@oisincoveney/pipeline 3.22.0 → 3.23.1

package/README.md

@@ -44,12 +44,12 @@ Initialize package-owned pipeline support:
 moka init
 ```
 
-`moka init` installs or refreshes the whole per-machine harness in one step:
-the package's default skills, generated host command surfaces, the singleton
-`pipeline-gateway` MCP entry, copied hook files from private
-`oisin-ee/agent/hooks`, and global instruction files from `oisin-ee/agent/rules`.
-OpenCode is the package default runtime. The command does not create repo-local
-`.pipeline` config files.
+`moka init` installs or refreshes Moka-owned host adapters: `/moka-quick`,
+`/moka-execute`, and `/moka-inspect` command surfaces, native-agent projections,
+and the singleton `pipeline-gateway` MCP host config. It does not install the
+shared agent harness; skills, hooks, rules, and Claude settings come from
+`oisin-ee/agent` via chezmoi. OpenCode is the package default runtime. The
+command does not create repo-local `.pipeline` config files.
 
 The default MCP gateway can run locally or point at the hosted Momokaya gateway.
 Set `PIPELINE_MCP_GATEWAY_AUTHORIZATION` to the full HTTP `Authorization` header
@@ -59,14 +59,14 @@ value before starting OpenCode when using a protected gateway:
 export PIPELINE_MCP_GATEWAY_AUTHORIZATION="Basic $(printf '%s' 'user:password' | base64)"
 ```
 
-Verify the generated harness (commands, hooks, rules) is current after package
-upgrades or edits to `oisin-ee/agent`, without writing anything:
+Verify generated Moka host adapters are current after package upgrades, without
+writing anything:
 
 ```shell
 moka init --check
 ```
 
-Refresh it, overwriting any locally edited harness files:
+Refresh generated Moka host adapters, overwriting locally edited adapter files:
 
 ```shell
 moka init --force
@@ -107,10 +107,10 @@ Canonical commands:
 - `moka stop <run-id> [node-id]`: abort a run or one active node.
 - `moka export <run-id> --sanitize`: print a portable evidence bundle.
 - `moka doctor`: check local prerequisites and config health.
-- `moka init`: install or refresh the whole per-machine harness (skills,
-  command surfaces, hooks, rules). `--check` verifies without writing,
-  `--dry-run` previews, `--force` overwrites locally edited files. The harness
-  is always installed globally; there is no `--scope`.
+- `moka init`: install or refresh Moka-owned host adapters (command surfaces,
+  native-agent projections, and gateway config). `--check` verifies without
+  writing, `--dry-run` previews, `--force` overwrites locally edited adapter
+  files. The shared agent harness is installed separately by chezmoi.
 
 ```shell
 moka run "Implement PIPE-123 user-facing behavior"
@@ -197,10 +197,10 @@ For a compact command reference, see
 ## Momokaya Runner Image
 
 The package is also the runner code used by the Momokaya runner image. The
-control plane owns Argo Workflow submission, run listing, cancellation, event
-storage, Kueue discovery, and UI rendering. This package owns the in-container
-`moka runner-command` and `moka runner-finalize` commands used by Argo Workflow
-DAG tasks.
+control plane owns Argo Workflow submission, status observation, run listing,
+cancellation, event storage, and UI rendering. This package owns the
+in-container `moka runner-command` and `moka runner-finalize` commands used by
+Argo Workflow DAG tasks.
 
 Argo starts the image with payload, schedule, and per-task descriptor files
 mounted from ConfigMaps, plus the event auth token mounted from a Secret. The

package/dist/argo-submit.d.ts

@@ -5,6 +5,7 @@ import { z } from "zod";
 
 //#region src/argo-submit.d.ts
 declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
+  activeDeadlineSeconds: z.ZodOptional<z.ZodNumber>;
   brokerAuth: z.ZodObject<{
     secretKey: z.ZodDefault<z.ZodString>;
     secretName: z.ZodString;
@@ -36,10 +37,38 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   namespace: z.ZodString;
   npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadJson: z.ZodString;
+  podGC: z.ZodOptional<z.ZodObject<{
+    deleteDelayDuration: z.ZodOptional<z.ZodString>;
+    labelSelector: z.ZodOptional<z.ZodObject<{
+      matchExpressions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        operator: z.ZodEnum<{
+          DoesNotExist: "DoesNotExist";
+          Exists: "Exists";
+          In: "In";
+          NotIn: "NotIn";
+        }>;
+        values: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      }, z.core.$strict>>>;
+      matchLabels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strict>>;
+    strategy: z.ZodOptional<z.ZodEnum<{
+      OnPodCompletion: "OnPodCompletion";
+      OnPodSuccess: "OnPodSuccess";
+      OnWorkflowCompletion: "OnWorkflowCompletion";
+      OnWorkflowSuccess: "OnWorkflowSuccess";
+    }>>;
+  }, z.core.$strict>>;
   serviceAccountName: z.ZodOptional<z.ZodString>;
+  ttlStrategy: z.ZodOptional<z.ZodObject<{
+    secondsAfterCompletion: z.ZodOptional<z.ZodNumber>;
+    secondsAfterFailure: z.ZodOptional<z.ZodNumber>;
+    secondsAfterSuccess: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strict>>;
   scheduleYaml: z.ZodString;
 }, z.core.$strict>;
 declare const submitDynamicRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
+  activeDeadlineSeconds: z.ZodOptional<z.ZodNumber>;
   brokerAuth: z.ZodObject<{
     secretKey: z.ZodDefault<z.ZodString>;
     secretName: z.ZodString;
@@ -71,7 +100,34 @@ declare const submitDynamicRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   namespace: z.ZodString;
   npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadJson: z.ZodString;
+  podGC: z.ZodOptional<z.ZodObject<{
+    deleteDelayDuration: z.ZodOptional<z.ZodString>;
+    labelSelector: z.ZodOptional<z.ZodObject<{
+      matchExpressions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        operator: z.ZodEnum<{
+          DoesNotExist: "DoesNotExist";
+          Exists: "Exists";
+          In: "In";
+          NotIn: "NotIn";
+        }>;
+        values: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      }, z.core.$strict>>>;
+      matchLabels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strict>>;
+    strategy: z.ZodOptional<z.ZodEnum<{
+      OnPodCompletion: "OnPodCompletion";
+      OnPodSuccess: "OnPodSuccess";
+      OnWorkflowCompletion: "OnWorkflowCompletion";
+      OnWorkflowSuccess: "OnWorkflowSuccess";
+    }>>;
+  }, z.core.$strict>>;
   serviceAccountName: z.ZodOptional<z.ZodString>;
+  ttlStrategy: z.ZodOptional<z.ZodObject<{
+    secondsAfterCompletion: z.ZodOptional<z.ZodNumber>;
+    secondsAfterFailure: z.ZodOptional<z.ZodNumber>;
+    secondsAfterSuccess: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strict>>;
   workflowId: z.ZodString;
 }, z.core.$strict>;
 declare const commandScheduleOptionsSchema: z.ZodObject<{

package/dist/argo-submit.js

@@ -1,5 +1,5 @@
 import { ArgoGraphCompilerError, compileArgoExecutionGraph } from "./argo-graph.js";
-import { dbAuthOptionSchema, mcpGatewayAuthOptionSchema } from "./remote/argo/model.js";
+import { argoWorkflowActiveDeadlineSecondsSchema, argoWorkflowPodGcSchema, argoWorkflowTtlStrategySchema, dbAuthOptionSchema, mcpGatewayAuthOptionSchema } from "./remote/argo/model.js";
 import { brokerAuthOptionSchema } from "./credentials/broker.js";
 import { appendPullRequestDelivery } from "./schedule/passes/open-pull-request.js";
 import { compileScheduleArtifact, parseScheduleArtifact } from "./planning/generate.js";
@@ -25,11 +25,19 @@ const configMapSchema = z.object({
 		namespace: z.string().min(1)
 	}).strict()
 }).strict();
+const workflowOwnerReferenceSchema = z.object({
+	apiVersion: z.literal("argoproj.io/v1alpha1"),
+	kind: z.literal("Workflow"),
+	name: z.string().min(1),
+	uid: z.string().min(1)
+}).strict();
+const configMapOwnerReferencesPatchSchema = z.object({ metadata: z.object({ ownerReferences: z.tuple([workflowOwnerReferenceSchema]) }).strict() }).strict();
 const createdWorkflowSchema = z.object({ metadata: z.object({
 	name: z.string().min(1).optional(),
 	uid: z.string().min(1).optional()
 }).passthrough() }).passthrough();
 const submitRunnerArgoWorkflowBaseOptionShape = {
+	activeDeadlineSeconds: argoWorkflowActiveDeadlineSecondsSchema.optional(),
 	brokerAuth: brokerAuthOptionSchema,
 	dbAuth: dbAuthOptionSchema.optional(),
 	eventAuthSecretKey: z.string().min(1).optional(),
@@ -51,7 +59,9 @@ const submitRunnerArgoWorkflowBaseOptionShape = {
 	namespace: z.string().min(1),
 	npmRegistryAuthSecretName: z.string().min(1).optional(),
 	payloadJson: z.string().min(1),
-	serviceAccountName: z.string().min(1).optional()
+	podGC: argoWorkflowPodGcSchema.optional(),
+	serviceAccountName: z.string().min(1).optional(),
+	ttlStrategy: argoWorkflowTtlStrategySchema.optional()
 };
 const submitRunnerArgoWorkflowOptionsSchema = z.object({
 	...submitRunnerArgoWorkflowBaseOptionShape,
@@ -102,6 +112,7 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 			"pipeline.oisin.dev/ticket-project": payload.run.project,
 			"pipeline.oisin.dev/ticket-title": payload.task.title
 		} : {},
+		activeDeadlineSeconds: options.activeDeadlineSeconds,
 		brokerAuth: options.brokerAuth,
 		dbAuth: options.dbAuth,
 		mcpGatewayAuth: options.mcpGatewayAuth,
@@ -121,51 +132,21 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		plan: compiled.plan,
 		scheduleConfigMapName: scheduleArtifactConfigMapName,
 		serviceAccountName: options.serviceAccountName,
-		taskDescriptorConfigMapName
+		taskDescriptorConfigMapName,
+		ttlStrategy: options.ttlStrategy
 	});
 	return Effect.gen(function* () {
-		const service = yield* KubernetesArgoService;
 		const graph = yield* graphEffect;
-		yield* service.createConfigMap({
-			body: configMapSchema.parse({
-				apiVersion: "v1",
-				data: { "payload.json": payloadJson },
-				kind: "ConfigMap",
-				metadata: {
-					labels,
-					name: payloadConfigMapName,
-					namespace: options.namespace
-				}
-			}),
-			dependencies,
-			namespace: options.namespace,
-			options
-		});
-		yield* service.createConfigMap({
-			body: configMapSchema.parse({
-				apiVersion: "v1",
-				data: Object.fromEntries(graph.tasks.map((task) => [`${task.taskName}.json`, `${JSON.stringify(buildRunnerTaskDescriptor(task.nodeId))}\n`])),
-				kind: "ConfigMap",
-				metadata: {
-					labels,
-					name: taskDescriptorConfigMapName,
-					namespace: options.namespace
-				}
-			}),
-			dependencies,
-			namespace: options.namespace,
-			options
-		});
-		yield* service.createConfigMap({
-			body: configMapSchema.parse({
-				apiVersion: "v1",
-				data: { "schedule.yaml": options.scheduleYaml },
-				kind: "ConfigMap",
-				metadata: {
-					labels,
-					name: scheduleArtifactConfigMapName,
-					namespace: options.namespace
-				}
+		const createdConfigMapNames = yield* createRunConfigMaps({
+			configMaps: staticRunConfigMaps({
+				labels,
+				namespace: options.namespace,
+				payloadConfigMapName,
+				payloadJson,
+				scheduleConfigMapName: scheduleArtifactConfigMapName,
+				scheduleYaml: options.scheduleYaml,
+				taskDescriptorConfigMapName,
+				tasks: graph.tasks
 			}),
 			dependencies,
 			namespace: options.namespace,
@@ -180,8 +161,21 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 				scheduleConfigMapName: scheduleArtifactConfigMapName,
 				taskDescriptorConfigMapName
 			},
-			workflow
-		});
+			workflow,
+			workflowFieldOverrides: { podGC: options.podGC }
+		}).pipe(Effect.flatMap((result) => ownRunConfigMaps({
+			configMapNames: createdConfigMapNames,
+			dependencies,
+			namespace: options.namespace,
+			options,
+			result
+		})), Effect.catch((error) => cleanupRunConfigMapsOnFailure({
+			configMapNames: createdConfigMapNames,
+			dependencies,
+			error,
+			namespace: options.namespace,
+			options
+		})));
 	});
 }
 function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
@@ -199,12 +193,14 @@ function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		"pipeline.oisin.dev/source": "argo-workflow",
 		"pipeline.oisin.dev/workflow": options.workflowId
 	};
+	const annotations = payload.task.kind === "ticket" ? {
+		"pipeline.oisin.dev/ticket-id": payload.task.id,
+		"pipeline.oisin.dev/ticket-project": payload.run.project,
+		"pipeline.oisin.dev/ticket-title": payload.task.title
+	} : {};
 	const workflow = buildDynamicRunnerArgoWorkflowManifest({
-		annotations: payload.task.kind === "ticket" ? {
-			"pipeline.oisin.dev/ticket-id": payload.task.id,
-			"pipeline.oisin.dev/ticket-project": payload.run.project,
-			"pipeline.oisin.dev/ticket-title": payload.task.title
-		} : {},
+		activeDeadlineSeconds: options.activeDeadlineSeconds,
+		annotations,
 		brokerAuth: options.brokerAuth,
 		dbAuth: options.dbAuth,
 		eventAuthSecretKey: options.eventAuthSecretKey,
@@ -222,19 +218,16 @@ function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		npmRegistryAuthSecretName: options.npmRegistryAuthSecretName,
 		payloadConfigMapName,
 		serviceAccountName: options.serviceAccountName,
+		ttlStrategy: options.ttlStrategy,
 		workflowId: options.workflowId
 	});
 	return Effect.gen(function* () {
-		yield* (yield* KubernetesArgoService).createConfigMap({
-			body: configMapSchema.parse({
-				apiVersion: "v1",
-				data: { "payload.json": payloadJson },
-				kind: "ConfigMap",
-				metadata: {
-					labels,
-					name: payloadConfigMapName,
-					namespace: options.namespace
-				}
+		const createdConfigMapNames = yield* createRunConfigMaps({
+			configMaps: dynamicRunConfigMaps({
+				labels,
+				namespace: options.namespace,
+				payloadConfigMapName,
+				payloadJson
 			}),
 			dependencies,
 			namespace: options.namespace,
@@ -245,23 +238,169 @@ function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 			namespace: options.namespace,
 			options,
 			resultExtras: { payloadConfigMapName },
-			workflow
-		});
+			workflow,
+			workflowFieldOverrides: { podGC: options.podGC }
+		}).pipe(Effect.flatMap((result) => ownRunConfigMaps({
+			configMapNames: createdConfigMapNames,
+			dependencies,
+			namespace: options.namespace,
+			options,
+			result
+		})), Effect.catch((error) => cleanupRunConfigMapsOnFailure({
+			configMapNames: createdConfigMapNames,
+			dependencies,
+			error,
+			namespace: options.namespace,
+			options
+		})));
 	});
 }
+function staticRunConfigMaps(input) {
+	return [
+		runConfigMap({
+			data: { "payload.json": input.payloadJson },
+			labels: input.labels,
+			name: input.payloadConfigMapName,
+			namespace: input.namespace
+		}),
+		runConfigMap({
+			data: Object.fromEntries(input.tasks.map((task) => [`${task.taskName}.json`, `${JSON.stringify(buildRunnerTaskDescriptor(task.nodeId))}\n`])),
+			labels: input.labels,
+			name: input.taskDescriptorConfigMapName,
+			namespace: input.namespace
+		}),
+		runConfigMap({
+			data: { "schedule.yaml": input.scheduleYaml },
+			labels: input.labels,
+			name: input.scheduleConfigMapName,
+			namespace: input.namespace
+		})
+	];
+}
+function dynamicRunConfigMaps(input) {
+	return [runConfigMap({
+		data: { "payload.json": input.payloadJson },
+		labels: input.labels,
+		name: input.payloadConfigMapName,
+		namespace: input.namespace
+	})];
+}
+function runConfigMap(input) {
+	return {
+		body: configMapSchema.parse({
+			apiVersion: "v1",
+			data: input.data,
+			kind: "ConfigMap",
+			metadata: {
+				labels: input.labels,
+				name: input.name,
+				namespace: input.namespace
+			}
+		}),
+		name: input.name
+	};
+}
+function createRunConfigMaps(input) {
+	const createdConfigMapNames = [];
+	return Effect.gen(function* () {
+		const service = yield* KubernetesArgoService;
+		yield* Effect.forEach(input.configMaps, (configMap) => service.createConfigMap({
+			body: configMap.body,
+			dependencies: input.dependencies,
+			namespace: input.namespace,
+			options: input.options
+		}).pipe(Effect.tap(() => Effect.sync(() => {
+			createdConfigMapNames.push(configMap.name);
+		}))));
+		return createdConfigMapNames;
+	}).pipe(Effect.catch((error) => cleanupRunConfigMapsOnFailure({
+		configMapNames: createdConfigMapNames,
+		dependencies: input.dependencies,
+		error,
+		namespace: input.namespace,
+		options: input.options
+	})));
+}
+function ownRunConfigMaps(input) {
+	return patchRunConfigMapOwnerReferences({
+		body: configMapOwnerReferencesPatch(workflowOwnerReference(input.result)),
+		configMapNames: input.configMapNames,
+		dependencies: input.dependencies,
+		namespace: input.namespace,
+		options: input.options
+	}).pipe(Effect.as(input.result));
+}
+function cleanupRunConfigMapsOnFailure(input) {
+	return deleteRunConfigMaps({
+		configMapNames: input.configMapNames,
+		dependencies: input.dependencies,
+		namespace: input.namespace,
+		options: input.options
+	}).pipe(Effect.catch((cleanupError) => Effect.fail(/* @__PURE__ */ new Error(`Failed to clean up ConfigMaps after submit failure: ${errorMessage(input.error)}; cleanup failed: ${errorMessage(cleanupError)}`))), Effect.flatMap(() => Effect.fail(input.error)));
+}
+function patchRunConfigMapOwnerReferences(input) {
+	return Effect.gen(function* () {
+		const service = yield* KubernetesArgoService;
+		return yield* Effect.all(input.configMapNames.map((name) => service.patchConfigMapOwnerReferences({
+			body: input.body,
+			dependencies: input.dependencies,
+			name,
+			namespace: input.namespace,
+			options: input.options
+		})), { concurrency: "unbounded" });
+	});
+}
+function deleteRunConfigMaps(input) {
+	return Effect.gen(function* () {
+		const service = yield* KubernetesArgoService;
+		return yield* Effect.all(input.configMapNames.map((name) => service.deleteConfigMap({
+			dependencies: input.dependencies,
+			name,
+			namespace: input.namespace,
+			options: input.options
+		})), { concurrency: "unbounded" });
+	});
+}
+function workflowOwnerReference(result) {
+	if (result.workflowUid === void 0) throw new Error(`Created Argo Workflow '${result.workflowName}' did not include metadata.uid; cannot own ConfigMaps`);
+	return workflowOwnerReferenceSchema.parse({
+		apiVersion: "argoproj.io/v1alpha1",
+		kind: "Workflow",
+		name: result.workflowName,
+		uid: result.workflowUid
+	});
+}
+function configMapOwnerReferencesPatch(ownerReference) {
+	return configMapOwnerReferencesPatchSchema.parse({ metadata: { ownerReferences: [ownerReference] } });
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
 function submitWorkflowManifest(input) {
 	return Effect.gen(function* () {
-		return workflowSubmitResult(yield* (yield* KubernetesArgoService).createWorkflow({
-			body: runnerArgoWorkflowManifestSchema.parse(input.workflow),
+		const service = yield* KubernetesArgoService;
+		const workflow = applyWorkflowFieldOverrides(input.workflow, input.workflowFieldOverrides);
+		return workflowSubmitResult(yield* service.createWorkflow({
+			body: runnerArgoWorkflowManifestSchema.parse(workflow),
 			dependencies: input.dependencies,
 			namespace: input.namespace,
 			options: input.options
-		}), input.workflow, {
+		}), workflow, {
 			namespace: input.namespace,
 			...input.resultExtras
 		});
 	});
 }
+function applyWorkflowFieldOverrides(workflow, overrides) {
+	if (overrides?.podGC === void 0) return workflow;
+	return runnerArgoWorkflowManifestSchema.parse({
+		...workflow,
+		spec: {
+			...workflow.spec,
+			podGC: overrides.podGC
+		}
+	});
+}
 function workflowSubmitResult(response, workflow, base) {
 	const created = createdWorkflowSchema.parse(response);
 	return workflowSubmitResultSchema.parse({

package/dist/argo-workflow.d.ts

@@ -126,6 +126,28 @@ declare const runnerArgoWorkflowManifestSchema: z.ZodObject<{
         }>;
       }, z.core.$strict>>;
     }, z.core.$strict>>;
+    podGC: z.ZodOptional<z.ZodObject<{
+      deleteDelayDuration: z.ZodOptional<z.ZodString>;
+      labelSelector: z.ZodOptional<z.ZodObject<{
+        matchExpressions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+          key: z.ZodString;
+          operator: z.ZodEnum<{
+            DoesNotExist: "DoesNotExist";
+            Exists: "Exists";
+            In: "In";
+            NotIn: "NotIn";
+          }>;
+          values: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>>;
+        matchLabels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+      }, z.core.$strict>>;
+      strategy: z.ZodOptional<z.ZodEnum<{
+        OnPodCompletion: "OnPodCompletion";
+        OnPodSuccess: "OnPodSuccess";
+        OnWorkflowCompletion: "OnWorkflowCompletion";
+        OnWorkflowSuccess: "OnWorkflowSuccess";
+      }>>;
+    }, z.core.$strict>>;
     ttlStrategy: z.ZodOptional<z.ZodObject<{
       secondsAfterCompletion: z.ZodOptional<z.ZodNumber>;
       secondsAfterFailure: z.ZodOptional<z.ZodNumber>;

package/dist/commands/runner-command-command.js

@@ -51,7 +51,7 @@ function registerRunnerCommandCommand(program) {
 	program.command("runner-command").description("Run one scheduled Argo Workflow task").requiredOption("--payload-file <path>", "Path to the runner payload JSON").option("--node-id <id>", "Node id to execute without a task descriptor").option("--schedule-file <path>", "Path to the schedule artifact YAML").option("--schedule-source <source>", "Schedule source: file or db").action((options) => runRunnerProgram(runRunnerCommandEffect(options)));
 	program.command("runner-lifecycle").description("Run one Argo Workflow lifecycle phase").requiredOption("--phase <phase>", "Lifecycle phase to run").requiredOption("--payload-file <path>", "Path to the runner payload JSON").requiredOption("--schedule-file <path>", "Path to the schedule artifact YAML").action((options) => runRunnerProgram(runRunnerLifecycleEffect(options)));
 	program.command("runner-pre-schedule").description("Run one dynamic pre-schedule phase").requiredOption("--phase <phase>", "pre-research, pre-planning, or generate-schedule").requiredOption("--payload-file <path>", "Path to the runner payload JSON").action((options) => runRunnerProgram(runPreScheduleEffect(options)));
-	program.command("runner-finalize").description("Finalize one Argo Workflow run").requiredOption("--payload-file <path>", "Path to the runner payload JSON").option("--schedule-file <path>", "Path to the schedule artifact YAML").option("--schedule-source <source>", "Schedule source: file or db").requiredOption("--argo-status <status>", "Argo Workflow status").action((options) => runRunnerProgram(runRunnerFinalizeEffect(options)));
+	program.command("runner-finalize").description("Finalize one Argo Workflow run").requiredOption("--payload-file <path>", "Path to the runner payload JSON").option("--schedule-file <path>", "Path to the schedule artifact YAML").option("--schedule-source <source>", "Schedule source: file or db").requiredOption("--argo-status <status>", "Argo Workflow status").option("--argo-failures <json>", "Argo Workflow failure details JSON").action((options) => runRunnerProgram(runRunnerFinalizeEffect(options)));
 	program.command("runner-select-ready-wave").description("Select DB-ready nodes for the next dynamic Argo wave").requiredOption("--payload-file <path>", "Path to the runner payload JSON").requiredOption("--output-file <path>", "Path where the ready node id JSON array is written").action((options) => runRunnerProgram(runSelectReadyWaveEffect(options)));
 }
 //#endregion

package/dist/factory/create-experiment.js

@@ -1,5 +1,6 @@
 import { DEFAULT_RUNNER_COMMAND_GIT_COMMITTER } from "../config/schema/catalog.js";
 import { resolveFactorySeams } from "./exec.js";
+import { githubGitCredentialEnv } from "./git-credentials.js";
 import { existsSync, mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
@@ -80,7 +81,7 @@ async function runCreateExperiment(options) {
 		previews,
 		...options.templateRef ? { templateRef: options.templateRef } : {},
 		templateSource
-	}));
+	}), { env: githubGitCredentialEnv() });
 	const stampedRegistryEntry = join(stampDir, STAMPED_REGISTRY_DIR, `${name}.yaml`);
 	if (!existsSync(stampedRegistryEntry)) throw new Error(`create-experiment: stamp is missing the registry entry ${STAMPED_REGISTRY_DIR}/${name}.yaml — template contract changed?`);
 	log("create-experiment: committing the stamped tree");

package/dist/factory/exec.js

@@ -3,6 +3,7 @@ import { execa } from "execa";
 //#region src/factory/exec.ts
 const defaultFactoryExec = (command, args, options) => execa(command, [...args], {
 	...options?.cwd ? { cwd: options.cwd } : {},
+	...options?.env ? { env: options.env } : {},
 	stdin: "ignore"
 });
 const defaultFactoryGit = (cwd, args) => runAuthenticatedGit(cwd, args);

package/dist/factory/git-credentials.js

@@ -0,0 +1,37 @@
+import { existsSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+//#region src/factory/git-credentials.ts
+const DEFAULT_GIT_CREDENTIALS_DIR = "/etc/pipeline/git-credentials";
+/**
+* copier fetches the (private) momokaya-template by spawning its OWN git
+* subprocess (`git ls-remote` / `clone`, via plumbum). `runAuthenticatedGit`
+* only configures credentials per-invocation with `-c` flags on the git calls
+* the lane makes itself, so copier's git sees no github.com credential and
+* dies `fatal: could not read Username for 'https://github.com'`.
+*
+* This materializes a process-wide github.com credential from the runner's
+* mounted git-credentials (username + PAT under /etc/pipeline/git-credentials)
+* as `GIT_CONFIG_*` env any child (and grandchild) git process inherits, so
+* copier's template fetch authenticates. The token is written to a 0600 store
+* file and referenced by a `credential.helper=store` entry — it never lands in
+* a URL or argv. No mounted credentials (local dev) -> empty env, so git falls
+* back to ambient auth.
+*/
+function githubGitCredentialEnv(credentialsDir = process.env.PIPELINE_GIT_CREDENTIALS_DIR ?? DEFAULT_GIT_CREDENTIALS_DIR) {
+	const usernamePath = resolve(credentialsDir, "username");
+	const passwordPath = resolve(credentialsDir, "password");
+	if (!(existsSync(usernamePath) && existsSync(passwordPath))) return {};
+	const username = readFileSync(usernamePath, "utf8").trim();
+	const password = readFileSync(passwordPath, "utf8").trim();
+	const storePath = join(mkdtempSync(join(tmpdir(), "factory-git-cred-")), ".git-credentials");
+	writeFileSync(storePath, `https://${encodeURIComponent(username)}:${encodeURIComponent(password)}@github.com\n`, { mode: 384 });
+	return {
+		GIT_CONFIG_COUNT: "1",
+		GIT_CONFIG_KEY_0: "credential.helper",
+		GIT_CONFIG_VALUE_0: `store --file=${storePath}`,
+		GIT_TERMINAL_PROMPT: "0"
+	};
+}
+//#endregion
+export { githubGitCredentialEnv };

package/dist/factory/template-update.js

@@ -1,4 +1,5 @@
 import { resolveFactorySeams } from "./exec.js";
+import { githubGitCredentialEnv } from "./git-credentials.js";
 import { committerConfigArgs } from "./create-experiment.js";
 import { isStampOf, parseCopierAnswers } from "./stamp-answers.js";
 import { parse } from "yaml";
@@ -101,7 +102,10 @@ async function updateRepo(input) {
 			"--trust",
 			"--defaults",
 			...input.templateRef ? ["--vcs-ref", input.templateRef] : []
-		], { cwd: cloneDir });
+		], {
+			cwd: cloneDir,
+			env: githubGitCredentialEnv()
+		});
 		const status = await git(cloneDir, ["status", "--porcelain"]);
 		if (status.trim().length === 0) return {
 			repo,

package/dist/loop/controller-deps.js

@@ -1,5 +1,6 @@
 import { runAuthenticatedGit } from "../run-state/git-refs.js";
 import { RunnerEventSinkHttpService, RunnerEventSinkHttpServiceLive } from "../runtime/services/runner-event-sink-http-service.js";
+import { RUNNER_EVENT_SINK_RETRY_POLICY } from "../runner-event-sink.js";
 import { pollWorkflowPhaseUntilTerminal } from "./argo-poll.js";
 import { ticketGraphDtoSchema } from "../tickets/ticket-graph-dto.js";
 import { submitMoka } from "../moka-submit.js";
@@ -39,6 +40,7 @@ function buildControllerDeps(context, seams = {}) {
 			runId: input.runId,
 			workflowName: input.workflowName
 		}),
+		projectId: context.project,
 		refreshBacklog: () => Effect.tryPromise({
 			catch: refreshError,
 			try: () => gitRefresh(context.worktreePath)
@@ -130,7 +132,10 @@ function submitRepository(context, request) {
 const RECORD_BUILDER = {
 	"loop.start": (event, envelope) => event.type === "loop.start" ? {
 		...envelope,
-		loopStart: { strategy: event.strategy },
+		loopStart: {
+			projectId: event.projectId,
+			strategy: event.strategy
+		},
 		type: "loop.start"
 	} : unreachable(event),
 	"loop.graph.snapshot": (event, envelope) => event.type === "loop.graph.snapshot" ? {
@@ -183,8 +188,8 @@ function defaultPostEvent(context) {
 		authToken: context.eventAuthToken,
 		events: [record],
 		fetch: fetchImpl,
-		maxRetries: 0,
-		retryDelayMs: 250,
+		maxRetries: RUNNER_EVENT_SINK_RETRY_POLICY.maxRetries,
+		retryDelayMs: RUNNER_EVENT_SINK_RETRY_POLICY.retryDelayMs,
 		url: context.eventUrl
 	})), RunnerEventSinkHttpServiceLive));
 }

package/dist/loop/controller.js

@@ -17,6 +17,7 @@ function runLoopController(deps) {
 		const graph = yield* buildTicketGraphEffect([...initialTasks]).pipe(Effect.mapError((error) => new Error(error.message)));
 		yield* deps.emit({
 			type: "loop.start",
+			projectId: deps.projectId,
 			strategy: deps.strategy
 		});
 		const snapshot = yield* serializeTicketGraph(graph);