@oisincoveney/pipeline 3.21.0 → 3.23.0

package/README.md

@@ -44,12 +44,12 @@ Initialize package-owned pipeline support:
 moka init
 ```
 
-`moka init` installs or refreshes the whole per-machine harness in one step:
-the package's default skills, generated host command surfaces, the singleton
-`pipeline-gateway` MCP entry, copied hook files from private
-`oisin-ee/agent/hooks`, and global instruction files from `oisin-ee/agent/rules`.
-OpenCode is the package default runtime. The command does not create repo-local
-`.pipeline` config files.
+`moka init` installs or refreshes Moka-owned host adapters: `/moka-quick`,
+`/moka-execute`, and `/moka-inspect` command surfaces, native-agent projections,
+and the singleton `pipeline-gateway` MCP host config. It does not install the
+shared agent harness; skills, hooks, rules, and Claude settings come from
+`oisin-ee/agent` via chezmoi. OpenCode is the package default runtime. The
+command does not create repo-local `.pipeline` config files.
 
 The default MCP gateway can run locally or point at the hosted Momokaya gateway.
 Set `PIPELINE_MCP_GATEWAY_AUTHORIZATION` to the full HTTP `Authorization` header
@@ -59,14 +59,14 @@ value before starting OpenCode when using a protected gateway:
 export PIPELINE_MCP_GATEWAY_AUTHORIZATION="Basic $(printf '%s' 'user:password' | base64)"
 ```
 
-Verify the generated harness (commands, hooks, rules) is current after package
-upgrades or edits to `oisin-ee/agent`, without writing anything:
+Verify generated Moka host adapters are current after package upgrades, without
+writing anything:
 
 ```shell
 moka init --check
 ```
 
-Refresh it, overwriting any locally edited harness files:
+Refresh generated Moka host adapters, overwriting locally edited adapter files:
 
 ```shell
 moka init --force
@@ -107,10 +107,10 @@ Canonical commands:
 - `moka stop <run-id> [node-id]`: abort a run or one active node.
 - `moka export <run-id> --sanitize`: print a portable evidence bundle.
 - `moka doctor`: check local prerequisites and config health.
-- `moka init`: install or refresh the whole per-machine harness (skills,
-  command surfaces, hooks, rules). `--check` verifies without writing,
-  `--dry-run` previews, `--force` overwrites locally edited files. The harness
-  is always installed globally; there is no `--scope`.
+- `moka init`: install or refresh Moka-owned host adapters (command surfaces,
+  native-agent projections, and gateway config). `--check` verifies without
+  writing, `--dry-run` previews, `--force` overwrites locally edited adapter
+  files. The shared agent harness is installed separately by chezmoi.
 
 ```shell
 moka run "Implement PIPE-123 user-facing behavior"
@@ -197,10 +197,10 @@ For a compact command reference, see
 ## Momokaya Runner Image
 
 The package is also the runner code used by the Momokaya runner image. The
-control plane owns Argo Workflow submission, run listing, cancellation, event
-storage, Kueue discovery, and UI rendering. This package owns the in-container
-`moka runner-command` and `moka runner-finalize` commands used by Argo Workflow
-DAG tasks.
+control plane owns Argo Workflow submission, status observation, run listing,
+cancellation, event storage, and UI rendering. This package owns the
+in-container `moka runner-command` and `moka runner-finalize` commands used by
+Argo Workflow DAG tasks.
 
 Argo starts the image with payload, schedule, and per-task descriptor files
 mounted from ConfigMaps, plus the event auth token mounted from a Secret. The

package/dist/argo-submit.d.ts

@@ -5,6 +5,7 @@ import { z } from "zod";
 
 //#region src/argo-submit.d.ts
 declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
+  activeDeadlineSeconds: z.ZodOptional<z.ZodNumber>;
   brokerAuth: z.ZodObject<{
     secretKey: z.ZodDefault<z.ZodString>;
     secretName: z.ZodString;
@@ -36,10 +37,38 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   namespace: z.ZodString;
   npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadJson: z.ZodString;
+  podGC: z.ZodOptional<z.ZodObject<{
+    deleteDelayDuration: z.ZodOptional<z.ZodString>;
+    labelSelector: z.ZodOptional<z.ZodObject<{
+      matchExpressions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        operator: z.ZodEnum<{
+          DoesNotExist: "DoesNotExist";
+          Exists: "Exists";
+          In: "In";
+          NotIn: "NotIn";
+        }>;
+        values: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      }, z.core.$strict>>>;
+      matchLabels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strict>>;
+    strategy: z.ZodOptional<z.ZodEnum<{
+      OnPodCompletion: "OnPodCompletion";
+      OnPodSuccess: "OnPodSuccess";
+      OnWorkflowCompletion: "OnWorkflowCompletion";
+      OnWorkflowSuccess: "OnWorkflowSuccess";
+    }>>;
+  }, z.core.$strict>>;
   serviceAccountName: z.ZodOptional<z.ZodString>;
+  ttlStrategy: z.ZodOptional<z.ZodObject<{
+    secondsAfterCompletion: z.ZodOptional<z.ZodNumber>;
+    secondsAfterFailure: z.ZodOptional<z.ZodNumber>;
+    secondsAfterSuccess: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strict>>;
   scheduleYaml: z.ZodString;
 }, z.core.$strict>;
 declare const submitDynamicRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
+  activeDeadlineSeconds: z.ZodOptional<z.ZodNumber>;
   brokerAuth: z.ZodObject<{
     secretKey: z.ZodDefault<z.ZodString>;
     secretName: z.ZodString;
@@ -71,7 +100,34 @@ declare const submitDynamicRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   namespace: z.ZodString;
   npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadJson: z.ZodString;
+  podGC: z.ZodOptional<z.ZodObject<{
+    deleteDelayDuration: z.ZodOptional<z.ZodString>;
+    labelSelector: z.ZodOptional<z.ZodObject<{
+      matchExpressions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        operator: z.ZodEnum<{
+          DoesNotExist: "DoesNotExist";
+          Exists: "Exists";
+          In: "In";
+          NotIn: "NotIn";
+        }>;
+        values: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      }, z.core.$strict>>>;
+      matchLabels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strict>>;
+    strategy: z.ZodOptional<z.ZodEnum<{
+      OnPodCompletion: "OnPodCompletion";
+      OnPodSuccess: "OnPodSuccess";
+      OnWorkflowCompletion: "OnWorkflowCompletion";
+      OnWorkflowSuccess: "OnWorkflowSuccess";
+    }>>;
+  }, z.core.$strict>>;
   serviceAccountName: z.ZodOptional<z.ZodString>;
+  ttlStrategy: z.ZodOptional<z.ZodObject<{
+    secondsAfterCompletion: z.ZodOptional<z.ZodNumber>;
+    secondsAfterFailure: z.ZodOptional<z.ZodNumber>;
+    secondsAfterSuccess: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strict>>;
   workflowId: z.ZodString;
 }, z.core.$strict>;
 declare const commandScheduleOptionsSchema: z.ZodObject<{

package/dist/argo-submit.js

@@ -1,5 +1,5 @@
 import { ArgoGraphCompilerError, compileArgoExecutionGraph } from "./argo-graph.js";
-import { dbAuthOptionSchema, mcpGatewayAuthOptionSchema } from "./remote/argo/model.js";
+import { argoWorkflowActiveDeadlineSecondsSchema, argoWorkflowPodGcSchema, argoWorkflowTtlStrategySchema, dbAuthOptionSchema, mcpGatewayAuthOptionSchema } from "./remote/argo/model.js";
 import { brokerAuthOptionSchema } from "./credentials/broker.js";
 import { appendPullRequestDelivery } from "./schedule/passes/open-pull-request.js";
 import { compileScheduleArtifact, parseScheduleArtifact } from "./planning/generate.js";
@@ -25,11 +25,19 @@ const configMapSchema = z.object({
 		namespace: z.string().min(1)
 	}).strict()
 }).strict();
+const workflowOwnerReferenceSchema = z.object({
+	apiVersion: z.literal("argoproj.io/v1alpha1"),
+	kind: z.literal("Workflow"),
+	name: z.string().min(1),
+	uid: z.string().min(1)
+}).strict();
+const configMapOwnerReferencesPatchSchema = z.object({ metadata: z.object({ ownerReferences: z.tuple([workflowOwnerReferenceSchema]) }).strict() }).strict();
 const createdWorkflowSchema = z.object({ metadata: z.object({
 	name: z.string().min(1).optional(),
 	uid: z.string().min(1).optional()
 }).passthrough() }).passthrough();
 const submitRunnerArgoWorkflowBaseOptionShape = {
+	activeDeadlineSeconds: argoWorkflowActiveDeadlineSecondsSchema.optional(),
 	brokerAuth: brokerAuthOptionSchema,
 	dbAuth: dbAuthOptionSchema.optional(),
 	eventAuthSecretKey: z.string().min(1).optional(),
@@ -51,7 +59,9 @@ const submitRunnerArgoWorkflowBaseOptionShape = {
 	namespace: z.string().min(1),
 	npmRegistryAuthSecretName: z.string().min(1).optional(),
 	payloadJson: z.string().min(1),
-	serviceAccountName: z.string().min(1).optional()
+	podGC: argoWorkflowPodGcSchema.optional(),
+	serviceAccountName: z.string().min(1).optional(),
+	ttlStrategy: argoWorkflowTtlStrategySchema.optional()
 };
 const submitRunnerArgoWorkflowOptionsSchema = z.object({
 	...submitRunnerArgoWorkflowBaseOptionShape,
@@ -102,6 +112,7 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 			"pipeline.oisin.dev/ticket-project": payload.run.project,
 			"pipeline.oisin.dev/ticket-title": payload.task.title
 		} : {},
+		activeDeadlineSeconds: options.activeDeadlineSeconds,
 		brokerAuth: options.brokerAuth,
 		dbAuth: options.dbAuth,
 		mcpGatewayAuth: options.mcpGatewayAuth,
@@ -121,51 +132,21 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		plan: compiled.plan,
 		scheduleConfigMapName: scheduleArtifactConfigMapName,
 		serviceAccountName: options.serviceAccountName,
-		taskDescriptorConfigMapName
+		taskDescriptorConfigMapName,
+		ttlStrategy: options.ttlStrategy
 	});
 	return Effect.gen(function* () {
-		const service = yield* KubernetesArgoService;
 		const graph = yield* graphEffect;
-		yield* service.createConfigMap({
-			body: configMapSchema.parse({
-				apiVersion: "v1",
-				data: { "payload.json": payloadJson },
-				kind: "ConfigMap",
-				metadata: {
-					labels,
-					name: payloadConfigMapName,
-					namespace: options.namespace
-				}
-			}),
-			dependencies,
-			namespace: options.namespace,
-			options
-		});
-		yield* service.createConfigMap({
-			body: configMapSchema.parse({
-				apiVersion: "v1",
-				data: Object.fromEntries(graph.tasks.map((task) => [`${task.taskName}.json`, `${JSON.stringify(buildRunnerTaskDescriptor(task.nodeId))}\n`])),
-				kind: "ConfigMap",
-				metadata: {
-					labels,
-					name: taskDescriptorConfigMapName,
-					namespace: options.namespace
-				}
-			}),
-			dependencies,
-			namespace: options.namespace,
-			options
-		});
-		yield* service.createConfigMap({
-			body: configMapSchema.parse({
-				apiVersion: "v1",
-				data: { "schedule.yaml": options.scheduleYaml },
-				kind: "ConfigMap",
-				metadata: {
-					labels,
-					name: scheduleArtifactConfigMapName,
-					namespace: options.namespace
-				}
+		const createdConfigMapNames = yield* createRunConfigMaps({
+			configMaps: staticRunConfigMaps({
+				labels,
+				namespace: options.namespace,
+				payloadConfigMapName,
+				payloadJson,
+				scheduleConfigMapName: scheduleArtifactConfigMapName,
+				scheduleYaml: options.scheduleYaml,
+				taskDescriptorConfigMapName,
+				tasks: graph.tasks
 			}),
 			dependencies,
 			namespace: options.namespace,
@@ -180,8 +161,21 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 				scheduleConfigMapName: scheduleArtifactConfigMapName,
 				taskDescriptorConfigMapName
 			},
-			workflow
-		});
+			workflow,
+			workflowFieldOverrides: { podGC: options.podGC }
+		}).pipe(Effect.flatMap((result) => ownRunConfigMaps({
+			configMapNames: createdConfigMapNames,
+			dependencies,
+			namespace: options.namespace,
+			options,
+			result
+		})), Effect.catch((error) => cleanupRunConfigMapsOnFailure({
+			configMapNames: createdConfigMapNames,
+			dependencies,
+			error,
+			namespace: options.namespace,
+			options
+		})));
 	});
 }
 function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
@@ -199,12 +193,14 @@ function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		"pipeline.oisin.dev/source": "argo-workflow",
 		"pipeline.oisin.dev/workflow": options.workflowId
 	};
+	const annotations = payload.task.kind === "ticket" ? {
+		"pipeline.oisin.dev/ticket-id": payload.task.id,
+		"pipeline.oisin.dev/ticket-project": payload.run.project,
+		"pipeline.oisin.dev/ticket-title": payload.task.title
+	} : {};
 	const workflow = buildDynamicRunnerArgoWorkflowManifest({
-		annotations: payload.task.kind === "ticket" ? {
-			"pipeline.oisin.dev/ticket-id": payload.task.id,
-			"pipeline.oisin.dev/ticket-project": payload.run.project,
-			"pipeline.oisin.dev/ticket-title": payload.task.title
-		} : {},
+		activeDeadlineSeconds: options.activeDeadlineSeconds,
+		annotations,
 		brokerAuth: options.brokerAuth,
 		dbAuth: options.dbAuth,
 		eventAuthSecretKey: options.eventAuthSecretKey,
@@ -222,19 +218,16 @@ function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		npmRegistryAuthSecretName: options.npmRegistryAuthSecretName,
 		payloadConfigMapName,
 		serviceAccountName: options.serviceAccountName,
+		ttlStrategy: options.ttlStrategy,
 		workflowId: options.workflowId
 	});
 	return Effect.gen(function* () {
-		yield* (yield* KubernetesArgoService).createConfigMap({
-			body: configMapSchema.parse({
-				apiVersion: "v1",
-				data: { "payload.json": payloadJson },
-				kind: "ConfigMap",
-				metadata: {
-					labels,
-					name: payloadConfigMapName,
-					namespace: options.namespace
-				}
+		const createdConfigMapNames = yield* createRunConfigMaps({
+			configMaps: dynamicRunConfigMaps({
+				labels,
+				namespace: options.namespace,
+				payloadConfigMapName,
+				payloadJson
 			}),
 			dependencies,
 			namespace: options.namespace,
@@ -245,23 +238,169 @@ function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 			namespace: options.namespace,
 			options,
 			resultExtras: { payloadConfigMapName },
-			workflow
-		});
+			workflow,
+			workflowFieldOverrides: { podGC: options.podGC }
+		}).pipe(Effect.flatMap((result) => ownRunConfigMaps({
+			configMapNames: createdConfigMapNames,
+			dependencies,
+			namespace: options.namespace,
+			options,
+			result
+		})), Effect.catch((error) => cleanupRunConfigMapsOnFailure({
+			configMapNames: createdConfigMapNames,
+			dependencies,
+			error,
+			namespace: options.namespace,
+			options
+		})));
 	});
 }
+function staticRunConfigMaps(input) {
+	return [
+		runConfigMap({
+			data: { "payload.json": input.payloadJson },
+			labels: input.labels,
+			name: input.payloadConfigMapName,
+			namespace: input.namespace
+		}),
+		runConfigMap({
+			data: Object.fromEntries(input.tasks.map((task) => [`${task.taskName}.json`, `${JSON.stringify(buildRunnerTaskDescriptor(task.nodeId))}\n`])),
+			labels: input.labels,
+			name: input.taskDescriptorConfigMapName,
+			namespace: input.namespace
+		}),
+		runConfigMap({
+			data: { "schedule.yaml": input.scheduleYaml },
+			labels: input.labels,
+			name: input.scheduleConfigMapName,
+			namespace: input.namespace
+		})
+	];
+}
+function dynamicRunConfigMaps(input) {
+	return [runConfigMap({
+		data: { "payload.json": input.payloadJson },
+		labels: input.labels,
+		name: input.payloadConfigMapName,
+		namespace: input.namespace
+	})];
+}
+function runConfigMap(input) {
+	return {
+		body: configMapSchema.parse({
+			apiVersion: "v1",
+			data: input.data,
+			kind: "ConfigMap",
+			metadata: {
+				labels: input.labels,
+				name: input.name,
+				namespace: input.namespace
+			}
+		}),
+		name: input.name
+	};
+}
+function createRunConfigMaps(input) {
+	const createdConfigMapNames = [];
+	return Effect.gen(function* () {
+		const service = yield* KubernetesArgoService;
+		yield* Effect.forEach(input.configMaps, (configMap) => service.createConfigMap({
+			body: configMap.body,
+			dependencies: input.dependencies,
+			namespace: input.namespace,
+			options: input.options
+		}).pipe(Effect.tap(() => Effect.sync(() => {
+			createdConfigMapNames.push(configMap.name);
+		}))));
+		return createdConfigMapNames;
+	}).pipe(Effect.catch((error) => cleanupRunConfigMapsOnFailure({
+		configMapNames: createdConfigMapNames,
+		dependencies: input.dependencies,
+		error,
+		namespace: input.namespace,
+		options: input.options
+	})));
+}
+function ownRunConfigMaps(input) {
+	return patchRunConfigMapOwnerReferences({
+		body: configMapOwnerReferencesPatch(workflowOwnerReference(input.result)),
+		configMapNames: input.configMapNames,
+		dependencies: input.dependencies,
+		namespace: input.namespace,
+		options: input.options
+	}).pipe(Effect.as(input.result));
+}
+function cleanupRunConfigMapsOnFailure(input) {
+	return deleteRunConfigMaps({
+		configMapNames: input.configMapNames,
+		dependencies: input.dependencies,
+		namespace: input.namespace,
+		options: input.options
+	}).pipe(Effect.catch((cleanupError) => Effect.fail(/* @__PURE__ */ new Error(`Failed to clean up ConfigMaps after submit failure: ${errorMessage(input.error)}; cleanup failed: ${errorMessage(cleanupError)}`))), Effect.flatMap(() => Effect.fail(input.error)));
+}
+function patchRunConfigMapOwnerReferences(input) {
+	return Effect.gen(function* () {
+		const service = yield* KubernetesArgoService;
+		return yield* Effect.all(input.configMapNames.map((name) => service.patchConfigMapOwnerReferences({
+			body: input.body,
+			dependencies: input.dependencies,
+			name,
+			namespace: input.namespace,
+			options: input.options
+		})), { concurrency: "unbounded" });
+	});
+}
+function deleteRunConfigMaps(input) {
+	return Effect.gen(function* () {
+		const service = yield* KubernetesArgoService;
+		return yield* Effect.all(input.configMapNames.map((name) => service.deleteConfigMap({
+			dependencies: input.dependencies,
+			name,
+			namespace: input.namespace,
+			options: input.options
+		})), { concurrency: "unbounded" });
+	});
+}
+function workflowOwnerReference(result) {
+	if (result.workflowUid === void 0) throw new Error(`Created Argo Workflow '${result.workflowName}' did not include metadata.uid; cannot own ConfigMaps`);
+	return workflowOwnerReferenceSchema.parse({
+		apiVersion: "argoproj.io/v1alpha1",
+		kind: "Workflow",
+		name: result.workflowName,
+		uid: result.workflowUid
+	});
+}
+function configMapOwnerReferencesPatch(ownerReference) {
+	return configMapOwnerReferencesPatchSchema.parse({ metadata: { ownerReferences: [ownerReference] } });
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
 function submitWorkflowManifest(input) {
 	return Effect.gen(function* () {
-		return workflowSubmitResult(yield* (yield* KubernetesArgoService).createWorkflow({
-			body: runnerArgoWorkflowManifestSchema.parse(input.workflow),
+		const service = yield* KubernetesArgoService;
+		const workflow = applyWorkflowFieldOverrides(input.workflow, input.workflowFieldOverrides);
+		return workflowSubmitResult(yield* service.createWorkflow({
+			body: runnerArgoWorkflowManifestSchema.parse(workflow),
 			dependencies: input.dependencies,
 			namespace: input.namespace,
 			options: input.options
-		}), input.workflow, {
+		}), workflow, {
 			namespace: input.namespace,
 			...input.resultExtras
 		});
 	});
 }
+function applyWorkflowFieldOverrides(workflow, overrides) {
+	if (overrides?.podGC === void 0) return workflow;
+	return runnerArgoWorkflowManifestSchema.parse({
+		...workflow,
+		spec: {
+			...workflow.spec,
+			podGC: overrides.podGC
+		}
+	});
+}
 function workflowSubmitResult(response, workflow, base) {
 	const created = createdWorkflowSchema.parse(response);
 	return workflowSubmitResultSchema.parse({

package/dist/argo-workflow.d.ts

@@ -126,6 +126,28 @@ declare const runnerArgoWorkflowManifestSchema: z.ZodObject<{
         }>;
       }, z.core.$strict>>;
     }, z.core.$strict>>;
+    podGC: z.ZodOptional<z.ZodObject<{
+      deleteDelayDuration: z.ZodOptional<z.ZodString>;
+      labelSelector: z.ZodOptional<z.ZodObject<{
+        matchExpressions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+          key: z.ZodString;
+          operator: z.ZodEnum<{
+            DoesNotExist: "DoesNotExist";
+            Exists: "Exists";
+            In: "In";
+            NotIn: "NotIn";
+          }>;
+          values: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>>;
+        matchLabels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+      }, z.core.$strict>>;
+      strategy: z.ZodOptional<z.ZodEnum<{
+        OnPodCompletion: "OnPodCompletion";
+        OnPodSuccess: "OnPodSuccess";
+        OnWorkflowCompletion: "OnWorkflowCompletion";
+        OnWorkflowSuccess: "OnWorkflowSuccess";
+      }>>;
+    }, z.core.$strict>>;
     ttlStrategy: z.ZodOptional<z.ZodObject<{
       secondsAfterCompletion: z.ZodOptional<z.ZodNumber>;
       secondsAfterFailure: z.ZodOptional<z.ZodNumber>;

package/dist/cli/factory-commands.js

@@ -0,0 +1,33 @@
+import { runCreateExperiment } from "../factory/create-experiment.js";
+import { runTemplateUpdate, summarizeTemplateUpdate } from "../factory/template-update.js";
+import { Option } from "commander";
+//#region src/cli/factory-commands.ts
+function registerFactoryCommands(program) {
+	program.command("create-experiment").description("Birth a fleet experiment: copier-stamp momokaya-template, create+push the org repo, register it in infra's fleet registry").requiredOption("--name <name>", "app name (kebab-case)").addOption(new Option("--flavor <flavor>", "app flavor").choices(["web", "expo-web"]).default("web")).option("--no-db", "skip the database surface").option("--no-previews", "skip per-PR preview environments").option("--org <org>", "GitHub org for the new repo").option("--template-src <source>", "copier template source").option("--template-ref <ref>", "template tag/ref (default: latest tag)").option("--infra-repo-url <url>", "infra repo the registry entry lands in").action(async (flags) => {
+		const result = await runCreateExperiment({
+			db: flags.db,
+			flavor: flags.flavor,
+			...flags.infraRepoUrl ? { infraRepoUrl: flags.infraRepoUrl } : {},
+			name: flags.name,
+			...flags.org ? { org: flags.org } : {},
+			previews: flags.previews,
+			...flags.templateRef ? { templateRef: flags.templateRef } : {},
+			...flags.templateSrc ? { templateSource: flags.templateSrc } : {}
+		});
+		console.log(`Experiment born: ${result.repoUrl} (registry ${result.registryPath} @ infra ${result.infraCommitSha})`);
+	});
+	program.command("template-update").description("Fan copier-update PRs out across repos stamped from momokaya-template").option("--repos <repos>", "comma-separated repo list (skips fleet-registry discovery)").option("--org <org>", "GitHub org the stamped repos live in").option("--template-match <substring>", "answers-file _src_path filter for stamp detection").option("--template-ref <ref>", "template tag/ref (default: latest tag)").option("--infra-repo-url <url>", "infra repo used for discovery").action(async (flags) => {
+		const { results } = await runTemplateUpdate({
+			...flags.infraRepoUrl ? { infraRepoUrl: flags.infraRepoUrl } : {},
+			...flags.org ? { org: flags.org } : {},
+			...flags.repos ? { repos: flags.repos.split(",").map((repo) => repo.trim()).filter((repo) => repo.length > 0) } : {},
+			...flags.templateMatch ? { templateMatch: flags.templateMatch } : {},
+			...flags.templateRef ? { templateRef: flags.templateRef } : {}
+		});
+		const { failed, opened } = summarizeTemplateUpdate(results);
+		console.log(`template-update: ${opened} PR(s) opened, ${failed} error(s)`);
+		if (failed > 0) process.exitCode = 1;
+	});
+}
+//#endregion
+export { registerFactoryCommands };

package/dist/cli/program.js

@@ -7,6 +7,7 @@ import { registerTicketCommand } from "../commands/ticket-command.js";
 import { addMokaSubmitOptions, runMokaSubmitFromCli } from "./submit-options.js";
 import { registerRunControlCommands } from "../run-control/commands.js";
 import { registerBootstrapCommands } from "./bootstrap-commands.js";
+import { registerFactoryCommands } from "./factory-commands.js";
 import { registerLoopCommand } from "./loop-commands.js";
 import { registerMcpGatewayCommands } from "./mcp-gateway-commands.js";
 import { registerPlanCommands } from "./plan-commands.js";
@@ -34,6 +35,7 @@ function registerApplicationCommands(program, options) {
 	registerMcpGatewayCommands(program);
 	registerSubmitCommand(program);
 	registerLoopCommand(program);
+	registerFactoryCommands(program);
 	registerRunnerCommandCommand(program);
 	registerBenchCommand(program);
 	registerTicketCommand(program, {

package/dist/commands/pipeline-command.js

@@ -10,7 +10,9 @@ const BUILTIN_PIPE_COMMANDS = /* @__PURE__ */ new Set([
 	"submit",
 	"argo",
 	"runner-command",
-	"ticket"
+	"ticket",
+	"create-experiment",
+	"template-update"
 ]);
 var EntrypointCommandService = class extends Context.Service()("EntrypointCommandService") {};
 const createEntrypointCommandServiceLive = (runEntrypoint) => Layer.succeed(EntrypointCommandService, { runEntrypoint: (entrypoint, task, opts) => Effect.tryPromise({

package/dist/commands/runner-command-command.js

@@ -51,7 +51,7 @@ function registerRunnerCommandCommand(program) {
 	program.command("runner-command").description("Run one scheduled Argo Workflow task").requiredOption("--payload-file <path>", "Path to the runner payload JSON").option("--node-id <id>", "Node id to execute without a task descriptor").option("--schedule-file <path>", "Path to the schedule artifact YAML").option("--schedule-source <source>", "Schedule source: file or db").action((options) => runRunnerProgram(runRunnerCommandEffect(options)));
 	program.command("runner-lifecycle").description("Run one Argo Workflow lifecycle phase").requiredOption("--phase <phase>", "Lifecycle phase to run").requiredOption("--payload-file <path>", "Path to the runner payload JSON").requiredOption("--schedule-file <path>", "Path to the schedule artifact YAML").action((options) => runRunnerProgram(runRunnerLifecycleEffect(options)));
 	program.command("runner-pre-schedule").description("Run one dynamic pre-schedule phase").requiredOption("--phase <phase>", "pre-research, pre-planning, or generate-schedule").requiredOption("--payload-file <path>", "Path to the runner payload JSON").action((options) => runRunnerProgram(runPreScheduleEffect(options)));
-	program.command("runner-finalize").description("Finalize one Argo Workflow run").requiredOption("--payload-file <path>", "Path to the runner payload JSON").option("--schedule-file <path>", "Path to the schedule artifact YAML").option("--schedule-source <source>", "Schedule source: file or db").requiredOption("--argo-status <status>", "Argo Workflow status").action((options) => runRunnerProgram(runRunnerFinalizeEffect(options)));
+	program.command("runner-finalize").description("Finalize one Argo Workflow run").requiredOption("--payload-file <path>", "Path to the runner payload JSON").option("--schedule-file <path>", "Path to the schedule artifact YAML").option("--schedule-source <source>", "Schedule source: file or db").requiredOption("--argo-status <status>", "Argo Workflow status").option("--argo-failures <json>", "Argo Workflow failure details JSON").action((options) => runRunnerProgram(runRunnerFinalizeEffect(options)));
 	program.command("runner-select-ready-wave").description("Select DB-ready nodes for the next dynamic Argo wave").requiredOption("--payload-file <path>", "Path to the runner payload JSON").requiredOption("--output-file <path>", "Path where the ready node id JSON array is written").action((options) => runRunnerProgram(runSelectReadyWaveEffect(options)));
 }
 //#endregion