@oisincoveney/pipeline 3.15.3 → 3.15.4

package/defaults/profiles.yaml

@@ -155,7 +155,7 @@ profiles:
     scheduling_roles: [implementation]
     description: Add focused failing tests for the requested behavior.
     timeout_ms: 900000
-    instructions: { inline: "Add focused failing tests for the requested behavior only. Do not change production code. Only edit files matching test paths such as **/*.test.*, **/*.spec.*, **/*_test.*, **/__tests__/**, test/**, or tests/**. NEVER silence lint, type, complexity, or dead-code findings with suppression comments (no // fallow-ignore, // biome-ignore, eslint-disable, oxlint-disable, @ts-ignore, or @ts-expect-error); fix the underlying cause — if a gate flags your test, restructure the test (e.g. move restricted imports into shared support/fixture helpers) rather than suppressing it. Return only valid JSON with top-level changes and verification. Every changes entry must include summary, why, and files. Include risks, followups, and lessons when present. Do not use Markdown fences or prose outside the JSON object." }
+    instructions: { inline: "This scheduled node is already dispatched by Moka; do direct repository work inside the current workspace. Do not invoke `moka run`, `moka submit`, `$dispatch`, `$scope`, `$execute`, or any nested Moka/workflow supervisor from this node. Add focused failing tests for the requested behavior only. Do not change production code. Only edit files matching test paths such as **/*.test.*, **/*.spec.*, **/*_test.*, **/__tests__/**, test/**, or tests/**. Tool findings about lint, types, complexity, or dead code must be resolved at source; comments must not hide them. If a gate flags your test, restructure the test (e.g. move restricted imports into shared support/fixture helpers). Return only valid JSON with top-level changes and verification. Every changes entry must include summary, why, and files. Include risks, followups, and lessons when present. Do not use Markdown fences or prose outside the JSON object." }
     skills: [test]
     mcp_servers: [pipeline-gateway]
     tools: [read, list, grep, glob, bash, edit, write]
@@ -170,7 +170,7 @@ profiles:
     scheduling_roles: [implementation]
     description: Implement production code until the failing tests pass.
     timeout_ms: 900000
-    instructions: { inline: "Implement the smallest production change that satisfies the failing tests. NEVER silence lint, type, complexity, or dead-code findings with suppression comments (no // fallow-ignore, // biome-ignore, eslint-disable, oxlint-disable, @ts-ignore, or @ts-expect-error); fix the underlying cause — reduce complexity by extracting helpers, remove genuinely dead code, and migrate off deprecated APIs rather than suppressing the warning. Return only valid JSON with top-level changes and verification. Every changes entry must include summary, why, and files. Include risks, followups, and lessons when present. Do not use Markdown fences or prose outside the JSON object." }
+    instructions: { inline: "This scheduled node is already dispatched by Moka; do direct repository work inside the current workspace. Do not invoke `moka run`, `moka submit`, `$dispatch`, `$scope`, `$execute`, or any nested Moka/workflow supervisor from this node. Implement the smallest production change that makes the failing tests pass. Tool findings about lint, types, complexity, or dead code must be resolved at source; comments must not hide them. Reduce complexity by extracting helpers, remove genuinely dead code, and migrate off deprecated APIs rather than hiding the warning. Return only valid JSON with top-level changes and verification. Every changes entry must include summary, why, and files. Include risks, followups, and lessons when present. Do not use Markdown fences or prose outside the JSON object." }
     skills: [trace, test, fix, library-first-development]
     mcp_servers: [pipeline-gateway]
     tools: [read, list, grep, glob, bash, edit, write]

package/dist/argo-graph.js

@@ -1,8 +1,8 @@
 import { uniqueStrings } from "./strings.js";
 import { resolveExecutableDependencyIds } from "./planning/dependency-refs.js";
 import { terminalDependencyItems } from "./planning/graph.js";
-import { z } from "zod";
 import { Data } from "effect";
+import { z } from "zod";
 //#region src/argo-graph.ts
 const argoExecutableTaskSchema = z.object({
 	dependencies: z.array(z.string().min(1)),

package/dist/argo-submit.js

@@ -8,8 +8,8 @@ import { normalizeRunnerRepositoryForSubmit } from "./git-remote-url.js";
 import { KubernetesArgoService, KubernetesArgoServiceLive } from "./runtime/services/kubernetes-argo-service.js";
 import { workflowSubmitResultSchema } from "./workflow-submit-contract.js";
 import { stringify } from "yaml";
-import { z } from "zod";
 import { Effect } from "effect";
+import { z } from "zod";
 import { randomBytes } from "node:crypto";
 //#region src/argo-submit.ts
 const scheduleIdSchema = z.string().regex(/^[a-z][a-z0-9-]*$/);

package/dist/argo-workflow.d.ts

@@ -1,4 +1,5 @@
 import { WorkflowExecutionPlan } from "./planning/compile.js";
+import { buildRunnerArgoWorkflowOptionsSchema } from "./remote/argo/model.js";
 import { z } from "zod";
 
 //#region src/argo-workflow.d.ts
@@ -59,7 +60,6 @@ declare const runnerArgoWorkflowManifestSchema: z.ZodObject<{
       }, z.core.$strict>>;
       dag: z.ZodOptional<z.ZodObject<{
         tasks: z.ZodArray<z.ZodObject<{
-          dependencies: z.ZodOptional<z.ZodArray<z.ZodString>>;
           arguments: z.ZodOptional<z.ZodObject<{
             artifacts: z.ZodOptional<z.ZodArray<z.ZodObject<{
               from: z.ZodOptional<z.ZodString>;
@@ -67,6 +67,7 @@ declare const runnerArgoWorkflowManifestSchema: z.ZodObject<{
               path: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>>;
           }, z.core.$strict>>;
+          dependencies: z.ZodOptional<z.ZodArray<z.ZodString>>;
           name: z.ZodString;
           template: z.ZodString;
         }, z.core.$strict>>;
@@ -127,45 +128,6 @@ declare const runnerArgoWorkflowManifestSchema: z.ZodObject<{
     }, z.core.$strict>>;
   }, z.core.$strict>;
 }, z.core.$strict>;
-declare const buildRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
-  activeDeadlineSeconds: z.ZodOptional<z.ZodNumber>;
-  eventAuthSecretKey: z.ZodOptional<z.ZodString>;
-  eventAuthSecretName: z.ZodOptional<z.ZodString>;
-  generateName: z.ZodOptional<z.ZodString>;
-  gitCredentialsSecretName: z.ZodOptional<z.ZodString>;
-  githubAuthSecretName: z.ZodOptional<z.ZodString>;
-  annotations: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>>;
-  image: z.ZodDefault<z.ZodString>;
-  imagePullPolicy: z.ZodDefault<z.ZodEnum<{
-    Always: "Always";
-    IfNotPresent: "IfNotPresent";
-    Never: "Never";
-  }>>;
-  imagePullSecretName: z.ZodOptional<z.ZodString>;
-  labels: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodString>>>;
-  name: z.ZodOptional<z.ZodString>;
-  namespace: z.ZodString;
-  brokerAuth: z.ZodObject<{
-    secretKey: z.ZodDefault<z.ZodString>;
-    secretName: z.ZodString;
-    url: z.ZodDefault<z.ZodString>;
-  }, z.core.$strict>;
-  payloadConfigMapKey: z.ZodDefault<z.ZodString>;
-  payloadConfigMapName: z.ZodString;
-  resources: z.ZodOptional<z.ZodObject<{
-    limits: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    requests: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-  }, z.core.$strict>>;
-  scheduleConfigMapKey: z.ZodDefault<z.ZodString>;
-  scheduleConfigMapName: z.ZodString;
-  serviceAccountName: z.ZodDefault<z.ZodString>;
-  taskDescriptorConfigMapName: z.ZodString;
-  ttlStrategy: z.ZodOptional<z.ZodObject<{
-    secondsAfterCompletion: z.ZodOptional<z.ZodNumber>;
-    secondsAfterFailure: z.ZodOptional<z.ZodNumber>;
-    secondsAfterSuccess: z.ZodOptional<z.ZodNumber>;
-  }, z.core.$strict>>;
-}, z.core.$strict>;
 type ArgoWorkflowManifest = z.infer<typeof runnerArgoWorkflowManifestSchema>;
 type BuildRunnerArgoWorkflowOptions = z.input<typeof buildRunnerArgoWorkflowOptionsSchema> & {
   plan: WorkflowExecutionPlan;

package/dist/argo-workflow.js

@@ -1,457 +1,76 @@
 import { compileArgoExecutionGraph } from "./argo-graph.js";
-import { DEFAULT_RUNNER_TASK_DESCRIPTOR_PATH } from "./runner-command/task-descriptor.js";
+import { RUNNER_WORKFLOW_ENTRYPOINT, RUNNER_WORKFLOW_START_TASK } from "./remote/argo/policy.js";
+import { buildRunnerArgoWorkflowOptionsSchema, createRunnerArgoWorkflowManifestSchema } from "./remote/argo/model.js";
+import { runnerWorkflowStorage } from "./remote/argo/storage.js";
+import { runnerCommandTemplate, runnerFinalizerTemplate, runnerLifecycleTemplate } from "./remote/argo/templates.js";
 import { stringify } from "yaml";
-import { z } from "zod";
 //#region src/argo-workflow.ts
-const ARGO_WORKFLOW_API_VERSION = "argoproj.io/v1alpha1";
-const ARGO_WORKFLOW_KIND = "Workflow";
-const RUNNER_WORKFLOW_IMAGE = "ghcr.io/oisin-ee/pipeline-runner:latest";
-const RUNNER_WORKFLOW_SERVICE_ACCOUNT = "pipeline-runner";
-const RUNNER_WORKFLOW_ENTRYPOINT = "pipeline";
-const RUNNER_WORKFLOW_START_TASK = "workflow-start";
-const RUNNER_WORKFLOW_PAYLOAD_PATH = "/etc/pipeline/payload.json";
-const RUNNER_WORKFLOW_SCHEDULE_PATH = "/etc/pipeline/schedule.yaml";
-const RUNNER_GIT_CREDENTIALS_PATH = "/etc/pipeline/git-credentials";
-const RUNNER_RETRY_STRATEGY = {
-	expression: "lastRetry.status == 'Error' || (lastRetry.exitCode != '0' && lastRetry.exitCode != '1')",
-	limit: "3",
-	retryPolicy: "Always"
-};
-const RUNNER_OPENCODE_ENV = [
-	{
-		name: "CODEX_AUTH_PER_PROJECT_ACCOUNTS",
-		value: "0"
-	},
-	{
-		name: "PIPELINE_AGENT_TIMEOUT_MS",
-		value: "600000"
-	},
-	{
-		name: "PIPELINE_AGENT_IDLE_TIMEOUT_MS",
-		value: "180000"
-	},
-	{
-		name: "PIPELINE_DISABLED_MODELS",
-		value: "opencode-go/qwen3.7-max"
-	}
-];
-const DEFAULT_RUNNER_RESOURCES = {
-	limits: {
-		cpu: "4",
-		memory: "12Gi"
-	},
-	requests: {
-		cpu: "1",
-		memory: "5Gi"
-	}
-};
-const DEFAULT_RUNNER_DEADLINE_SECONDS = 5400;
-const kubernetesNameSchema = z.string().min(1);
-const labelValueSchema = z.string().min(1);
-const stringMapSchema = z.record(z.string().min(1), z.string().min(1));
-const configMapVolumeSchema = z.object({
-	items: z.array(z.object({
-		key: z.string().min(1),
-		path: z.string().min(1)
-	}).strict()),
-	name: kubernetesNameSchema
-}).strict();
-const secretVolumeSchema = z.object({
-	defaultMode: z.number().int().positive().optional(),
-	items: z.array(z.object({
-		key: z.string().min(1),
-		path: z.string().min(1)
-	}).strict()).optional(),
-	optional: z.boolean().optional(),
-	secretName: kubernetesNameSchema
-}).strict();
-const argoWorkflowVolumeSchema = z.object({
-	configMap: configMapVolumeSchema.optional(),
-	name: kubernetesNameSchema,
-	secret: secretVolumeSchema.optional()
-}).strict().refine((volume) => volume.configMap !== void 0 || volume.secret !== void 0, { message: "Workflow volumes must declare configMap or secret" });
-const argoWorkflowVolumeMountSchema = z.object({
-	mountPath: z.string().min(1),
-	name: kubernetesNameSchema,
-	readOnly: z.boolean().optional(),
-	subPath: z.string().min(1).optional()
-}).strict();
-const argoWorkflowResourceRequirementsSchema = z.object({
-	limits: stringMapSchema.optional(),
-	requests: stringMapSchema.optional()
-}).strict();
-const argoWorkflowArtifactSchema = z.object({
-	from: z.string().min(1).optional(),
-	name: z.string().min(1),
-	path: z.string().min(1).optional()
-}).strict();
-const argoWorkflowRetryStrategySchema = z.object({
-	expression: z.string().min(1).optional(),
-	limit: z.string().min(1).optional(),
-	retryPolicy: z.enum([
-		"Always",
-		"OnError",
-		"OnFailure",
-		"OnTransientError"
-	])
-}).strict();
-const argoWorkflowEnvVarSchema = z.union([z.object({
-	name: z.string().min(1),
-	value: z.string()
-}).strict(), z.object({
-	name: z.string().min(1),
-	valueFrom: z.object({ secretKeyRef: z.object({
-		key: z.string().min(1),
-		name: kubernetesNameSchema
-	}).strict() }).strict()
-}).strict()]);
-const argoWorkflowTemplateSchema = z.object({
-	container: z.object({
-		args: z.array(z.string().min(1)).min(1),
-		command: z.array(z.string().min(1)).min(1).optional(),
-		env: z.array(argoWorkflowEnvVarSchema).optional(),
-		image: z.string().min(1),
-		imagePullPolicy: z.enum([
-			"Always",
-			"IfNotPresent",
-			"Never"
-		]),
-		name: z.string().min(1).optional(),
-		resources: argoWorkflowResourceRequirementsSchema.optional(),
-		volumeMounts: z.array(argoWorkflowVolumeMountSchema)
-	}).strict().optional(),
-	dag: z.object({ tasks: z.array(z.object({
-		dependencies: z.array(z.string().min(1)).optional(),
-		arguments: z.object({ artifacts: z.array(argoWorkflowArtifactSchema).optional() }).strict().optional(),
-		name: z.string().min(1),
-		template: z.string().min(1)
-	}).strict()).min(1) }).strict().optional(),
-	inputs: z.object({
-		artifacts: z.array(argoWorkflowArtifactSchema).optional(),
-		parameters: z.array(z.object({ name: z.string().min(1) }).strict()).optional()
-	}).strict().optional(),
-	outputs: z.object({ artifacts: z.array(argoWorkflowArtifactSchema) }).strict().optional(),
-	activeDeadlineSeconds: z.number().int().positive().optional(),
-	name: z.string().min(1),
-	retryStrategy: argoWorkflowRetryStrategySchema.optional()
-}).strict().refine((template) => template.container !== void 0 || template.dag !== void 0, { message: "Workflow templates must declare container or dag" });
-const runnerArgoWorkflowManifestSchema = z.object({
-	apiVersion: z.literal(ARGO_WORKFLOW_API_VERSION),
-	kind: z.literal(ARGO_WORKFLOW_KIND),
-	metadata: z.object({
-		annotations: z.record(z.string().min(1), z.string().min(1)).optional(),
-		generateName: z.string().min(1).optional(),
-		labels: z.record(z.string().min(1), labelValueSchema).optional(),
-		name: z.string().min(1).optional(),
-		namespace: kubernetesNameSchema
-	}).strict().refine((metadata) => metadata.name !== void 0 || metadata.generateName !== void 0, { message: "Workflow metadata must declare name or generateName" }),
-	spec: z.object({
-		activeDeadlineSeconds: z.number().int().positive().optional(),
-		entrypoint: z.literal(RUNNER_WORKFLOW_ENTRYPOINT),
-		imagePullSecrets: z.array(z.object({ name: kubernetesNameSchema }).strict()).optional(),
-		podMetadata: z.object({ labels: z.record(z.string().min(1), labelValueSchema).optional() }).strict().optional(),
-		serviceAccountName: kubernetesNameSchema,
-		onExit: z.string().min(1).optional(),
-		templates: z.array(argoWorkflowTemplateSchema).min(2),
-		ttlStrategy: z.object({
-			secondsAfterCompletion: z.number().int().positive().optional(),
-			secondsAfterFailure: z.number().int().positive().optional(),
-			secondsAfterSuccess: z.number().int().positive().optional()
-		}).strict().optional(),
-		volumes: z.array(argoWorkflowVolumeSchema).min(1)
-	}).strict()
-}).strict();
-const buildRunnerArgoWorkflowOptionsSchema = z.object({
-	activeDeadlineSeconds: z.number().int().positive().optional(),
-	eventAuthSecretKey: z.string().min(1).optional(),
-	eventAuthSecretName: kubernetesNameSchema.optional(),
-	generateName: z.string().min(1).optional(),
-	gitCredentialsSecretName: kubernetesNameSchema.optional(),
-	githubAuthSecretName: kubernetesNameSchema.optional(),
-	annotations: z.record(z.string().min(1), z.string().min(1).optional()).default({}),
-	image: z.string().min(1).default(RUNNER_WORKFLOW_IMAGE),
-	imagePullPolicy: z.enum([
-		"Always",
-		"IfNotPresent",
-		"Never"
-	]).default("Always"),
-	imagePullSecretName: kubernetesNameSchema.optional(),
-	labels: z.record(z.string().min(1), z.string().min(1).optional()).default({}),
-	name: z.string().min(1).optional(),
-	namespace: kubernetesNameSchema,
-	brokerAuth: z.object({
-		secretKey: z.string().min(1).default("api-key"),
-		secretName: kubernetesNameSchema,
-		url: z.string().min(1).default("https://cliproxy.momokaya.ee")
-	}).strict(),
-	payloadConfigMapKey: z.string().min(1).default("payload.json"),
-	payloadConfigMapName: kubernetesNameSchema,
-	resources: argoWorkflowResourceRequirementsSchema.optional(),
-	scheduleConfigMapKey: z.string().min(1).default("schedule.yaml"),
-	scheduleConfigMapName: kubernetesNameSchema,
-	serviceAccountName: kubernetesNameSchema.default(RUNNER_WORKFLOW_SERVICE_ACCOUNT),
-	taskDescriptorConfigMapName: kubernetesNameSchema,
-	ttlStrategy: z.object({
-		secondsAfterCompletion: z.number().int().positive().optional(),
-		secondsAfterFailure: z.number().int().positive().optional(),
-		secondsAfterSuccess: z.number().int().positive().optional()
-	}).strict().optional()
-}).strict().refine((options) => options.name !== void 0 || options.generateName !== void 0, { message: "Runner Workflow options must declare name or generateName" });
+const runnerArgoWorkflowManifestSchema = createRunnerArgoWorkflowManifestSchema();
 function buildRunnerArgoWorkflowManifest(rawOptions) {
-	const { plan, ...schemaOptions } = rawOptions;
-	const options = {
-		...buildRunnerArgoWorkflowOptionsSchema.parse(schemaOptions),
-		plan
-	};
-	const graph = compileArgoExecutionGraph(plan);
-	const { volumeMounts, volumes } = runnerWorkflowStorage(options, graph.tasks);
+	const options = parsedBuildOptions(rawOptions);
+	const graph = compileArgoExecutionGraph(options.plan);
+	const storage = runnerWorkflowStorage(options, graph.tasks);
 	return runnerArgoWorkflowManifestSchema.parse({
-		apiVersion: ARGO_WORKFLOW_API_VERSION,
-		kind: ARGO_WORKFLOW_KIND,
-		metadata: {
-			annotations: compactRecord(options.annotations),
-			...options.name ? { name: options.name } : {},
-			...options.generateName ? { generateName: options.generateName } : {},
-			labels: compactRecord({
-				"pipeline.oisin.dev/source": "argo-workflow",
-				"pipeline.oisin.dev/workflow": plan.workflowId,
-				...options.labels
-			}),
-			namespace: options.namespace
-		},
-		spec: {
-			...options.activeDeadlineSeconds ? { activeDeadlineSeconds: options.activeDeadlineSeconds } : {},
-			entrypoint: RUNNER_WORKFLOW_ENTRYPOINT,
-			...options.imagePullSecretName ? { imagePullSecrets: [{ name: options.imagePullSecretName }] } : {},
-			onExit: "pipeline-finalizer",
-			serviceAccountName: options.serviceAccountName,
-			templates: [
-				{
-					dag: { tasks: [{
-						name: RUNNER_WORKFLOW_START_TASK,
-						template: RUNNER_WORKFLOW_START_TASK
-					}, ...graph.tasks.map((task) => ({
-						dependencies: [RUNNER_WORKFLOW_START_TASK, ...task.dependencies],
-						name: task.taskName,
-						template: task.templateName
-					}))] },
-					name: RUNNER_WORKFLOW_ENTRYPOINT
-				},
-				runnerLifecycleTemplate(options, volumeMounts),
-				...graph.tasks.map((task) => runnerCommandTemplate(task, options, volumeMounts)),
-				runnerFinalizerTemplate(options, volumeMounts)
-			],
-			...options.ttlStrategy ? { ttlStrategy: options.ttlStrategy } : {},
-			volumes
-		}
+		apiVersion: "argoproj.io/v1alpha1",
+		kind: "Workflow",
+		metadata: workflowMetadata(options),
+		spec: workflowSpec(options, graph.tasks, storage)
 	});
 }
 function stringifyRunnerArgoWorkflow(workflow) {
 	return stringify(runnerArgoWorkflowManifestSchema.parse(workflow));
 }
-function runnerWorkflowStorage(options, tasks) {
-	const volumes = [
-		{
-			configMap: {
-				items: [{
-					key: options.payloadConfigMapKey,
-					path: "payload.json"
-				}],
-				name: options.payloadConfigMapName
-			},
-			name: "runner-payload"
-		},
-		{
-			configMap: {
-				items: [{
-					key: options.scheduleConfigMapKey,
-					path: "schedule.yaml"
-				}],
-				name: options.scheduleConfigMapName
-			},
-			name: "runner-schedule"
-		},
-		{
-			configMap: {
-				items: tasks.map((task) => ({
-					key: `${task.taskName}.json`,
-					path: `${task.taskName}.json`
-				})),
-				name: options.taskDescriptorConfigMapName
-			},
-			name: "runner-task-descriptor"
-		}
-	];
-	const volumeMounts = [{
-		mountPath: RUNNER_WORKFLOW_PAYLOAD_PATH,
-		name: "runner-payload",
-		readOnly: true,
-		subPath: "payload.json"
-	}, {
-		mountPath: RUNNER_WORKFLOW_SCHEDULE_PATH,
-		name: "runner-schedule",
-		readOnly: true,
-		subPath: "schedule.yaml"
-	}];
-	if (options.eventAuthSecretName) {
-		volumes.push({
-			name: "runner-event-auth",
-			secret: {
-				...options.eventAuthSecretKey ? { items: [{
-					key: options.eventAuthSecretKey,
-					path: options.eventAuthSecretKey
-				}] } : {},
-				secretName: options.eventAuthSecretName
-			}
-		});
-		volumeMounts.push({
-			mountPath: "/etc/pipeline/event-auth",
-			name: "runner-event-auth",
-			readOnly: true
-		});
-	}
-	if (options.gitCredentialsSecretName) {
-		volumes.push({
-			name: "runner-git-credentials",
-			secret: {
-				defaultMode: 256,
-				secretName: options.gitCredentialsSecretName
-			}
-		});
-		volumeMounts.push({
-			mountPath: RUNNER_GIT_CREDENTIALS_PATH,
-			name: "runner-git-credentials",
-			readOnly: true
-		});
-	}
-	if (options.githubAuthSecretName) {
-		volumes.push({
-			name: "github-auth",
-			secret: {
-				items: [{
-					key: "hosts.yml",
-					path: "hosts.yml"
-				}],
-				secretName: options.githubAuthSecretName
-			}
-		});
-		volumeMounts.push({
-			mountPath: "/root/.config/gh/hosts.yml",
-			name: "github-auth",
-			readOnly: true,
-			subPath: "hosts.yml"
-		});
-	}
+function parsedBuildOptions(rawOptions) {
+	const { plan, ...schemaOptions } = rawOptions;
 	return {
-		volumeMounts: z.array(argoWorkflowVolumeMountSchema).parse(volumeMounts),
-		volumes: z.array(argoWorkflowVolumeSchema).parse(volumes)
+		...buildRunnerArgoWorkflowOptionsSchema.parse(schemaOptions),
+		plan
 	};
 }
-/**
-* The runner container env: static opencode/agent tuning plus BROKER_URL
-* (literal) and BROKER_API_KEY (sourced from the broker secret key, never
-* inlined into the manifest).
-*/
-function runnerContainerEnv(options) {
-	return [
-		...RUNNER_OPENCODE_ENV,
-		{
-			name: "BROKER_URL",
-			value: options.brokerAuth.url
-		},
-		{
-			name: "PIPELINE_BROKER_SECRET_NAME",
-			value: options.brokerAuth.secretName
-		},
-		{
-			name: "PIPELINE_BROKER_SECRET_KEY",
-			value: options.brokerAuth.secretKey
-		},
-		{
-			name: "BROKER_API_KEY",
-			valueFrom: { secretKeyRef: {
-				key: options.brokerAuth.secretKey,
-				name: options.brokerAuth.secretName
-			} }
-		}
-	];
-}
-function runnerLifecycleTemplate(options, volumeMounts) {
+function workflowMetadata(options) {
 	return {
-		container: {
-			args: [
-				"runner-lifecycle",
-				"--phase",
-				"workflow.start",
-				"--payload-file",
-				RUNNER_WORKFLOW_PAYLOAD_PATH,
-				"--schedule-file",
-				RUNNER_WORKFLOW_SCHEDULE_PATH
-			],
-			command: ["moka"],
-			env: runnerContainerEnv(options),
-			image: options.image,
-			imagePullPolicy: options.imagePullPolicy,
-			name: "runner",
-			resources: options.resources ?? DEFAULT_RUNNER_RESOURCES,
-			volumeMounts
-		},
-		name: RUNNER_WORKFLOW_START_TASK,
-		retryStrategy: { ...RUNNER_RETRY_STRATEGY },
-		activeDeadlineSeconds: DEFAULT_RUNNER_DEADLINE_SECONDS
+		annotations: compactRecord(options.annotations),
+		...options.name ? { name: options.name } : {},
+		...options.generateName ? { generateName: options.generateName } : {},
+		labels: compactRecord({
+			"pipeline.oisin.dev/source": "argo-workflow",
+			"pipeline.oisin.dev/workflow": options.plan.workflowId,
+			...options.labels
+		}),
+		namespace: options.namespace
 	};
 }
-function runnerCommandTemplate(task, options, volumeMounts) {
-	const taskVolumeMount = {
-		mountPath: DEFAULT_RUNNER_TASK_DESCRIPTOR_PATH,
-		name: "runner-task-descriptor",
-		readOnly: true,
-		subPath: `${task.taskName}.json`
-	};
+function workflowSpec(options, tasks, storage) {
 	return {
-		container: {
-			args: [
-				"runner-command",
-				"--payload-file",
-				RUNNER_WORKFLOW_PAYLOAD_PATH,
-				"--schedule-file",
-				RUNNER_WORKFLOW_SCHEDULE_PATH
-			],
-			command: ["moka"],
-			env: runnerContainerEnv(options),
-			image: options.image,
-			imagePullPolicy: options.imagePullPolicy,
-			name: "runner",
-			resources: options.resources ?? DEFAULT_RUNNER_RESOURCES,
-			volumeMounts: [...volumeMounts, taskVolumeMount]
-		},
-		name: task.templateName,
-		retryStrategy: { ...RUNNER_RETRY_STRATEGY },
-		activeDeadlineSeconds: DEFAULT_RUNNER_DEADLINE_SECONDS
+		...options.activeDeadlineSeconds ? { activeDeadlineSeconds: options.activeDeadlineSeconds } : {},
+		entrypoint: RUNNER_WORKFLOW_ENTRYPOINT,
+		...options.imagePullSecretName ? { imagePullSecrets: [{ name: options.imagePullSecretName }] } : {},
+		serviceAccountName: options.serviceAccountName,
+		onExit: "pipeline-finalizer",
+		templates: workflowTemplates(options, tasks, storage.volumeMounts),
+		...options.ttlStrategy ? { ttlStrategy: options.ttlStrategy } : {},
+		volumes: storage.volumes
 	};
 }
-function runnerFinalizerTemplate(options, volumeMounts) {
+function workflowTemplates(options, tasks, volumeMounts) {
+	return [
+		workflowDagTemplate(tasks),
+		runnerLifecycleTemplate(options, volumeMounts),
+		...tasks.map((task) => runnerCommandTemplate(task, options, volumeMounts)),
+		runnerFinalizerTemplate(options, volumeMounts)
+	];
+}
+function workflowDagTemplate(tasks) {
 	return {
-		container: {
-			args: [
-				"runner-finalize",
-				"--payload-file",
-				RUNNER_WORKFLOW_PAYLOAD_PATH,
-				"--schedule-file",
-				RUNNER_WORKFLOW_SCHEDULE_PATH,
-				"--argo-status",
-				"{{workflow.status}}"
-			],
-			command: ["moka"],
-			env: runnerContainerEnv(options),
-			image: options.image,
-			imagePullPolicy: options.imagePullPolicy,
-			name: "runner",
-			resources: options.resources ?? DEFAULT_RUNNER_RESOURCES,
-			volumeMounts
-		},
-		name: "pipeline-finalizer",
-		activeDeadlineSeconds: DEFAULT_RUNNER_DEADLINE_SECONDS
+		dag: { tasks: [{
+			name: RUNNER_WORKFLOW_START_TASK,
+			template: RUNNER_WORKFLOW_START_TASK
+		}, ...tasks.map((task) => ({
+			dependencies: [RUNNER_WORKFLOW_START_TASK, ...task.dependencies],
+			name: task.taskName,
+			template: task.templateName
+		}))] },
+		name: RUNNER_WORKFLOW_ENTRYPOINT
 	};
 }
 function compactRecord(input) {

package/dist/config/defaults.js

@@ -1,6 +1,6 @@
 import { ConfigIoService, parseConfigYamlAs, runConfigIoSync } from "../runtime/services/config-io-service.js";
-import { z } from "zod";
 import { Effect } from "effect";
+import { z } from "zod";
 //#region src/config/defaults.ts
 const PIPELINE_CONFIG_PATH = ".pipeline/pipeline.yaml";
 const RUNNERS_CONFIG_PATH = ".pipeline/runners.yaml";

package/dist/config/schemas.d.ts

@@ -226,8 +226,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        "trusted-only": "trusted-only";
         deny: "deny";
+        "trusted-only": "trusted-only";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -255,8 +255,8 @@ declare const configSchema: z.ZodObject<{
       global: "global";
     }>>;
     mode: z.ZodEnum<{
-      hosted: "hosted";
       local: "local";
+      hosted: "hosted";
     }>;
     provider: z.ZodLiteral<"toolhive">;
     authorization_env: z.ZodDefault<z.ZodString>;
@@ -300,10 +300,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -379,10 +379,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;