@oisincoveney/pipeline 3.23.1 → 3.24.1

package/README.md

@@ -379,6 +379,15 @@ Package and container publishing is owned by GitHub Actions. Do not publish from
 a workstation with `npm publish`, `semantic-release`, Docker pushes, or direct
 registry commands.
 
+The authoritative package version lives in the npm registry, not in this
+repository. `package.json` pins the `0.0.0-development` semantic-release
+sentinel and is never bumped in git; semantic-release derives and publishes the
+real version from commit history at release time. To learn the current version,
+query the registry (`npm view @oisincoveney/pipeline version`) — the repo
+`version` field is intentionally not authoritative. Downstream pins (for example
+pipeline-console) should track the registry via Renovate rather than the git
+field.
+
 Before committing changes in this repository, run:
 
 ```shell

package/defaults/pipeline.yaml

@@ -79,10 +79,11 @@ runner_command:
       # Set up package-owned pipeline support + the opencode model registration
       # (.opencode/opencode.json, which declares the gpt-5.5-* reasoning selectors)
       # on every run, so opencode-backed agents in the pod resolve their models
-      # instead of failing with "Model not found". `moka init` installs the full
-      # per-machine harness (skills + commands + hooks + rules); --force refreshes
-      # a pre-baked/version-skewed settings.json instead of refusing it. Idempotent,
-      # writes no repo-local pipeline config.
+      # instead of failing with "Model not found". `moka init` installs Moka host
+      # adapters only; the shared harness (skills + hooks + rules) is laid down by
+      # chezmoi before this step. --force refreshes a pre-baked/version-skewed
+      # settings.json instead of refusing it. Idempotent, writes no repo-local
+      # pipeline config.
       - command: moka
         args: [init, --force]
 scheduler:

package/dist/argo-submit.js

@@ -137,22 +137,22 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 	});
 	return Effect.gen(function* () {
 		const graph = yield* graphEffect;
-		const createdConfigMapNames = yield* createRunConfigMaps({
-			configMaps: staticRunConfigMaps({
-				labels,
+		return yield* submitWorkflowWithRunConfigMaps({
+			configMapNames: yield* createRunConfigMaps({
+				configMaps: staticRunConfigMaps({
+					labels,
+					namespace: options.namespace,
+					payloadConfigMapName,
+					payloadJson,
+					scheduleConfigMapName: scheduleArtifactConfigMapName,
+					scheduleYaml: options.scheduleYaml,
+					taskDescriptorConfigMapName,
+					tasks: graph.tasks
+				}),
+				dependencies,
 				namespace: options.namespace,
-				payloadConfigMapName,
-				payloadJson,
-				scheduleConfigMapName: scheduleArtifactConfigMapName,
-				scheduleYaml: options.scheduleYaml,
-				taskDescriptorConfigMapName,
-				tasks: graph.tasks
+				options
 			}),
-			dependencies,
-			namespace: options.namespace,
-			options
-		});
-		return yield* submitWorkflowManifest({
 			dependencies,
 			namespace: options.namespace,
 			options,
@@ -163,19 +163,7 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 			},
 			workflow,
 			workflowFieldOverrides: { podGC: options.podGC }
-		}).pipe(Effect.flatMap((result) => ownRunConfigMaps({
-			configMapNames: createdConfigMapNames,
-			dependencies,
-			namespace: options.namespace,
-			options,
-			result
-		})), Effect.catch((error) => cleanupRunConfigMapsOnFailure({
-			configMapNames: createdConfigMapNames,
-			dependencies,
-			error,
-			namespace: options.namespace,
-			options
-		})));
+		});
 	});
 }
 function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
@@ -222,37 +210,25 @@ function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		workflowId: options.workflowId
 	});
 	return Effect.gen(function* () {
-		const createdConfigMapNames = yield* createRunConfigMaps({
-			configMaps: dynamicRunConfigMaps({
-				labels,
+		return yield* submitWorkflowWithRunConfigMaps({
+			configMapNames: yield* createRunConfigMaps({
+				configMaps: dynamicRunConfigMaps({
+					labels,
+					namespace: options.namespace,
+					payloadConfigMapName,
+					payloadJson
+				}),
+				dependencies,
 				namespace: options.namespace,
-				payloadConfigMapName,
-				payloadJson
+				options
 			}),
-			dependencies,
-			namespace: options.namespace,
-			options
-		});
-		return yield* submitWorkflowManifest({
 			dependencies,
 			namespace: options.namespace,
 			options,
 			resultExtras: { payloadConfigMapName },
 			workflow,
 			workflowFieldOverrides: { podGC: options.podGC }
-		}).pipe(Effect.flatMap((result) => ownRunConfigMaps({
-			configMapNames: createdConfigMapNames,
-			dependencies,
-			namespace: options.namespace,
-			options,
-			result
-		})), Effect.catch((error) => cleanupRunConfigMapsOnFailure({
-			configMapNames: createdConfigMapNames,
-			dependencies,
-			error,
-			namespace: options.namespace,
-			options
-		})));
+		});
 	});
 }
 function staticRunConfigMaps(input) {
@@ -322,14 +298,32 @@ function createRunConfigMaps(input) {
 	})));
 }
 function ownRunConfigMaps(input) {
+	const ownerReference = workflowOwnerReference(input.result);
+	if (ownerReference === void 0) return warnRunConfigMapOwnershipSkipped({
+		error: new Error(missingWorkflowUidMessage(input.result)),
+		result: input.result
+	}).pipe(Effect.as(input.result));
 	return patchRunConfigMapOwnerReferences({
-		body: configMapOwnerReferencesPatch(workflowOwnerReference(input.result)),
+		body: configMapOwnerReferencesPatch(ownerReference),
 		configMapNames: input.configMapNames,
 		dependencies: input.dependencies,
 		namespace: input.namespace,
 		options: input.options
 	}).pipe(Effect.as(input.result));
 }
+function ownRunConfigMapsBestEffort(input) {
+	return ownRunConfigMaps(input).pipe(Effect.catch((error) => warnRunConfigMapOwnershipSkipped({
+		error,
+		result: input.result
+	}).pipe(Effect.as(input.result))));
+}
+function warnRunConfigMapOwnershipSkipped(input) {
+	return Effect.sync(() => {
+		const reason = errorMessage(input.error);
+		const message = `moka submit: failed to set Workflow ownerReference for ConfigMaps after Argo Workflow '${input.result.workflowName}' was created; leaving ConfigMaps for TTL/sweeper cleanup: ${reason}\n`;
+		process.stderr.write(message);
+	});
+}
 function cleanupRunConfigMapsOnFailure(input) {
 	return deleteRunConfigMaps({
 		configMapNames: input.configMapNames,
@@ -362,7 +356,7 @@ function deleteRunConfigMaps(input) {
 	});
 }
 function workflowOwnerReference(result) {
-	if (result.workflowUid === void 0) throw new Error(`Created Argo Workflow '${result.workflowName}' did not include metadata.uid; cannot own ConfigMaps`);
+	if (result.workflowUid === void 0) return;
 	return workflowOwnerReferenceSchema.parse({
 		apiVersion: "argoproj.io/v1alpha1",
 		kind: "Workflow",
@@ -370,6 +364,9 @@ function workflowOwnerReference(result) {
 		uid: result.workflowUid
 	});
 }
+function missingWorkflowUidMessage(result) {
+	return `Created Argo Workflow '${result.workflowName}' did not include metadata.uid; cannot own ConfigMaps`;
+}
 function configMapOwnerReferencesPatch(ownerReference) {
 	return configMapOwnerReferencesPatchSchema.parse({ metadata: { ownerReferences: [ownerReference] } });
 }
@@ -391,6 +388,28 @@ function submitWorkflowManifest(input) {
 		});
 	});
 }
+function submitWorkflowWithRunConfigMaps(input) {
+	return submitWorkflowManifest({
+		dependencies: input.dependencies,
+		namespace: input.namespace,
+		options: input.options,
+		resultExtras: input.resultExtras,
+		workflow: input.workflow,
+		workflowFieldOverrides: input.workflowFieldOverrides
+	}).pipe(Effect.catch((error) => cleanupRunConfigMapsOnFailure({
+		configMapNames: input.configMapNames,
+		dependencies: input.dependencies,
+		error,
+		namespace: input.namespace,
+		options: input.options
+	})), Effect.flatMap((result) => ownRunConfigMapsBestEffort({
+		configMapNames: input.configMapNames,
+		dependencies: input.dependencies,
+		namespace: input.namespace,
+		options: input.options,
+		result
+	})));
+}
 function applyWorkflowFieldOverrides(workflow, overrides) {
 	if (overrides?.podGC === void 0) return workflow;
 	return runnerArgoWorkflowManifestSchema.parse({

package/dist/cli/bootstrap-commands.js

@@ -10,7 +10,12 @@ function registerBootstrapCommands(program) {
 		console.log(flags.json ? JSON.stringify(result) : formatDoctorResult(result));
 		if (!result.passed) throw new Error("Doctor checks failed.");
 	});
-	program.command("init").description("Install or refresh moka's slash-command adapters (/moka-execute, /moka-inspect, /moka-quick) plus the singleton MCP gateway host config, globally to ~/.claude, ~/.config/opencode, ~/.codex with no repo-local config. The agent harness (skills, hooks, instruction rules) is provisioned separately from oisin-ee/agent via chezmoi, not by moka.").option("--check", "verify the installed adapters are current; fail if stale").option("--dry-run", "show planned changes without writing files").option("--force", "overwrite manually edited command adapter files").action(async (flags) => {
+	program.command("init").description([
+		"Install or refresh Moka host adapters (/moka-execute, /moka-inspect, /moka-quick command surfaces,",
+		"native-agent projections, and gateway config), globally to ~/.claude, ~/.config/opencode, ~/.codex",
+		"with no repo-local config. The shared agent harness (skills, hooks, instruction rules) is provisioned",
+		"separately from oisin-ee/agent via chezmoi, not by Moka."
+	].join(" ")).option("--check", "verify the installed adapters are current; fail if stale").option("--dry-run", "show planned changes without writing files").option("--force", "overwrite manually edited command adapter files").action(async (flags) => {
 		const result = await initPipelineProject({
 			...flags,
 			cwd: process.env.PIPELINE_TARGET_PATH ?? process.cwd()

package/dist/config/lint.js

@@ -61,7 +61,7 @@ function missingFileReferenceWarning(path, value) {
 }
 function missingFileReferenceMessage(path, value) {
 	const base = `${path} references missing file '${value}'`;
-	if (path.startsWith("skills.") && value.startsWith(".agents/skills/")) return `${base}. Run \`moka init\` to install project-local skills with \`npx --yes skills add oisin-ee/agent/skills\`.`;
+	if (path.startsWith("skills.") && value.startsWith(".agents/skills/")) return `${base}. Run \`chezmoi apply --refresh-externals always\` to install shared harness skills from oisin-ee/agent.`;
 	return base;
 }
 function resolveLintPathReference(projectRoot, ref) {

package/dist/pipeline-init.js

@@ -1,13 +1,14 @@
 import { installCommands } from "./install-commands.js";
 //#region src/pipeline-init.ts
 /**
-* `moka init` installs only moka's own slash-command adapters
-* (`/moka-execute|inspect|quick`) plus the singleton MCP gateway host config,
-* globally for Claude Code, Codex, and OpenCode. The shared agent harness
+* `moka init` installs only Moka's own host adapters
+* (`/moka-execute|inspect|quick` command surfaces, native-agent projections,
+* and singleton MCP gateway host config) globally for Claude Code, Codex, and
+* OpenCode. The shared agent harness
 * (skills, agent hooks, and global instruction rules) is no longer installed by
-* moka — it is provisioned from `oisin-ee/agent` via chezmoi (the dotfiles'
+* Moka — it is provisioned from `oisin-ee/agent` via chezmoi (the dotfiles'
 * `.chezmoiexternal` clone + `run_onchange` harness installer). Keeping moka's
-* command adapters here means the runner image (and local dev) still gets the
+* host adapters here means the runner image (and local dev) still gets the
 * `/moka-*` entrypoints after `chezmoi apply` lays down the harness.
 */
 async function initPipelineProject(options = {}) {
@@ -27,17 +28,17 @@ function initInstallerFlags(options) {
 }
 const INIT_RESULT_COPY = {
 	install: {
-		headline: "Initialized moka slash-command adapters:",
+		headline: "Initialized Moka host adapters:",
 		fileVerb: "generated",
 		footer: "no repo-local pipeline config files were created"
 	},
 	check: {
-		headline: "Verified moka slash-command adapters are current:",
+		headline: "Verified Moka host adapters are current:",
 		fileVerb: "current",
 		footer: "adapters verified; no changes written"
 	},
 	dryRun: {
-		headline: "Planned moka slash-command adapters:",
+		headline: "Planned Moka host adapters:",
 		fileVerb: "would generate",
 		footer: "dry run; no changes written"
 	}
@@ -51,7 +52,11 @@ function formatPipelineInitResult(result, mode = {}) {
 	const copy = INIT_RESULT_COPY[initResultMode(mode)];
 	return [
 		copy.headline,
-		"per-machine slash-command adapters (/moka-execute|inspect|quick) installed globally (~/.claude, ~/.config/opencode, ~/.codex); the agent harness (skills, hooks, instruction rules) comes from oisin-ee/agent via chezmoi, not moka",
+		[
+			"per-machine Moka host adapters (/moka-execute|inspect|quick command surfaces, native-agent projections,",
+			"and gateway config) installed globally (~/.claude, ~/.config/opencode, ~/.codex); the shared agent harness",
+			"(skills, hooks, instruction rules) comes from oisin-ee/agent via chezmoi, not Moka"
+		].join(" "),
 		...result.files.map((path) => `${copy.fileVerb} ${path}`),
 		copy.footer
 	].join("\n");

package/dist/runner-command/pre-schedule.js

@@ -127,6 +127,7 @@ function generateSchedulePhaseEffect(context) {
 				config: context.config,
 				entrypointId,
 				phaseContext,
+				pullRequestDeliveryRequested: context.payload.delivery.pullRequest,
 				runId: context.payload.run.id,
 				task: context.task,
 				worktreePath: context.worktreePath

package/docs/config-architecture.md

@@ -151,8 +151,8 @@ receive explicit grants:
 - `network`: inherited or disabled.
 - `output`: text, JSON, JSONL, or JSON Schema output.
 
-Default skills resolve from project-installed skill files created by
-`moka init` via `npx --yes skills add oisin-ee/agent/skills`:
+Default skills resolve from shared harness skill files installed from
+`oisin-ee/agent` by chezmoi:
 
 ```yaml
 skills:
@@ -161,11 +161,11 @@ skills:
 ```
 
 Project-authored skill and rule paths resolve from the project root and must
-exist for runtime use. If default skill files are missing, run `moka init` to
-install them before executing workflows.
+exist for runtime use. If shared harness skill files are missing, run
+`chezmoi apply --refresh-externals always` before executing workflows.
 
-Default agent hooks are copied by `moka init` from private `oisin-ee/agent`.
-That source repository has one canonical hook layout:
+Default agent hooks are copied by `bin/install-harness.mjs` from private
+`oisin-ee/agent`. That source repository has one canonical hook layout:
 
 ```text
 hooks/claude-code/
@@ -173,18 +173,10 @@ hooks/codex/
 hooks/opencode/
 ```
 
-Moka overlays those folders onto `.claude`, `.codex`, and `.opencode` for
-project scope, or the corresponding per-machine host config directories for
-global scope. Moka tracks installed hashes in host-local manifests so it can
-update unchanged owned hook files, delete owned files removed from the hook
-repository, and reject manual drift unless `--force` is used.
-
-`moka init --skill-scope` (PIPE-83.12) chooses how the default set is installed:
-`project` (default) vendors a repo-local copy (`skills add … --copy`,
-`skills-lock.json`); `personal` installs once at user/global scope
-(`skills add … --global`) so every repo the user opens inherits the skills with
-no per-repo copy and no project lockfile — the standardization path for a single
-user across many projects.
+The harness installer overlays those folders onto the corresponding per-machine
+host config directories. It tracks installed hashes in host-local manifests so
+it can update unchanged owned hook files, delete owned files removed from the
+hook repository, and reject manual drift unless `--force` is used.
 
 MCP-enabled profiles use one gateway grant:
 
@@ -211,10 +203,10 @@ OpenCode host resources are generated from the same profile registry:
 
 - `.opencode/agents/*.md` declares native agents with `mode`, `description`,
   resolved model, explicit permissions, and task access to generated agents only.
-- `.opencode/skills/*/SKILL.md` is installed by `skills add`; Moka only
-  generates agents, commands, plugins, and project config.
-- Additional manually authored OpenCode hook plugins can be copied from
-  `oisin-ee/agent/hooks/opencode/` by `moka init`.
+- `.agents/skills/*/SKILL.md` is installed by the shared harness; Moka only
+  generates agents, commands, plugins, and host config.
+- Additional manually authored OpenCode hook plugins are copied from
+  `oisin-ee/agent/hooks/opencode/` by the shared harness installer.
 - `.opencode/plugins/pipeline-goal-context.ts` projects package-owned
   continuation context into OpenCode compaction.
 - `.opencode/opencode.json` contains the gateway MCP config, enables LSP, and
@@ -454,8 +446,9 @@ rather than re-emitting it into every project.
 
 ## Troubleshooting
 
-- Missing host resources: run `moka init`; `moka run` loads the installed
+- Missing Moka host adapters: run `moka init`; `moka run` loads the installed
   package config.
+- Missing shared harness assets: run `chezmoi apply --refresh-externals always`.
 - Capability error: reduce the profile grants or choose a runner whose declared
   capabilities include the requested tools, filesystem, network, output, rules,
   skills, or MCP access.

package/docs/mcp-gateway.md

@@ -47,7 +47,7 @@ host-specific MCP config.
 3. Configure `mcp_gateway` in package-owned profile config.
 4. Run `moka mcp gateway reconcile` to render and apply the full ToolHive vMCP
    backend inventory for the current workspace.
-5. Run `moka init` to write project OpenCode and Claude Code command surfaces and host
+5. Run `moka init` to write OpenCode and Claude Code command surfaces and host
    MCP config.
 6. Run `moka mcp gateway doctor` to verify gateway health and required tools.
 7. Keep high-risk upstream capabilities controlled by gateway-side policy, not

package/docs/slash-command-adapter-contract.md

@@ -32,9 +32,9 @@ moka init --check
 - OpenCode agents project package profiles as markdown agents with `mode`,
   `description`, resolved `model`, `permission`, `hidden`, and task permission
   maps. The primary orchestrator may call only generated package profile agents.
-- OpenCode skill files are installed by `npx skills add` during `moka init`;
-  Moka does not generate `.opencode/skills`. Generated agent
-  `permission.skill` maps still deny ungranted skills.
+- OpenCode skill files are installed by the shared harness from `oisin-ee/agent`;
+  Moka does not generate skill files. Generated agent `permission.skill` maps
+  still deny ungranted skills.
 - `.opencode/opencode.json` includes the singleton `pipeline-gateway` MCP
   server and enables OpenCode LSP. CLI lint, typecheck, tests, and configured
   gates remain the blocking verification path; LSP is editor/runtime assistance.

package/package.json

@@ -146,7 +146,7 @@
     "prepack": "nub run build:cli"
   },
   "type": "module",
-  "version": "3.23.1",
+  "version": "3.24.1",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",