-			image: options.image,
-			imagePullPolicy: options.imagePullPolicy,
-			name: "runner",
-			resources: options.resources ?? DEFAULT_RUNNER_RESOURCES,
-			volumeMounts
-		},
-		name: "pipeline-finalizer",
-		activeDeadlineSeconds: DEFAULT_RUNNER_DEADLINE_SECONDS
+		dag: { tasks: [{
+			name: RUNNER_WORKFLOW_START_TASK,
+			template: RUNNER_WORKFLOW_START_TASK
+		}, ...tasks.map((task) => ({
+			dependencies: [RUNNER_WORKFLOW_START_TASK, ...task.dependencies],
+			name: task.taskName,
+			template: task.templateName
+		}))] },
+		name: RUNNER_WORKFLOW_ENTRYPOINT
 	};
 }
 function compactRecord(input) {

package/dist/cli/bootstrap-commands.js

@@ -0,0 +1,34 @@
+import { formatCodexAuthSyncResult, syncLocalCodexAuth } from "../credentials/local-codex-auth-sync.js";
+import { formatPipelineInitResult, initPipelineProject } from "../pipeline-init.js";
+import { runDoctor } from "./doctor.js";
+import { formatDoctorResult } from "./format.js";
+import { resolve } from "node:path";
+//#region src/cli/bootstrap-commands.ts
+function registerBootstrapCommands(program) {
+	program.command("doctor").description("Check local prerequisites for pipeline init and execution").option("--cluster [namespace]", "also check runner-job Kubernetes prerequisites").option("--json", "print machine-readable readiness results").option("--kube-context <context>", "kubectl context for cluster checks").option("--kubeconfig <path>", "kubeconfig path for cluster checks").action(async (flags) => {
+		const result = await runDoctor(process.env.PIPELINE_TARGET_PATH ?? process.cwd(), flags);
+		console.log(flags.json ? JSON.stringify(result) : formatDoctorResult(result));
+		if (!result.passed) throw new Error("Doctor checks failed.");
+	});
+	program.command("init").description("Install or refresh package-owned pipeline support: per-machine harness (skills + slash-command adapters + agent hooks + global instruction files) installed globally to ~/.claude, ~/.config/opencode, ~/.codex with no repo-local config").option("--check", "verify the generated harness is current; fail if stale").option("--dry-run", "show planned changes without writing files").option("--force", "overwrite manually edited harness files").action(async (flags) => {
+		const result = await initPipelineProject({
+			...flags,
+			cwd: process.env.PIPELINE_TARGET_PATH ?? process.cwd()
+		});
+		console.log(formatPipelineInitResult(result, {
+			check: flags.check,
+			dryRun: flags.dryRun
+		}));
+	});
+	program.command("codex-auth").description("Manage local Codex broker auth integration").command("sync-local").description("Point local dev repos' opencode openai provider at the central CLIProxyAPI broker").option("--root <path>", "directory containing repositories to sync").option("--dry-run", "show planned changes without writing files").option("--check", "fail if local Codex auth config is not synced").action((flags) => {
+		const result = syncLocalCodexAuth({
+			check: flags.check,
+			dryRun: flags.dryRun,
+			root: resolve(flags.root ?? process.env.PIPELINE_TARGET_PATH ?? process.cwd())
+		});
+		console.log(formatCodexAuthSyncResult(result));
+		if (!result.ok) process.exitCode = 1;
+	});
+}
+//#endregion
+export { registerBootstrapCommands };