@oisincoveney/pipeline 3.19.4 → 3.19.6

package/dist/argo-submit.d.ts

@@ -26,6 +26,7 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
     Never: "Never";
   }>>;
   imagePullSecretName: z.ZodOptional<z.ZodString>;
+  kubeContext: z.ZodOptional<z.ZodString>;
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   mcpGatewayAuth: z.ZodOptional<z.ZodObject<{
     secretKey: z.ZodDefault<z.ZodString>;
@@ -59,6 +60,7 @@ declare const submitDynamicRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
     Never: "Never";
   }>>;
   imagePullSecretName: z.ZodOptional<z.ZodString>;
+  kubeContext: z.ZodOptional<z.ZodString>;
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   mcpGatewayAuth: z.ZodOptional<z.ZodObject<{
     secretKey: z.ZodDefault<z.ZodString>;

package/dist/argo-submit.js

@@ -43,6 +43,7 @@ const submitRunnerArgoWorkflowBaseOptionShape = {
 		"Never"
 	]).optional(),
 	imagePullSecretName: z.string().min(1).optional(),
+	kubeContext: z.string().min(1).optional(),
 	kubeconfigPath: z.string().min(1).optional(),
 	mcpGatewayAuth: mcpGatewayAuthOptionSchema.optional(),
 	name: z.string().min(1).optional(),
@@ -166,16 +167,16 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 			namespace: options.namespace,
 			options
 		});
-		return workflowSubmitResult(yield* service.createWorkflow({
-			body: runnerArgoWorkflowManifestSchema.parse(workflow),
+		return yield* submitWorkflowManifest({
 			dependencies,
 			namespace: options.namespace,
-			options
-		}), workflow, {
-			namespace: options.namespace,
-			payloadConfigMapName,
-			scheduleConfigMapName: scheduleArtifactConfigMapName,
-			taskDescriptorConfigMapName
+			options,
+			resultExtras: {
+				payloadConfigMapName,
+				scheduleConfigMapName: scheduleArtifactConfigMapName,
+				taskDescriptorConfigMapName
+			},
+			workflow
 		});
 	});
 }
@@ -219,8 +220,7 @@ function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		workflowId: options.workflowId
 	});
 	return Effect.gen(function* () {
-		const service = yield* KubernetesArgoService;
-		yield* service.createConfigMap({
+		yield* (yield* KubernetesArgoService).createConfigMap({
 			body: configMapSchema.parse({
 				apiVersion: "v1",
 				data: { "payload.json": payloadJson },
@@ -235,14 +235,25 @@ function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 			namespace: options.namespace,
 			options
 		});
-		return workflowSubmitResult(yield* service.createWorkflow({
-			body: runnerArgoWorkflowManifestSchema.parse(workflow),
+		return yield* submitWorkflowManifest({
 			dependencies,
 			namespace: options.namespace,
-			options
-		}), workflow, {
-			namespace: options.namespace,
-			payloadConfigMapName
+			options,
+			resultExtras: { payloadConfigMapName },
+			workflow
+		});
+	});
+}
+function submitWorkflowManifest(input) {
+	return Effect.gen(function* () {
+		return workflowSubmitResult(yield* (yield* KubernetesArgoService).createWorkflow({
+			body: runnerArgoWorkflowManifestSchema.parse(input.workflow),
+			dependencies: input.dependencies,
+			namespace: input.namespace,
+			options: input.options
+		}), input.workflow, {
+			namespace: input.namespace,
+			...input.resultExtras
 		});
 	});
 }

package/dist/cli/doctor.d.ts

@@ -18,4 +18,4 @@ interface DoctorFlags {
 }
 declare function runDoctor(cwd: string, options?: DoctorFlags): Promise<DoctorResult>;
 //#endregion
-export { runDoctor };
+export { DoctorCheck, DoctorFlags, DoctorResult, runDoctor };

package/dist/cli/doctor.js

@@ -9,8 +9,8 @@ import { execa } from "execa";
 import { join } from "node:path";
 import matter from "gray-matter";
 //#region src/cli/doctor.ts
-const HEADLESS_AGENT_PERMISSION_VALUES = new Set(["ask"]);
-const RUN_READINESS_CATEGORIES = new Set([
+const HEADLESS_AGENT_PERMISSION_VALUES = /* @__PURE__ */ new Set(["ask"]);
+const RUN_READINESS_CATEGORIES = /* @__PURE__ */ new Set([
 	"acceptance",
 	"green",
 	"intake",

package/dist/cli/format.js

@@ -137,4 +137,4 @@ function truncateMiddle(text, maxLength) {
 	return `${text.slice(0, keep)}\n... truncated ...\n${text.slice(-keep)}`;
 }
 //#endregion
-export { createTerminalRuntimeReporter, formatDoctorResult, formatRuntimeFailure, formatRuntimeResult };
+export { createTerminalRuntimeReporter, formatDoctorResult, formatRuntimeFailure, formatRuntimeProgressMessage, formatRuntimeResult };

package/dist/cli/program.d.ts

@@ -11,4 +11,4 @@ interface CliProgramOptions {
 declare function createCliProgram(options?: CliProgramOptions): Command;
 declare function runCli(argv: string[]): Promise<void>;
 //#endregion
-export { createCliProgram, runCli };
+export { CliProgramOptions, createCliProgram, runCli };

package/dist/cli/run-command.d.ts

@@ -10,4 +10,4 @@ interface RunCommandCall {
 }
 type RunCommand = (call: RunCommandCall) => Promise<void> | void;
 //#endregion
-export { RunCommand };
+export { RunCommand, RunCommandCall };

package/dist/cli/run-resolver.d.ts

@@ -33,4 +33,4 @@ interface RunResolution {
   target: MokaRunTarget;
 }
 //#endregion
-export { RunResolution, RunResolverFlags };
+export { LocalRuntimeExecution, MOKA_RUN_EFFORTS, MOKA_RUN_TARGETS, MokaRunEffort, MokaRunMode, MokaRunTarget, RemoteSubmitExecution, RunResolution, RunResolverFlags };

package/dist/cli/run-service.d.ts

@@ -26,4 +26,4 @@ interface RunControlOptions {
 declare function execute(description: string, options?: ExecuteOptions): Promise<void>;
 declare function quick(description: string, options?: Omit<ExecuteOptions, "entrypoint">): Promise<void>;
 //#endregion
-export { execute, quick };
+export { ExecuteOptions, RunControlOptions, RunStoreMode, execute, quick };

package/dist/cli/submit-options.js

@@ -4,8 +4,16 @@ import { loadMokaGlobalConfig } from "../moka-global-config.js";
 import { submitMoka } from "../moka-submit.js";
 import { Option } from "commander";
 //#region src/cli/submit-options.ts
+function resolveOptionalSecretRef(flags, fromGlobalConfig) {
+	if (flags.skip) return;
+	if (flags.secretName) return {
+		secretName: flags.secretName,
+		...flags.secretKey ? { secretKey: flags.secretKey } : {}
+	};
+	return fromGlobalConfig;
+}
 function addMokaSubmitOptions(command) {
-	return addRunnerArgoOptions(command.option("--quick", "submit the compact graph").option("--command", "treat input after -- as explicit argv").option("--schedule <path>", "approved schedule YAML to submit").option("--event-url <url>", "runner event sink URL").option("--open-pr", "append an open-pull-request delivery node (preview-labelled PR)").option("--task <text>", "task description for command-mode metadata"), { kubeconfig: true });
+	return addRunnerArgoOptions(command.option("--quick", "submit the compact graph").option("--command", "treat input after -- as explicit argv").option("--schedule <path>", "approved schedule YAML to submit").option("--event-url <url>", "runner event sink URL").option("--open-pr", "append an open-pull-request delivery node (preview-labelled PR)").option("--task <text>", "task description for command-mode metadata").option("--db-auth-secret-name <name>", "override momokaya.submit.dbAuth secret name").option("--db-auth-secret-key <key>", "override momokaya.submit.dbAuth secret key").option("--skip-db-auth", "omit MOKA_DB_URL injection regardless of global config").option("--mcp-gateway-auth-secret-name <name>", "override momokaya.submit.mcpGatewayAuth secret name").option("--mcp-gateway-auth-secret-key <key>", "override momokaya.submit.mcpGatewayAuth secret key").option("--skip-mcp-gateway-auth", "omit PIPELINE_MCP_GATEWAY_AUTHORIZATION injection regardless of global config"), { kubeconfig: true });
 }
 function runMokaSubmitFromCli(input, flags) {
 	const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
@@ -36,8 +44,16 @@ function mokaCommonSubmitOptions(input) {
 	return {
 		brokerAuth: resolveMokaBrokerAuth(input.globalConfig),
 		config: input.config,
-		dbAuth: momokaya?.submit.dbAuth,
-		mcpGatewayAuth: momokaya?.submit.mcpGatewayAuth,
+		dbAuth: resolveOptionalSecretRef({
+			secretKey: input.flags.dbAuthSecretKey,
+			secretName: input.flags.dbAuthSecretName,
+			skip: input.flags.skipDbAuth
+		}, momokaya?.submit.dbAuth),
+		mcpGatewayAuth: resolveOptionalSecretRef({
+			secretKey: input.flags.mcpGatewayAuthSecretKey,
+			secretName: input.flags.mcpGatewayAuthSecretName,
+			skip: input.flags.skipMcpGatewayAuth
+		}, momokaya?.submit.mcpGatewayAuth),
 		delivery: { pullRequest: input.flags.openPr === true },
 		eventUrl: input.eventUrl,
 		eventAuthSecretKey: momokaya?.submit.eventAuthSecretKey,
@@ -48,6 +64,7 @@ function mokaCommonSubmitOptions(input) {
 		image: input.flags.image,
 		imagePullPolicy: parseImagePullPolicy(input.flags.imagePullPolicy),
 		imagePullSecretName: input.flags.imagePullSecret ?? momokaya?.submit.imagePullSecretName,
+		kubeContext: input.flags.kubeContext ?? momokaya?.kubernetes.context,
 		kubeconfigPath: input.flags.kubeconfig ?? momokaya?.kubernetes.kubeconfig,
 		name: input.flags.name,
 		namespace: input.flags.namespace ?? momokaya?.kubernetes.namespace,
@@ -83,7 +100,7 @@ function submitMokaGraphInput(input, flags, commonOptions) {
 }
 function addRunnerArgoOptions(command, options = {}) {
 	command.option("--name <name>", "Workflow metadata.name").option("--generate-name <prefix>", "Workflow metadata.generateName").option("--namespace <namespace>", "Workflow namespace");
-	if (options.kubeconfig) command.option("--kubeconfig <path>", "kubeconfig path");
+	if (options.kubeconfig) command.option("--kubeconfig <path>", "kubeconfig path").option("--kube-context <name>", "kubeconfig context to target");
 	return command.option("--service-account <name>", "Workflow service account").option("--image <image>", "runner image").addOption(new Option("--image-pull-policy <policy>", "runner image pull policy").choices([
 		"Always",
 		"IfNotPresent",
@@ -95,4 +112,4 @@ function parseImagePullPolicy(value) {
 	return "Always";
 }
 //#endregion
-export { addMokaSubmitOptions, buildMokaSubmitInputFromCli, runMokaSubmitFromCli };
+export { addMokaSubmitOptions, buildMokaSubmitInputFromCli, parseImagePullPolicy, runMokaSubmitFromCli };

package/dist/commands/pipeline-command.js

@@ -1,6 +1,6 @@
 import { Context, Effect, Layer } from "effect";
 //#region src/commands/pipeline-command.ts
-const BUILTIN_PIPE_COMMANDS = new Set([
+const BUILTIN_PIPE_COMMANDS = /* @__PURE__ */ new Set([
 	"run",
 	"validate",
 	"explain-plan",

package/dist/commands/ticket/shared.d.ts

@@ -11,4 +11,4 @@ interface TicketCommandOptions {
   readonly ticketPlanExecutor?: TicketPlanExecutor;
 }
 //#endregion
-export { TicketCommandOptions };
+export { TicketCommandOptions, TicketPlanExecutor };

package/dist/commands/ticket-command.d.ts

@@ -1,2 +1,3 @@
 import { TicketCommandOptions } from "./ticket/shared.js";
-import { Command } from "commander";
+import { Command } from "commander";
+export type { TicketCommandOptions };

package/dist/config/schemas.d.ts

@@ -583,4 +583,4 @@ interface PipelineConfigValidationOptions {
   allowMissingLintFileReferences?: boolean;
 }
 //#endregion
-export { GateKind, HookEvent, McpGatewayBackendLocality, McpGatewayWorkspacePathSource, PipelineConfig, PipelineConfigError, PipelineConfigErrorCode, PipelineConfigIssue, PipelineConfigParts, PipelineConfigValidationOptions, RunnerType, ScheduleBaseline, SchedulingRole, WorkflowNodeKind, workflowSchema };
+export { GateKind, HookEvent, McpGatewayBackendLocality, McpGatewayWorkspacePathSource, PipelineConfig, PipelineConfigError, PipelineConfigErrorCode, PipelineConfigIssue, PipelineConfigParts, PipelineConfigValidationOptions, RunnerType, ScheduleBaseline, SchedulingRole, WorkflowNodeKind, configSchema, workflowSchema };

package/dist/context/repo-map.js

@@ -7,7 +7,7 @@ import { Query } from "web-tree-sitter";
 import Graph from "graphology";
 import pagerank from "graphology-metrics/centrality/pagerank.js";
 //#region src/context/repo-map.ts
-const SOURCE_EXTENSIONS = new Set([
+const SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
 	".cjs",
 	".js",
 	".jsx",
@@ -15,7 +15,7 @@ const SOURCE_EXTENSIONS = new Set([
 	".ts",
 	".tsx"
 ]);
-const SKIP_DIRS = new Set([
+const SKIP_DIRS = /* @__PURE__ */ new Set([
 	"node_modules",
 	".git",
 	"dist",

package/dist/credentials/broker.d.ts

@@ -12,4 +12,4 @@ declare const brokerAuthOptionSchema: z.ZodObject<{
 }, z.core.$strict>;
 type BrokerAuthOption = z.input<typeof brokerAuthOptionSchema>;
 //#endregion
-export { BrokerAuthOption };
+export { BrokerAuthOption, brokerAuthOptionSchema };

package/dist/install-commands/opencode.js

@@ -413,4 +413,4 @@ const opencodeAdapter = {
 	}
 };
 //#endregion
-export { agentDispatchRoutes, entrypointDispatchBlock, grants, header, markdown, opencodeAdapter, projectAgentsMdDefinition, resolvedHostModel };
+export { agentDispatchRoutes, entrypointDispatchBlock, grants, header, markdown, opencodeAdapter, projectAgentsMdDefinition, resolvedHostModel, shouldEmbedProjectGateway };

package/dist/install-commands/planner.js

@@ -15,7 +15,7 @@ const ADAPTERS = {
 	opencode: opencodeAdapter,
 	"claude-code": claudeCodeAdapter
 };
-const GLOBAL_EXCLUDED_PATHS = new Set(["AGENTS.md"]);
+const GLOBAL_EXCLUDED_PATHS = /* @__PURE__ */ new Set(["AGENTS.md"]);
 const GENERATED_CONTENT_MARKERS = [
 	GENERATED_MARKER,
 	GENERATED_TS_MARKER,

package/dist/install-hooks.js

@@ -20,7 +20,7 @@ const HOST_TARGET_ROOT = {
 	codex: ".codex",
 	opencode: ".opencode"
 };
-const NON_HOOK_OWNED_TARGETS = new Set([".opencode/opencode.json"]);
+const NON_HOOK_OWNED_TARGETS = /* @__PURE__ */ new Set([".opencode/opencode.json"]);
 function hashContent(content) {
 	return createHash("sha256").update(content).digest("hex");
 }

package/dist/loop/argo-poll.js

@@ -2,12 +2,12 @@ import { isRecord } from "../safe-json.js";
 import { Duration, Effect } from "effect";
 import { CustomObjectsApi, KubeConfig } from "@kubernetes/client-node";
 //#region src/loop/argo-poll.ts
-const TERMINAL_PHASES = new Set([
+const TERMINAL_PHASES = /* @__PURE__ */ new Set([
 	"Succeeded",
 	"Failed",
 	"Error"
 ]);
-const KNOWN_RUNNING_PHASES = new Set([
+const KNOWN_RUNNING_PHASES = /* @__PURE__ */ new Set([
 	"Running",
 	"Pending",
 	""

package/dist/loop/loop-command.js

@@ -88,4 +88,4 @@ function loopControllerSubmitInput(input) {
 	};
 }
 //#endregion
-export { parseLoopFlags, runLoopSubmit };
+export { loopControllerArgv, parseLoopFlags, runLoopSubmit };

package/dist/loop/merge.js

@@ -117,4 +117,4 @@ function mergeForClassification(input) {
 	return adminMerge(input.pr, token, input.gh);
 }
 //#endregion
-export { mergeForClassification };
+export { adminMerge, enableAutoMerge, mergeForClassification, secretToken, selectMergeAction };

package/dist/moka-global-config.d.ts

@@ -9,6 +9,7 @@ declare const mokaGlobalConfigSchema: z.ZodObject<{
       url: z.ZodString;
     }, z.core.$strict>>;
     kubernetes: z.ZodObject<{
+      context: z.ZodOptional<z.ZodString>;
       kubeconfig: z.ZodOptional<z.ZodString>;
       namespace: z.ZodString;
     }, z.core.$strict>;

package/dist/moka-global-config.js

@@ -29,6 +29,7 @@ const mokaSubmitGlobalConfigSchema = z.object({
 	serviceAccountName: z.string().min(1)
 }).strict();
 const mokaKubernetesGlobalConfigSchema = z.object({
+	context: z.string().min(1).optional(),
 	kubeconfig: z.string().min(1).optional(),
 	namespace: z.string().min(1)
 }).strict();

package/dist/moka-submit.d.ts

@@ -197,6 +197,7 @@ declare const mokaSubmitBaseOptionsSchema: z.ZodObject<{
     Never: "Never";
   }>>;
   imagePullSecretName: z.ZodOptional<z.ZodString>;
+  kubeContext: z.ZodOptional<z.ZodString>;
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
@@ -310,6 +311,7 @@ declare const mokaGraphSubmitOptionsSchema: z.ZodObject<{
     Never: "Never";
   }>>;
   imagePullSecretName: z.ZodOptional<z.ZodString>;
+  kubeContext: z.ZodOptional<z.ZodString>;
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
@@ -440,6 +442,7 @@ declare const mokaCommandSubmitOptionsSchema: z.ZodObject<{
     Never: "Never";
   }>>;
   imagePullSecretName: z.ZodOptional<z.ZodString>;
+  kubeContext: z.ZodOptional<z.ZodString>;
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
@@ -565,6 +568,7 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     Never: "Never";
   }>>;
   imagePullSecretName: z.ZodOptional<z.ZodString>;
+  kubeContext: z.ZodOptional<z.ZodString>;
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
@@ -694,6 +698,7 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     Never: "Never";
   }>>;
   imagePullSecretName: z.ZodOptional<z.ZodString>;
+  kubeContext: z.ZodOptional<z.ZodString>;
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;

package/dist/moka-submit.js

@@ -66,6 +66,7 @@ const mokaSubmitBaseOptionsSchema = z.object({
 	image: z.string().min(1).optional(),
 	imagePullPolicy: imagePullPolicySchema,
 	imagePullSecretName: z.string().min(1).optional(),
+	kubeContext: z.string().min(1).optional(),
 	kubeconfigPath: z.string().min(1).optional(),
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1).optional(),

package/dist/planning/generate.js

@@ -41,7 +41,7 @@ const SCHEDULE_BUILTINS = [
 	"test",
 	"typecheck"
 ];
-const PARALLEL_MERGE_BUILTINS = new Set(["drain-merge"]);
+const PARALLEL_MERGE_BUILTINS = /* @__PURE__ */ new Set(["drain-merge"]);
 const scheduleArtifactSchema = z.object({
 	generated_at: z.string().datetime(),
 	kind: z.literal(SCHEDULE_KIND),

package/dist/remote/submit/argo-submission.d.ts

@@ -18,6 +18,7 @@ interface MokaWorkflowSubmitOptions {
   image?: string;
   imagePullPolicy?: "Always" | "IfNotPresent" | "Never";
   imagePullSecretName?: string;
+  kubeContext?: string;
   kubeconfigPath?: string;
   mcpGatewayAuth?: {
     secretKey?: string;

package/dist/remote/submit/argo-submission.js

@@ -50,6 +50,7 @@ function workflowSubmitOptions(options) {
 		image: options.image,
 		imagePullPolicy: options.imagePullPolicy,
 		imagePullSecretName: options.imagePullSecretName,
+		kubeContext: options.kubeContext,
 		kubeconfigPath: options.kubeconfigPath,
 		name: options.name,
 		namespace: requireSubmitOption(options.namespace, "namespace"),

package/dist/remote/submit/io.js

@@ -1,6 +1,6 @@
 import { normalizeRunnerRepositoryForSubmit } from "../../git-remote-url.js";
 import { readFileSync } from "node:fs";
-import { simpleGit } from "simple-git";
+import { simpleGit as simpleGit$1 } from "simple-git";
 import parseGitUrl from "git-url-parse";
 //#region src/remote/submit/io.ts
 function readScheduleFile(dependencies, path) {
@@ -47,7 +47,7 @@ function runContext(options, git, runId) {
 }
 async function resolveGit(worktreePath, dependencies) {
 	if (dependencies.resolveGitContext) return dependencies.resolveGitContext(worktreePath);
-	const git = simpleGit({ baseDir: worktreePath });
+	const git = simpleGit$1({ baseDir: worktreePath });
 	const [branchResult, sha, remoteConfig] = await Promise.all([
 		git.branch(),
 		git.revparse(["HEAD"]),

package/dist/run-control/contracts.d.ts

@@ -103,4 +103,4 @@ type RunEffort = z.infer<typeof runEffortSchema>;
 type RunMode = z.infer<typeof runModeSchema>;
 type MokaRunManifest = z.infer<typeof mokaRunManifestSchema>;
 //#endregion
-export { MokaRunManifest, RunEffort, RunMode, RunTarget };
+export { MokaRunManifest, RunEffort, RunMode, RunTarget, mokaRunManifestSchema, runEffortSchema, runModeSchema, runTargetSchema };

package/dist/run-control/contracts.js

@@ -127,4 +127,4 @@ function parseMokaRunManifest(input) {
 	return mokaRunManifestSchema.parse(input);
 }
 //#endregion
-export { DEFAULT_RUN_CONTROL_HEARTBEAT_INTERVAL_MS, DEFAULT_RUN_CONTROL_NODE_STALE_AFTER_MS, DEFAULT_RUN_CONTROL_STALE_DETECTION, mokaNodeStatusSchema, mokaRunStatusSchema, parseMokaNodeStatus, parseMokaRunController, parseMokaRunEvent, parseMokaRunManifest, parseMokaRunStatus, parseRunControlStaleDetection, parseRunEffort, parseRunMode, parseRunTarget };
+export { DEFAULT_RUN_CONTROL_HEARTBEAT_INTERVAL_MS, DEFAULT_RUN_CONTROL_NODE_STALE_AFTER_MS, DEFAULT_RUN_CONTROL_STALE_DETECTION, MOKA_NODE_STATUSES, MOKA_RUN_STATUSES, RUN_EFFORTS, RUN_MODES, RUN_TARGETS, mokaNodeStatusEventSchema, mokaNodeStatusSchema, mokaRunControlEventSchema, mokaRunControllerSchema, mokaRunEventSchema, mokaRunHeartbeatEventSchema, mokaRunManifestSchema, mokaRunStatusEventSchema, mokaRunStatusSchema, parseMokaNodeStatus, parseMokaRunController, parseMokaRunEvent, parseMokaRunManifest, parseMokaRunStatus, parseRunControlStaleDetection, parseRunEffort, parseRunMode, parseRunTarget, runControlStaleDetectionSchema, runEffortSchema, runModeSchema, runTargetSchema };

package/dist/run-control/detach.js

@@ -76,4 +76,4 @@ function waitForControllerSpawnEffect(child) {
 	});
 }
 //#endregion
-export { startDetachedRunController };
+export { startDetachedRunController, startDetachedRunControllerEffect };

package/dist/run-control/next-node.js

@@ -115,4 +115,4 @@ function printNextNodeEnvelopeScoped(runId) {
 	});
 }
 //#endregion
-export { readPersistedScheduleEffect, readyNodeIdsFromRunStore, registerNextNodeSubcommand };
+export { buildNextNodeEnvelope, buildNextNodeEnvelopeFromRunStore, readPersistedScheduleEffect, readyNodeIdsFromRunStore, registerNextNodeSubcommand };

package/dist/run-control/postgres/postgres-run-control-store.js

@@ -1,13 +1,12 @@
+import "../../runtime/durable-store/postgres/migrate-substrate.js";
 import { DEFAULT_RUN_CONTROL_STALE_DETECTION, parseMokaNodeStatus, parseMokaRunController, parseMokaRunEvent, parseMokaRunManifest, parseMokaRunStatus, parseRunControlStaleDetection, parseRunEffort, parseRunMode, parseRunTarget } from "../contracts.js";
 import { publishScheduleManifest } from "../store-manifest.js";
 import { runControlEvent, runControlNodeArtifact, runControlNodeSession, runControlRun } from "./schema.js";
 import { Effect } from "effect";
-import { fileURLToPath } from "node:url";
-import { asc, eq, inArray } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/postgres-js";
-import "drizzle-orm/postgres-js/migrator";
 import postgres from "postgres";
-fileURLToPath(new URL("../../runtime/durable-store/postgres/migrations", import.meta.url));
+import { asc, eq, inArray } from "drizzle-orm";
+//#region src/run-control/postgres/postgres-run-control-store.ts
 function openClient(dbUrl) {
 	return postgres(dbUrl, { max: 1 });
 }
@@ -39,7 +38,7 @@ function createRun(db, input) {
 			manifest,
 			runId: manifest.runId
 		}).onConflictDoNothing());
-		const existing = yield* readRun(db, manifest.runId);
+		const existing = yield* loadBaseManifest(db, manifest.runId);
 		if (existing === void 0) return yield* Effect.fail(/* @__PURE__ */ new Error(`Run ${manifest.runId} not found after createRun upsert.`));
 		return existing;
 	});

package/dist/run-control/run-artifacts-command.js

@@ -14,7 +14,7 @@ const WATCH_INTERVAL_MS = 1e3;
 const SENSITIVE_BASENAME_PARTS = ["prompt", "session"];
 const SENSITIVE_BASENAME_PREFIXES = ["body."];
 const SENSITIVE_PATH_PARTS = ["session-body", "session_body"];
-const SENSITIVE_BASENAMES = new Set(["body"]);
+const SENSITIVE_BASENAMES = /* @__PURE__ */ new Set(["body"]);
 function printLogsEffect(input) {
 	return Effect.gen(function* () {
 		const run = yield* requireRunEffect(input.store, input.runId);

package/dist/run-control/run-command-domain.js

@@ -1,13 +1,13 @@
 import { parseLogicalSegment } from "./logical-segment.js";
 import { Effect } from "effect";
 //#region src/run-control/run-command-domain.ts
-const ACTIVE_RUN_STATUSES = new Set([
+const ACTIVE_RUN_STATUSES = /* @__PURE__ */ new Set([
 	"queued",
 	"starting",
 	"running",
 	"stalled"
 ]);
-const ACTIVE_NODE_STATUSES = new Set([
+const ACTIVE_NODE_STATUSES = /* @__PURE__ */ new Set([
 	"queued",
 	"starting",
 	"running",

package/dist/run-control/run-control-store.js

@@ -1,4 +1,5 @@
 import { loadMokaDbUrl, requireMokaDbUrl } from "../moka-global-config.js";
+import { migratePostgresSubstrate } from "../runtime/durable-store/postgres/migrate-substrate.js";
 import { postgresRunControlStore } from "./postgres/postgres-run-control-store.js";
 import "./store-paths.js";
 import "./store.js";
@@ -19,7 +20,10 @@ import { Effect } from "effect";
 * filesystem store holds no resources, so it is returned directly.
 */
 function resolveRunControlStore(dbUrl, _workspaceRoot) {
-	return requireMokaDbUrl(dbUrl).pipe(Effect.flatMap((requiredDbUrl) => Effect.acquireRelease(Effect.sync(() => postgresRunControlStore(requiredDbUrl)), (store) => Effect.promise(() => store.close()))));
+	return requireMokaDbUrl(dbUrl).pipe(Effect.flatMap((requiredDbUrl) => Effect.tryPromise({
+		catch: (error) => error,
+		try: () => migratePostgresSubstrate(requiredDbUrl)
+	}).pipe(Effect.flatMap(() => Effect.acquireRelease(Effect.sync(() => postgresRunControlStore(requiredDbUrl)), (store) => Effect.promise(() => store.close()))))));
 }
 /**
 * PIPE-91.14: the single store-lifecycle wrapper shared by every run-control

package/dist/run-control/runtime-reporter.js

@@ -132,4 +132,4 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
-export { createRunStoreRuntimeReporter };
+export { createRunStoreRuntimeReporter, createRunStoreRuntimeReporterEffect };

package/dist/run-control/store-paths.js

@@ -20,4 +20,4 @@ function runPaths(workspaceRoot, runId) {
 	};
 }
 //#endregion
-export { runPaths };
+export { RUNS_DIRECTORY, runPaths };

package/dist/run-control/submit-result.js

@@ -57,4 +57,4 @@ function submitResultEffect(runId, nodeId, resultJson) {
 	}));
 }
 //#endregion
-export { registerSubmitResultSubcommand };
+export { recordSubmitResult, registerSubmitResultSubcommand };

package/dist/run-control/supervisor.js

@@ -3,7 +3,7 @@ import { createSerializedWriteQueue } from "../serialized-write-queue.js";
 import { createRunStoreRuntimeReporter } from "./runtime-reporter.js";
 import { Effect } from "effect";
 //#region src/run-control/supervisor.ts
-const RUNNING_NODE_EVENT_TYPES = new Set([
+const RUNNING_NODE_EVENT_TYPES = /* @__PURE__ */ new Set([
 	"agent.start",
 	"artifact.check.start",
 	"gate.start",
@@ -193,4 +193,4 @@ function shouldMarkNodeRunning(event) {
 	}
 }
 //#endregion
-export { createRunControlSupervisor };
+export { createRunControlSupervisor, createRunControlSupervisorEffect };

package/dist/run-state/git-refs.js

@@ -347,4 +347,4 @@ function shellQuote(value) {
 	return `'${value.replaceAll("'", `'\\''`)}'`;
 }
 //#endregion
-export { commitAndPushNodeRef, mergeDependencyRefs, prepareRunnerGitWorkspace, promoteFinalRef, runAuthenticatedGit };
+export { commitAndPushNodeRef, mergeDependencyRefs, prepareRunnerGitWorkspace, promoteFinalRef, runAuthenticatedGit, runnerCommitMessage };

package/dist/runner-command/run.js

@@ -572,4 +572,4 @@ function createRunnerLogger(options) {
 	}, pino.multistream(streams, { dedupe: true }));
 }
 //#endregion
-export { runRunnerCommand, runnerTaskTextEffect };
+export { nodeProcessExitCode, runRunnerCommand, runnerTaskTextEffect };

package/dist/runtime/actor-ids.d.ts

@@ -124,4 +124,4 @@ type RuntimeObservabilityEvent = {
   type: "runtime.retry.exhausted";
 };
 //#endregion
-export { RuntimeActorDescriptor, RuntimeObservabilityEvent };
+export { RetryReason, RuntimeActorDescriptor, RuntimeActorKind, RuntimeObservabilityEvent };

package/dist/runtime/agent-node/index.js

@@ -1,2 +1,2 @@
-import "./agent-node.js";
-export {};
+import { executeAgentNode } from "./agent-node.js";
+export { executeAgentNode };

package/dist/runtime/builtins/index.js

@@ -1,2 +1,2 @@
-import "./builtins.js";
-export {};
+import { executeBuiltin } from "./builtins.js";
+export { executeBuiltin };

package/dist/runtime/changed-files/changed-files.js

@@ -35,7 +35,7 @@ function pathFromPorcelainEntry(entry) {
 	return path ? [path] : [];
 }
 function diffChangedFiles(before, after, worktreePath) {
-	const files = [...new Set([...before.files, ...after.files])].filter((file) => !before.files.has(file) || before.fingerprints.get(file) !== (after.fingerprints.get(file) ?? fileFingerprint(worktreePath, file)));
+	const files = [.../* @__PURE__ */ new Set([...before.files, ...after.files])].filter((file) => !before.files.has(file) || before.fingerprints.get(file) !== (after.fingerprints.get(file) ?? fileFingerprint(worktreePath, file)));
 	return {
 		files: new Set(files),
 		fingerprints: new Map(files.map((file) => [file, after.fingerprints.get(file) ?? fileFingerprint(worktreePath, file)]))

package/dist/runtime/changed-files/index.js

@@ -1,2 +1,2 @@
-import "./changed-files.js";
-export {};
+import { diffChangedFiles, snapshotChangedFiles } from "./changed-files.js";
+export { diffChangedFiles, snapshotChangedFiles };

package/dist/runtime/command-executor/index.js

@@ -1,2 +1,2 @@
-import "./command-executor.js";
-export {};
+import { executeCommand } from "./command-executor.js";
+export { executeCommand };

package/dist/runtime/context/index.js

@@ -1,2 +1,2 @@
-import "./context.js";
-export {};
+import { createRuntimeContext, generateRuntimeRunId, resolveWorkflowSelection } from "./context.js";
+export { createRuntimeContext, generateRuntimeRunId, resolveWorkflowSelection };

package/dist/runtime/contracts/index.d.ts

@@ -1 +1,2 @@
-import { AcceptanceCriterion, HookRuntimePolicy, NodeExecutionState, NodeStatus, PipelineRuntimeEvent, PipelineRuntimeObservabilityLevel, PipelineRuntimeOptions, PipelineRuntimeResult, PipelineTaskContext, RuntimeFailure, RuntimeGateResult, RuntimeNodeResult, RuntimeStructuredOutput, UnmetCriterion } from "./contracts.js";
+import { AcceptanceCriterion, HookRuntimePolicy, NodeExecutionState, NodeStatus, PipelineRuntimeEvent, PipelineRuntimeObservabilityLevel, PipelineRuntimeOptions, PipelineRuntimeResult, PipelineTaskContext, RuntimeFailure, RuntimeGateResult, RuntimeNodeResult, RuntimeStructuredOutput, UnmetCriterion } from "./contracts.js";
+export { AcceptanceCriterion, HookRuntimePolicy, NodeExecutionState, NodeStatus, PipelineRuntimeEvent, PipelineRuntimeObservabilityLevel, PipelineRuntimeOptions, PipelineRuntimeResult, PipelineTaskContext, RuntimeFailure, RuntimeGateResult, RuntimeNodeResult, RuntimeStructuredOutput, UnmetCriterion };

package/dist/runtime/drain-merge/index.js

@@ -1,2 +1,2 @@
-import "./drain-merge.js";
-export {};
+import { executeDrainMergeBuiltin } from "./drain-merge.js";
+export { executeDrainMergeBuiltin };

package/dist/runtime/durable-store/acquisition.js

@@ -1,9 +1,10 @@
 import { requireMokaDbUrl } from "../../moka-global-config.js";
+import { migratePostgresSubstrate } from "./postgres/migrate-substrate.js";
 import { postgresDurableRunStore } from "./postgres/postgres-store.js";
 import { Effect } from "effect";
 //#region src/runtime/durable-store/acquisition.ts
 function resolveDurableStore(dbUrl, runId) {
-	return requireMokaDbUrl(dbUrl).pipe(Effect.flatMap((requiredDbUrl) => Effect.acquireRelease(Effect.tryPromise(() => postgresDurableRunStore(requiredDbUrl, runId)), (store) => Effect.promise(() => store.close()))));
+	return requireMokaDbUrl(dbUrl).pipe(Effect.flatMap((requiredDbUrl) => Effect.tryPromise(() => migratePostgresSubstrate(requiredDbUrl)).pipe(Effect.flatMap(() => Effect.acquireRelease(Effect.tryPromise(() => postgresDurableRunStore(requiredDbUrl, runId)), (store) => Effect.promise(() => store.close()))))));
 }
 //#endregion
 export { resolveDurableStore };

package/dist/runtime/durable-store/postgres/migrate-substrate.js

@@ -0,0 +1,29 @@
+import { fileURLToPath } from "node:url";
+import { drizzle } from "drizzle-orm/postgres-js";
+import { migrate } from "drizzle-orm/postgres-js/migrator";
+import postgres from "postgres";
+//#region src/runtime/durable-store/postgres/migrate-substrate.ts
+const migrationsFolder = fileURLToPath(new URL("./migrations", import.meta.url));
+const MIGRATION_LOCK_KEY = 8942017;
+/**
+* Apply the Drizzle migrations shared by the run-control and durable stores to
+* `dbUrl`. Idempotent (Drizzle tracks applied migrations in
+* `__drizzle_migrations` by content hash) and safe under concurrent callers
+* (Postgres advisory lock serializes them). Opens and closes its own
+* single-connection client.
+*/
+async function migratePostgresSubstrate(dbUrl) {
+	const client = postgres(dbUrl, { max: 1 });
+	try {
+		await client`select pg_advisory_lock(${MIGRATION_LOCK_KEY}::bigint)`;
+		try {
+			await migrate(drizzle(client), { migrationsFolder });
+		} finally {
+			await client`select pg_advisory_unlock(${MIGRATION_LOCK_KEY}::bigint)`;
+		}
+	} finally {
+		await client.end();
+	}
+}
+//#endregion
+export { migratePostgresSubstrate };

package/dist/runtime/durable-store/postgres/postgres-store.js

@@ -1,15 +1,13 @@
+import "./migrate-substrate.js";
 import { createSerializedWriteQueue } from "../../../serialized-write-queue.js";
 import { buildRunJournal } from "../../run-journal.js";
 import { durableNodeRecord, durableRun } from "./schema.js";
-import { fileURLToPath } from "node:url";
-import { eq } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/postgres-js";
-import "drizzle-orm/postgres-js/migrator";
 import postgres from "postgres";
+import { eq } from "drizzle-orm";
 import pino from "pino";
 //#region src/runtime/durable-store/postgres/postgres-store.ts
 const logger = pino({ name: "postgres-durable-store" });
-fileURLToPath(new URL("./migrations", import.meta.url));
 function openClient(dbUrl) {
 	return postgres(dbUrl, { max: 1 });
 }

package/dist/runtime/events/events.js

@@ -3,7 +3,7 @@ import { runtimeActorId } from "../actor-ids.js";
 import { parseRuntimeOutput, validateJsonSchemaSource } from "../json-validation/json-validation.js";
 import "../json-validation/index.js";
 //#region src/runtime/events/events.ts
-const warningRuntimeObservabilityTypes = new Set([
+const warningRuntimeObservabilityTypes = /* @__PURE__ */ new Set([
 	"runtime.gate.cancelled",
 	"runtime.gate.failed",
 	"runtime.hook.failed",
@@ -15,7 +15,7 @@ const primaryRuntimeObservabilityPrefixes = [
 	"runtime.hook.",
 	"runtime.state."
 ];
-const structuredOutputFormats = new Set([
+const structuredOutputFormats = /* @__PURE__ */ new Set([
 	"json",
 	"json_schema",
 	"jsonl"

package/dist/runtime/events/index.js

@@ -1,2 +1,2 @@
-import "./events.js";
-export {};
+import { childReporter, createPublicRuntimeObservabilityEmitter, emit, emitAgentFinish, emitAgentStart, emitGateFinish, emitGateStart, emitNodeFinish, emitNodeOutputRecorded, emitNodeStart, emitWorkflowFinish, emitWorkflowPlanned, emitWorkflowStarted, runtimeNodeActorDescriptor, runtimeSystemId } from "./events.js";
+export { childReporter, createPublicRuntimeObservabilityEmitter, emit, emitAgentFinish, emitAgentStart, emitGateFinish, emitGateStart, emitNodeFinish, emitNodeOutputRecorded, emitNodeStart, emitWorkflowFinish, emitWorkflowPlanned, emitWorkflowStarted, runtimeNodeActorDescriptor, runtimeSystemId };

package/dist/runtime/gates/index.js

@@ -1,5 +1,5 @@
-import "./contract.js";
-import "./gates.js";
-import "./registry.js";
-import "./orchestrator.js";
-export {};
+import { forKind } from "./contract.js";
+import { parseGateJson } from "./gates.js";
+import { evaluateGate, gateRegistry } from "./registry.js";
+import { evaluateNodeGates } from "./orchestrator.js";
+export { evaluateGate, evaluateNodeGates, forKind, gateRegistry, parseGateJson };

package/dist/runtime/gates/kinds/acceptance/acceptance.js

@@ -106,4 +106,4 @@ function hasNonEmptyEvidence(value) {
 	return Array.isArray(value) && value.filter((item) => typeof item === "string" && item.trim()).length > 0;
 }
 //#endregion
-export { evaluateAcceptanceGate };
+export { acceptanceUnmetCriteria, evaluateAcceptanceGate };

package/dist/runtime/hooks/command-hook.js

@@ -20,7 +20,7 @@ function hookEnv(hook, context) {
 	};
 }
 function commandHookEnvEntries(hook, context) {
-	return [...new Set([...context.hookPolicy.envPassthrough, ...hook.env?.passthrough ?? []])].flatMap(commandHookEnvEntry);
+	return [.../* @__PURE__ */ new Set([...context.hookPolicy.envPassthrough, ...hook.env?.passthrough ?? []])].flatMap(commandHookEnvEntry);
 }
 function commandHookEnvEntry(name) {
 	const value = process.env[name];

package/dist/runtime/hooks/index.js

@@ -1,2 +1,2 @@
-import "./hooks.js";
-export {};
+import { dispatchHooks } from "./hooks.js";
+export { dispatchHooks };

package/dist/runtime/json-validation/index.js

@@ -1,2 +1,2 @@
-import "./json-validation.js";
-export {};
+import { normalizeJsonSource, parseJsonObject, parseRuntimeOutput, readJsonSchemaSource, readOptionalFile, validateJsonSchemaSource } from "./json-validation.js";
+export { normalizeJsonSource, parseJsonObject, parseRuntimeOutput, readJsonSchemaSource, readOptionalFile, validateJsonSchemaSource };

package/dist/runtime/node-protocol/node-protocol.js

@@ -80,4 +80,4 @@ function parseSubmitResult(value) {
 	return submitResultSchema.parse(value);
 }
 //#endregion
-export { parseSubmitResult };
+export { parseSubmitResult, submitResultSchema };

package/dist/runtime/node-state-store.js

@@ -95,4 +95,4 @@ function pendingNodeState(id) {
 	};
 }
 //#endregion
-export { initialNodeStateStore };
+export { NodeStateStore, initialNodeStateStore };

package/dist/runtime/open-pull-request/index.js

@@ -1,2 +1,2 @@
-import "./open-pull-request.js";
-export {};
+import { executeOpenPullRequestBuiltin, openPullRequestProgram } from "./open-pull-request.js";
+export { executeOpenPullRequestBuiltin, openPullRequestProgram };

package/dist/runtime/opencode-session-executor.js

@@ -200,7 +200,7 @@ function promptBody(plan) {
 		...plan.variant ? { variant: plan.variant } : {}
 	};
 }
-const FLAGS_TAKING_VALUE = new Set([
+const FLAGS_TAKING_VALUE = /* @__PURE__ */ new Set([
 	"--agent",
 	"--dir",
 	"--file",

package/dist/runtime/parallel-node/index.js

@@ -1,2 +1,2 @@
-import "./parallel-node.js";
-export {};
+import { executeParallelNode } from "./parallel-node.js";
+export { executeParallelNode };

package/dist/runtime/retry.js

@@ -30,4 +30,4 @@ function decideNodeRetry(input) {
 	};
 }
 //#endregion
-export { decideNodeRetry, nodeRetryPolicy };
+export { decideNodeRetry, nodeRetryPolicy, retryDelayMs };

package/dist/runtime/scheduler.js

@@ -132,7 +132,7 @@ function computeReadyNodeIds(input) {
 	const completedIds = new Set((input.completed ?? []).map((r) => r.nodeId));
 	const runningIds = new Set(input.running ?? []);
 	const blockedIds = new Set(input.blocked ?? []);
-	const settled = new Set([...completedIds, ...runningIds]);
+	const settled = /* @__PURE__ */ new Set([...completedIds, ...runningIds]);
 	return orderedNodes(input.nodes).filter((node) => !(settled.has(node.id) || blockedIds.has(node.id))).filter((node) => node.needs.every((needId) => {
 		const result = (input.completed ?? []).find((r) => r.nodeId === needId);
 		if (result === void 0) return false;

package/dist/runtime/services/backlog-service.d.ts

@@ -13,4 +13,4 @@ declare const BacklogService_base: Context.ServiceClass<BacklogService, "Backlog
 }>;
 declare class BacklogService extends BacklogService_base {}
 //#endregion
-export { BacklogService };
+export { BacklogCommandError, BacklogService };

package/dist/runtime/services/backlog-service.js

@@ -21,4 +21,4 @@ const BacklogServiceLive = Layer.succeed(BacklogService, { run: (args, cwd) => E
 	try: () => execa("backlog", [...args], { cwd })
 }).pipe(Effect.map((result) => result.stdout)) });
 //#endregion
-export { BacklogService, BacklogServiceLive };
+export { BacklogCommandError, BacklogService, BacklogServiceLive };

package/dist/runtime/services/drain-merge-git-service.js

@@ -1,9 +1,9 @@
 import { Context, Effect, Layer } from "effect";
-import simpleGit$1 from "simple-git";
+import simpleGit from "simple-git";
 //#region src/runtime/services/drain-merge-git-service.ts
 var DrainMergeGitService = class extends Context.Service()("DrainMergeGitService") {};
 const DrainMergeGitServiceLive = Layer.succeed(DrainMergeGitService, { create: (baseDir) => Effect.sync(() => {
-	const git = simpleGit$1({ baseDir });
+	const git = simpleGit({ baseDir });
 	return { raw: (args) => Effect.tryPromise(() => git.raw(args)) };
 }) });
 //#endregion

package/dist/runtime/services/kubernetes-argo-service.js

@@ -62,6 +62,10 @@ function resolveKubeConfig(options, dependencies) {
 	const kubeConfig = new KubeConfig();
 	if (options.kubeconfigPath) kubeConfig.loadFromFile(options.kubeconfigPath);
 	else kubeConfig.loadFromDefault();
+	if (options.kubeContext) {
+		if (!kubeConfig.getContextObject(options.kubeContext)) throw new Error(`Kube context '${options.kubeContext}' was not found in the resolved kubeconfig`);
+		kubeConfig.setCurrentContext(options.kubeContext);
+	}
 	return kubeConfig;
 }
 function apiClients(options, dependencies) {
@@ -96,4 +100,4 @@ function kubectlErrorStdout(error) {
 	return (error.stdout || "").trim();
 }
 //#endregion
-export { KubernetesArgoService, KubernetesArgoServiceLive };
+export { KubernetesArgoService, KubernetesArgoServiceLive, resolveKubeConfig };

package/dist/runtime/services/run-journal-file-service.js

@@ -17,4 +17,4 @@ Layer.succeed(RunJournalFileService, {
 	})
 });
 //#endregion
-export {};
+export { RunJournalFileService };

package/dist/tickets/backlog-task-store.js

@@ -127,4 +127,4 @@ function storeError(path, message) {
 	});
 }
 //#endregion
-export { loadBacklogTaskStoreEffect };
+export { BacklogTaskStoreError, loadBacklogTaskStoreEffect };

package/dist/tickets/completion/complete-ticket.js

@@ -93,4 +93,4 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
-export { backlogTicketCompletionStoreEffect, completeTicket, conservativeLayerAJudge };
+export { TicketCompletionError, backlogTicketCompletionStoreEffect, completeTicket, conservativeLayerAJudge };

package/dist/tickets/ticket-graph.js

@@ -21,7 +21,7 @@ function sequenceTicketBatchesEffect(graph, ticketIds = dependencyGraphNodeIds(g
 function scopedTicketIds(graph, rootId) {
 	if (!rootId) return dependencyGraphNodeIds(graph.dependencyGraph).sort(compareTaskIds);
 	if (!dependencyGraphHasNode(graph.dependencyGraph, rootId)) return [];
-	const ids = new Set([rootId]);
+	const ids = /* @__PURE__ */ new Set([rootId]);
 	const visit = (id) => {
 		for (const child of graph.childrenByParentId.get(id) ?? []) {
 			ids.add(child.id);
@@ -71,4 +71,4 @@ function compareTasks(a, b) {
 	return compareBacklogTasks(a, b);
 }
 //#endregion
-export { buildTicketGraphEffect, compareTaskIds, predecessorIds, scopedTicketIds, sequenceTicketBatchesEffect };
+export { TicketGraphError, buildTicketGraphEffect, compareTaskIds, predecessorIds, scopedTicketIds, sequenceTicketBatchesEffect };

package/dist/tickets/ticket-plan.d.ts

@@ -41,4 +41,4 @@ declare const ticketPlanSchema: z.ZodObject<{
 }, z.core.$strict>;
 type TicketPlan = z.output<typeof ticketPlanSchema>;
 //#endregion
-export { TicketPlan };
+export { TicketPlan, ticketPlanSchema };

package/docs/adr-two-stage-submit-scheduling.md

@@ -0,0 +1,112 @@
+# ADR: Two-Stage `moka submit` — Schedule-Then-Dispatch
+
+Status: Accepted
+
+Date: 2026-07-01
+
+## Decision
+
+`moka submit` is one flow with two stages, not two separate commands and not two
+separate code paths:
+
+1. **Schedule** — research, planning, and graph generation, producing a
+   `ScheduleArtifact` and persisting it to the durable Postgres run-control
+   store before any Argo Workflow exists.
+2. **Dispatch** — compile the persisted (or explicitly supplied) schedule into
+   an Argo Workflow manifest and submit it, targeting whatever Kubernetes
+   cluster/context the operator configured.
+
+Both stages run inside the single call chain:
+
+```
+moka submit [args]
+  -> registerSubmitCommand()            src/cli/program.ts:71
+  -> runMokaSubmitFromCli()             src/cli/submit-options.ts:55
+  -> submitMoka()                       src/moka-submit.ts:238
+  -> submitParsedMoka()                 src/remote/submit/service.ts:47
+       - compileMokaSubmitPlan()        src/remote/submit/compilation.ts:32
+       - upsertRunRecord()  [Schedule -> DB]
+       - submitCompiledMokaWorkflow()   src/remote/submit/argo-submission.ts:46  [Dispatch]
+```
+
+There is exactly one WorkflowSpec builder chain (`buildRunnerArgoWorkflowManifest`
+/ `buildDynamicRunnerArgoWorkflowManifest` in `src/argo-workflow.ts`) and exactly
+one Kubernetes/Argo client (`KubernetesArgoService` in
+`src/runtime/services/kubernetes-argo-service.ts`). Static and dynamic
+scheduling are a discriminated union (`dynamicScheduling: boolean` on
+`CompiledMokaSubmitPlan`), not parallel implementations.
+
+## Stage 1 — Schedule (research -> planning -> graph, persisted)
+
+When no `scheduleYaml`/`schedulePath` is supplied at submit time
+(`dynamicScheduling: true`), the schedule is produced inside the runner pod by
+three sequential phases, run via `moka runner-pre-schedule --phase <phase>`
+(`src/runner-command/pre-schedule.ts`):
+
+1. `pre-research` — produces research context (findings, risks, target).
+2. `pre-planning` — consumes research, produces a `TicketPlan` (tickets +
+   dependencies), via `ticketPlanPlanningContext()`
+   (`src/planning/generate.ts:343`).
+3. `generate-schedule` — calls the configured planner profile to produce the
+   final `ScheduleArtifact`. If the planner fails or emits an invalid
+   artifact, `ticketPlanScheduleArtifact()` (`src/planning/generate.ts:497`)
+   deterministically derives a schedule directly from the `TicketPlan` graph
+   instead — this is the accepted fallback shape, not a patch to remove.
+
+The result is written once via `publishSchedule()`
+(`src/run-control/run-control-store.ts:60`) into the run's manifest
+(`moka_run_control_run.manifest` JSONB). `publishSchedule` is idempotent for an
+identical schedule and rejects a conflicting one for the same run
+(`tests/run-control-store-contract.test.ts:423`).
+
+## Stage 2 — Dispatch (compile -> submit)
+
+`submitParsedMoka()` (`src/remote/submit/service.ts:47`) upserts the run record
+to Postgres **before** calling Argo, but a DB write failure never blocks
+dispatch — the guard at `service.ts:56-61` logs and proceeds, because the
+in-pod runner lifecycle (`src/runner-command/lifecycle.ts`) re-creates the same
+run record idempotently once the pod starts. Postgres is a durability/inspection
+substrate for `moka status`/`moka logs`/`moka resume`, not a precondition for
+submission.
+
+`submitCompiledMokaWorkflow()` then calls `submitRunnerArgoWorkflow()` (static,
+schedule already known) or `submitDynamicRunnerArgoWorkflow()` (dynamic,
+schedule generated in-pod) — both in `src/argo-submit.ts`, both routed through
+the same `KubernetesArgoService`.
+
+## Cluster targeting is one seam, not per-caller
+
+Kubernetes context/kubeconfig resolution is a single function,
+`resolveKubeConfig()` (`src/runtime/services/kubernetes-argo-service.ts`), used
+by every Argo/K8s call (`createConfigMap`, `createWorkflow`,
+`getWorkflowPhase`). Precedence, highest wins:
+
+1. `--kube-context <name>` / `--kubeconfig <path>` CLI flags
+   (`src/cli/submit-options.ts`)
+2. `momokaya.kubernetes.context` / `momokaya.kubernetes.kubeconfig` in
+   `~/.config/moka/config.yaml` (`src/moka-global-config.ts`)
+3. The kubeconfig's own `current-context` (`KubeConfig.loadFromDefault()`)
+
+An unresolvable `kubeContext` fails loud at resolution time (`kubeConfig.
+getContextObject()` check) rather than silently falling through to whatever
+context happened to be current — this is what makes "point submit at momokaya
+or at a local orbstack context" a config change, never a code change. Prior to
+this ADR, `kubeContext` existed for the `kubectl`-shellout polling path
+(`cluster-doctor.ts`) but not for the actual submission API calls; that gap is
+closed as part of this decision.
+
+## Consequences
+
+- Do not add a second "generate the graph" path or a second Argo client.
+  Static vs. dynamic scheduling is a data flag on `CompiledMokaSubmitPlan`, not
+  a reason to fork the builder or the service.
+- Do not gate submission on the DB write succeeding — the guard in
+  `service.ts` is intentional, not a missing try/catch to "fix".
+- Any new cluster-targeting option (a third context source, a per-namespace
+  override) is added to `resolveKubeConfig`'s precedence list, not threaded
+  ad hoc through individual call sites.
+
+## References
+
+- Run-control persistence model: `./run-control.md`
+- PIPE-94 durable substrate: `oisin-ee` backlog PIPE-94.3/94.4/94.5/94.8

package/package.json

@@ -32,6 +32,8 @@
   "devDependencies": {
     "@biomejs/biome": "2.4.15",
     "@effect/vitest": "^4.0.0-beta.90",
+    "@mpsuesser/oxlint-plugin-effect": "0.3.0",
+    "@oisin-ee/oxlint-config": "1.0.0",
     "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/exec": "^7.1.0",
     "@semantic-release/github": "^12.0.8",
@@ -42,6 +44,9 @@
     "@typescript/native-preview": "7.0.0-dev.20260629.1",
     "drizzle-kit": "0.31.10",
     "jscpd": "^4.0.5",
+    "oxfmt": "^0.56.0",
+    "oxlint": "^1.71.0",
+    "oxlint-tsgolint": "^0.23.0",
     "semantic-release": "^25.0.3",
     "tsdown": "^0.22.0",
     "typescript": "rc",
@@ -132,7 +137,7 @@
     "prepack": "nub run build:cli"
   },
   "type": "module",
-  "version": "3.19.4",
+  "version": "3.19.6",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",