@oisincoveney/pipeline 3.24.2 → 4.0.0

package/dist/tickets/ticket-plan.js

@@ -1,92 +1,112 @@
-import { errorMessage, formatZodIssues } from "./validation-error-format.js";
-import { Data, Effect } from "effect";
-import { z } from "zod";
+import { formatSchemaIssueList, mutableArray, nonEmptyMutableArray, parseResultWithSchema, struct, trimmedRequiredString, withDefault } from "../schema-boundary.js";
+import { errorMessage } from "./validation-error-format.js";
+import * as Effect from "effect/Effect";
+import * as Option$1 from "effect/Option";
+import * as Schema from "effect/Schema";
+import * as Arr from "effect/Array";
+import * as HashMap from "effect/HashMap";
 //#region src/tickets/ticket-plan.ts
-const LOCAL_KEY_RE = /^[a-z][a-z0-9-]*$/;
-const nonEmptyStringSchema = z.string().trim().min(1);
-const localKeySchema = nonEmptyStringSchema.regex(LOCAL_KEY_RE, { message: "local keys must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens" });
-const acceptanceCriterionSchema = z.object({
+const LOCAL_KEY_RE = /^[a-z][a-z0-9-]*$/u;
+const nonEmptyStringSchema = trimmedRequiredString;
+const localKeySchema = nonEmptyStringSchema.check(Schema.makeFilter((value) => LOCAL_KEY_RE.test(value) || "local keys must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens", {
+	description: "Lowercase local ticket key with letters, numbers, and hyphens.",
+	identifier: "TicketPlanLocalKey",
+	title: "Ticket plan local key"
+}));
+const acceptanceCriterionSchema = struct({
 	evidence: nonEmptyStringSchema,
 	text: nonEmptyStringSchema
-}).strict();
-const plannedTaskSchema = z.object({
-	acceptance_criteria: z.array(acceptanceCriterionSchema).min(1),
-	depends_on: z.array(localKeySchema).default([]),
+});
+const plannedTaskSchema = struct({
+	acceptance_criteria: nonEmptyMutableArray(acceptanceCriterionSchema),
+	depends_on: withDefault(mutableArray(localKeySchema), []),
 	description: nonEmptyStringSchema,
 	key: localKeySchema,
-	likely_files: z.array(nonEmptyStringSchema).default([]),
+	likely_files: withDefault(mutableArray(nonEmptyStringSchema), []),
 	plan: nonEmptyStringSchema,
-	priority: z.enum([
+	priority: Schema.optional(Schema.Literals([
 		"high",
 		"medium",
 		"low"
-	]).optional(),
-	references: z.array(nonEmptyStringSchema).default([]),
+	])),
+	references: withDefault(mutableArray(nonEmptyStringSchema), []),
 	title: nonEmptyStringSchema
-}).strict();
-const epicTaskSchema = plannedTaskSchema.omit({ depends_on: true }).extend({ key: localKeySchema.default("epic") }).strict();
-const ticketPlanSchema = z.object({
-	epic: epicTaskSchema.optional(),
-	tickets: z.array(plannedTaskSchema).min(1)
-}).strict().superRefine((plan, ctx) => {
-	const seenKeys = validateUniqueTicketKeys(plan.tickets, ctx);
-	validateEpicKey(plan.epic, seenKeys, ctx);
-	validateLocalDependencies(plan.tickets, seenKeys, ctx);
 });
-var TicketPlanError = class extends Data.TaggedError("TicketPlanError") {};
-function parseTicketPlanEffect(source) {
-	return Effect.gen(function* () {
-		const json = yield* Effect.try({
-			catch: (error) => new TicketPlanError({ message: `Could not parse ticket plan JSON: ${errorMessage(error)}` }),
-			try: () => JSON.parse(source)
-		});
-		const decoded = ticketPlanSchema.safeParse(json);
-		if (decoded.success) return decoded.data;
-		return yield* Effect.fail(new TicketPlanError({ message: `Invalid ticket plan: ${formatZodIssues(decoded.error.issues)}` }));
-	});
-}
-function validateUniqueTicketKeys(tickets, ctx) {
-	const seenKeys = /* @__PURE__ */ new Map();
-	for (const [index, ticket] of tickets.entries()) {
-		const firstIndex = seenKeys.get(ticket.key);
-		if (firstIndex !== void 0) ctx.addIssue({
-			code: "custom",
-			message: `duplicate local ticket key '${ticket.key}' first used at tickets.${firstIndex}.key`,
-			path: [
-				"tickets",
-				index,
-				"key"
-			]
-		});
-		seenKeys.set(ticket.key, index);
-	}
-	return seenKeys;
-}
-function validateEpicKey(epic, seenKeys, ctx) {
-	if (!(epic && seenKeys.has(epic.key))) return;
-	ctx.addIssue({
-		code: "custom",
-		message: `epic key '${epic.key}' conflicts with a ticket key`,
+const epicTaskSchema = struct({
+	acceptance_criteria: nonEmptyMutableArray(acceptanceCriterionSchema),
+	description: nonEmptyStringSchema,
+	key: withDefault(localKeySchema, "epic"),
+	likely_files: withDefault(mutableArray(nonEmptyStringSchema), []),
+	plan: nonEmptyStringSchema,
+	priority: Schema.optional(Schema.Literals([
+		"high",
+		"medium",
+		"low"
+	])),
+	references: withDefault(mutableArray(nonEmptyStringSchema), []),
+	title: nonEmptyStringSchema
+});
+const emptyTicketKeyValidation = {
+	issues: [],
+	seenKeys: HashMap.empty()
+};
+var TicketPlanError = class extends Schema.TaggedErrorClass()("TicketPlanError", { message: Schema.String }) {};
+const validateUniqueTicketKeys = (tickets) => Arr.reduce(tickets, emptyTicketKeyValidation, (state, ticket, index) => {
+	const duplicateIssue = Option$1.map(HashMap.get(state.seenKeys, ticket.key), (firstIndex) => ({
+		issue: `duplicate local ticket key '${ticket.key}' first used at tickets.${firstIndex}.key`,
+		path: [
+			"tickets",
+			index,
+			"key"
+		]
+	}));
+	return {
+		issues: [...state.issues, ...Arr.fromOption(duplicateIssue)],
+		seenKeys: HashMap.set(state.seenKeys, ticket.key, index)
+	};
+});
+const validateEpicKey = (epic, seenKeys) => Option$1.match(epic, {
+	onNone: () => [],
+	onSome: (value) => HashMap.has(seenKeys, value.key) ? [{
+		issue: `epic key '${value.key}' conflicts with a ticket key`,
 		path: ["epic", "key"]
+	}] : []
+});
+const validateTicketDependencies = (ticket, ticketIndex, seenKeys) => Arr.flatMap(ticket.depends_on, (dependencyKey, dependencyIndex) => HashMap.has(seenKeys, dependencyKey) ? [] : [{
+	issue: `unknown dependency key '${dependencyKey}'`,
+	path: [
+		"tickets",
+		ticketIndex,
+		"depends_on",
+		dependencyIndex
+	]
+}]);
+const validateLocalDependencies = (tickets, seenKeys) => Arr.flatMap(tickets, (ticket, ticketIndex) => validateTicketDependencies(ticket, ticketIndex, seenKeys));
+const ticketPlanSchema = struct({
+	epic: Schema.optional(epicTaskSchema),
+	tickets: nonEmptyMutableArray(plannedTaskSchema)
+}).check(Schema.makeFilter((plan) => {
+	const { issues: keyIssues, seenKeys } = validateUniqueTicketKeys(plan.tickets);
+	const issues = [
+		...keyIssues,
+		...validateEpicKey(Option$1.fromUndefinedOr(plan.epic), seenKeys),
+		...validateLocalDependencies(plan.tickets, seenKeys)
+	];
+	return Arr.match(issues, {
+		onEmpty: () => true,
+		onNonEmpty: (values) => values
 	});
-}
-function validateLocalDependencies(tickets, seenKeys, ctx) {
-	for (const [ticketIndex, ticket] of tickets.entries()) validateTicketDependencies(ticket, ticketIndex, seenKeys, ctx);
-}
-function validateTicketDependencies(ticket, ticketIndex, seenKeys, ctx) {
-	for (const [dependencyIndex, dependencyKey] of ticket.depends_on.entries()) {
-		if (seenKeys.has(dependencyKey)) continue;
-		ctx.addIssue({
-			code: "custom",
-			message: `unknown dependency key '${dependencyKey}'`,
-			path: [
-				"tickets",
-				ticketIndex,
-				"depends_on",
-				dependencyIndex
-			]
-		});
-	}
-}
+}, {
+	description: "Ticket plan keys must be unique and dependencies must resolve.",
+	identifier: "TicketPlanGraphIntegrity",
+	title: "Ticket plan graph integrity"
+}));
+const parseTicketPlanEffect = (source) => Effect.gen(function* effectBody() {
+	const json = parseResultWithSchema(Schema.UnknownFromJsonString, source);
+	if (!json.ok) return yield* Effect.fail(new TicketPlanError({ message: `Could not parse ticket plan JSON: ${errorMessage(json.error)}` }));
+	const decoded = parseResultWithSchema(ticketPlanSchema, json.value, { onExcessProperty: "error" });
+	if (decoded.ok) return decoded.value;
+	return yield* Effect.fail(new TicketPlanError({ message: `Invalid ticket plan: ${formatSchemaIssueList(decoded.issues)}` }));
+});
 //#endregion
 export { parseTicketPlanEffect, ticketPlanSchema };

package/dist/tickets/ticket-selection.d.ts

@@ -1 +1,3 @@
-export { };
+import "./backlog-task-store.js";
+import "./ticket-graph.js";
+import { Option } from "effect";

package/dist/tickets/ticket-selection.js

@@ -1,55 +1,27 @@
 import { compareTaskIds, predecessorIds, scopedTicketIds } from "./ticket-graph.js";
+import { Option } from "effect";
 //#region src/tickets/ticket-selection.ts
 const PRIORITY_RANK = {
 	high: 0,
-	medium: 1,
-	low: 2
+	low: 2,
+	medium: 1
 };
-function selectReadyTickets(graph, options = {}) {
-	const ready = scopedTicketIds(graph, options.rootId).map((id) => graph.tasksById.get(id)).filter((task) => task !== void 0).filter((task) => isReadyTicket(graph, task, options));
-	if (options.strategy === "bfs" || options.strategy === "dfs") return orderByTraversal(graph, ready, options);
-	return ready.sort(compareReadyTickets);
-}
-function selectNextTicket(graph, options = {}) {
-	return selectReadyTickets(graph, options)[0];
-}
-function isReadyTicket(graph, task, options) {
-	return task.status === "To Do" && (options.includeParents === true || !hasIncompleteChildren(graph, task.id)) && predecessorIds(graph, task.id).every((dependencyId) => graph.tasksById.get(dependencyId)?.status === "Done");
-}
-function hasIncompleteChildren(graph, taskId) {
-	return (graph.childrenByParentId.get(taskId) ?? []).some((child) => child.status !== "Done");
-}
-function orderByTraversal(graph, ready, options) {
-	const remaining = new Map(ready.map((task) => [task.id, task]));
-	const ordered = [];
-	for (const id of traversalIds(graph, options.rootId, options.strategy)) {
-		const task = remaining.get(id);
-		if (task) {
-			ordered.push(task);
-			remaining.delete(id);
-		}
-	}
-	return [...ordered, ...[...remaining.values()].sort(compareReadyTickets)];
-}
-function traversalIds(graph, rootId, strategy) {
-	const roots = rootId ? [rootId] : rootIds(graph);
-	return strategy === "dfs" ? dfsIds(graph, roots) : bfsIds(graph, roots);
-}
-function rootIds(graph) {
-	return scopedTicketIds(graph).filter((id) => !graph.tasksById.get(id)?.parentTaskId).sort(compareTaskIds);
-}
-function bfsIds(graph, roots) {
+const hasIncompleteChildren = (graph, taskId) => (graph.childrenByParentId.get(taskId) ?? []).some((child) => child.status !== "Done");
+const isReadyTicket = (graph, task, options) => task.status === "To Do" && (options.includeParents === true || !hasIncompleteChildren(graph, task.id)) && predecessorIds(graph, task.id).every((dependencyId) => graph.tasksById.get(dependencyId)?.status === "Done");
+const rootIds = (graph) => scopedTicketIds(graph).filter((id) => graph.tasksById.get(id)?.parentTaskId === void 0).toSorted(compareTaskIds);
+const childIds = (graph, id) => [...graph.childrenByParentId.get(id) ?? []].map((task) => task.id).toSorted(compareTaskIds);
+const bfsIds = (graph, roots) => {
 	const result = [];
 	const queue = [...roots];
 	while (queue.length > 0) {
 		const id = queue.shift();
-		if (!id) continue;
+		if (id === void 0) continue;
 		result.push(id);
 		queue.push(...childIds(graph, id));
 	}
 	return result;
-}
-function dfsIds(graph, roots) {
+};
+const dfsIds = (graph, roots) => {
 	const result = [];
 	const visit = (id) => {
 		result.push(id);
@@ -57,18 +29,31 @@ function dfsIds(graph, roots) {
 	};
 	for (const root of roots) visit(root);
 	return result;
-}
-function childIds(graph, id) {
-	return [...graph.childrenByParentId.get(id) ?? []].map((task) => task.id).sort(compareTaskIds);
-}
-function compareReadyTickets(a, b) {
-	return priorityRank(a) - priorityRank(b) || ordinal(a) - ordinal(b) || compareTaskIds(a.id, b.id);
-}
-function priorityRank(task) {
-	return PRIORITY_RANK[task.priority ?? "medium"];
-}
-function ordinal(task) {
-	return task.ordinal ?? Number.MAX_SAFE_INTEGER;
-}
+};
+const traversalIds = (graph, rootId, strategy) => {
+	const roots = Option.isSome(rootId) ? [rootId.value] : rootIds(graph);
+	return Option.isSome(strategy) && strategy.value === "dfs" ? dfsIds(graph, roots) : bfsIds(graph, roots);
+};
+const priorityRank = (task) => PRIORITY_RANK[task.priority ?? "medium"];
+const ordinal = (task) => task.ordinal ?? Number.MAX_SAFE_INTEGER;
+const compareReadyTickets = (a, b) => priorityRank(a) - priorityRank(b) || ordinal(a) - ordinal(b) || compareTaskIds(a.id, b.id);
+const orderByTraversal = (graph, ready, options) => {
+	const remaining = new Map(ready.map((task) => [task.id, task]));
+	const ordered = [];
+	for (const id of traversalIds(graph, Option.fromUndefinedOr(options.rootId), Option.fromUndefinedOr(options.strategy))) {
+		const task = remaining.get(id);
+		if (task !== void 0) {
+			ordered.push(task);
+			remaining.delete(id);
+		}
+	}
+	return [...ordered, ...[...remaining.values()].toSorted(compareReadyTickets)];
+};
+const selectReadyTickets = (graph, options = {}) => {
+	const ready = scopedTicketIds(graph, options.rootId).map((id) => graph.tasksById.get(id)).filter((task) => task !== void 0).filter((task) => isReadyTicket(graph, task, options));
+	if (options.strategy === "bfs" || options.strategy === "dfs") return orderByTraversal(graph, ready, options);
+	return ready.toSorted(compareReadyTickets);
+};
+const selectNextTicket = (graph, options = {}) => Option.fromUndefinedOr(selectReadyTickets(graph, options)[0]);
 //#endregion
 export { selectNextTicket, selectReadyTickets };

package/dist/tickets/ticket-task-index.js

@@ -1,24 +1,20 @@
 //#region src/tickets/ticket-task-index.ts
-function compareTicketIds(a, b) {
-	return a.localeCompare(b, void 0, { numeric: true });
-}
-function compareBacklogTasks(a, b) {
-	return compareTicketIds(a.id, b.id);
-}
-function indexChildrenByParentId(tasks) {
-	const childrenByParentId = /* @__PURE__ */ new Map();
-	for (const task of tasks) addTaskToParentIndex(childrenByParentId, task);
-	sortParentIndex(childrenByParentId);
-	return childrenByParentId;
-}
-function addTaskToParentIndex(childrenByParentId, task) {
-	if (!task.parentTaskId) return;
+const compareTicketIds = (a, b) => a.localeCompare(b, void 0, { numeric: true });
+const compareBacklogTasks = (a, b) => compareTicketIds(a.id, b.id);
+const addTaskToParentIndex = (childrenByParentId, task) => {
+	if (task.parentTaskId === void 0 || task.parentTaskId.length === 0) return;
 	const siblings = childrenByParentId.get(task.parentTaskId) ?? [];
 	siblings.push(task);
 	childrenByParentId.set(task.parentTaskId, siblings);
-}
-function sortParentIndex(childrenByParentId) {
+};
+const sortParentIndex = (childrenByParentId) => {
 	for (const siblings of childrenByParentId.values()) siblings.sort(compareBacklogTasks);
-}
+};
+const indexChildrenByParentId = (tasks) => {
+	const childrenByParentId = /* @__PURE__ */ new Map();
+	for (const task of tasks) addTaskToParentIndex(childrenByParentId, task);
+	sortParentIndex(childrenByParentId);
+	return childrenByParentId;
+};
 //#endregion
 export { compareBacklogTasks, compareTicketIds, indexChildrenByParentId };

package/dist/tickets/validation-error-format.js

@@ -1,12 +1,5 @@
+import { formatSchemaIssueList } from "../schema-boundary.js";
 //#region src/tickets/validation-error-format.ts
-function formatZodIssues(issues) {
-	return issues.map((issue) => {
-		const path = issue.path.join(".");
-		return path ? `${path}: ${issue.message}` : issue.message;
-	}).join("; ");
-}
-function errorMessage(error) {
-	return error instanceof Error ? error.message : String(error);
-}
+const errorMessage = (error) => error instanceof Error ? error.message : String(error);
 //#endregion
-export { errorMessage, formatZodIssues };
+export { errorMessage, formatSchemaIssueList as formatSchemaIssues };

package/dist/token-estimator.js

@@ -1,3 +1,4 @@
+import { Option } from "effect";
 import { getEncoding } from "js-tiktoken";
 //#region src/token-estimator.ts
 /**
@@ -10,14 +11,18 @@ import { getEncoding } from "js-tiktoken";
 * budget/routing decisions only. For exact counts on Anthropic runners, use the
 * Anthropic `count_tokens` API.
 */
-let encoder;
-function encoding() {
-	encoder ??= getEncoding("o200k_base");
-	return encoder;
-}
-function estimateTokens(text) {
+let encoder = Option.none();
+const encoding = () => {
+	if (Option.isNone(encoder)) {
+		const resolved = getEncoding("o200k_base");
+		encoder = Option.some(resolved);
+		return resolved;
+	}
+	return encoder.value;
+};
+const estimateTokens = (text) => {
 	if (text.length === 0) return 0;
 	return encoding().encode(text).length;
-}
+};
 //#endregion
 export { estimateTokens };

package/dist/unknown-fields.js

@@ -0,0 +1,21 @@
+import * as Option$1 from "effect/Option";
+import * as P from "effect/Predicate";
+//#region src/unknown-fields.ts
+const isUnknownRecord = (value) => P.isObject(value) && !Array.isArray(value);
+const stringField = (value, field) => {
+	if (!isUnknownRecord(value)) return Option$1.none();
+	const fieldValue = value[field];
+	return P.isString(fieldValue) ? Option$1.some(fieldValue) : Option$1.none();
+};
+const numberField = (value, field) => {
+	if (!isUnknownRecord(value)) return Option$1.none();
+	const fieldValue = value[field];
+	return P.isNumber(fieldValue) ? Option$1.some(fieldValue) : Option$1.none();
+};
+const booleanField = (value, field) => {
+	if (!isUnknownRecord(value)) return Option$1.none();
+	const fieldValue = value[field];
+	return P.isBoolean(fieldValue) ? Option$1.some(fieldValue) : Option$1.none();
+};
+//#endregion
+export { booleanField, numberField, stringField };

package/dist/workflow-submit-contract.d.ts

@@ -1,13 +1,12 @@
-import { z } from "zod";
-
+import * as Schema from "effect/Schema";
 //#region src/workflow-submit-contract.d.ts
-declare const workflowSubmitResultSchema: z.ZodObject<{
-  namespace: z.ZodString;
-  payloadConfigMapName: z.ZodString;
-  scheduleConfigMapName: z.ZodOptional<z.ZodString>;
-  taskDescriptorConfigMapName: z.ZodOptional<z.ZodString>;
-  workflowName: z.ZodString;
-  workflowUid: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
+declare const workflowSubmitResultSchema: Schema.Struct<{
+  readonly namespace: Schema.NonEmptyString;
+  readonly payloadConfigMapName: Schema.NonEmptyString;
+  readonly scheduleConfigMapName: Schema.optional<Schema.NonEmptyString>;
+  readonly taskDescriptorConfigMapName: Schema.optional<Schema.NonEmptyString>;
+  readonly workflowName: Schema.NonEmptyString;
+  readonly workflowUid: Schema.optional<Schema.NonEmptyString>;
+}>;
 //#endregion
 export { workflowSubmitResultSchema };

package/dist/workflow-submit-contract.js

@@ -1,12 +1,13 @@
-import { z } from "zod";
+import { requiredString, struct } from "./schema-boundary.js";
+import * as Schema from "effect/Schema";
 //#region src/workflow-submit-contract.ts
-const workflowSubmitResultSchema = z.object({
-	namespace: z.string().min(1),
-	payloadConfigMapName: z.string().min(1),
-	scheduleConfigMapName: z.string().min(1).optional(),
-	taskDescriptorConfigMapName: z.string().min(1).optional(),
-	workflowName: z.string().min(1),
-	workflowUid: z.string().min(1).optional()
-}).strict();
+const workflowSubmitResultSchema = struct({
+	namespace: requiredString,
+	payloadConfigMapName: requiredString,
+	scheduleConfigMapName: Schema.optional(requiredString),
+	taskDescriptorConfigMapName: Schema.optional(requiredString),
+	workflowName: requiredString,
+	workflowUid: Schema.optional(requiredString)
+});
 //#endregion
 export { workflowSubmitResultSchema };

package/docs/adr-moka-postgres-schema-isolation.md

@@ -56,3 +56,51 @@ operator-reviewed rollback because application safety depends on the runtime rol
 Fresh installs create Moka tables in `moka`, not `public`. Existing public layouts get an in-place table move without
 row copy or data loss. Future migrations must keep schema-qualified Drizzle declarations and keep the runtime role's
 public grants restricted.
+
+## Runner connection targets `moka` (ENG-44.1)
+
+Every runner client that opens `MOKA_DB_URL` — the durable store and the run-control store — is opened through the one
+factory `openMokaSubstrateClient` (`src/runtime/durable-store/postgres/client.ts`). It pins the session `search_path`
+to `moka` via the `postgres.js` `connection` startup parameters, so `MOKA_DB_URL` genuinely *targets* the dedicated
+schema: unqualified SQL and an ad-hoc `psql "$MOKA_DB_URL"` resolve in `moka`, never `public`. Runtime queries are
+already schema-qualified through `pgSchema("moka")`; the connection-level `search_path` is defense in depth, **not**
+the access control. The access control is the runtime role's grants, which are infra-owned (below).
+
+## Provisioning the limited runtime role (infra-owned)
+
+The limited role is **not** created by the runner migrator — the migrator runs *as* `MOKA_DB_URL`'s role, so it cannot
+mint its own least-privilege identity. Provisioning it is infra's job (CloudNativePG owns prod roles declaratively; a
+runner cannot `CREATE ROLE` on prod without becoming a second, drift-prone source of truth — see the Momokaya GitOps
+deploy standard). As of ENG-44.1 the prod cluster `momokaya-db-v3` has **no** dedicated `moka` role: `MOKA_DB_URL`, if
+wired, would use the database owner `momokaya`, which has full `public` access. Infra must provision:
+
+1. A dedicated login role `moka` on `momokaya-db-v3`, via `spec.managed.roles` in the infra CNPG `Cluster` manifest
+   (`infra k8s/manifests/pipeline-console-db/cluster.yaml`), with its password in a managed `Secret`.
+2. Grants: `GRANT USAGE, CREATE ON SCHEMA moka TO moka;` and ownership of the `moka` schema objects (so the migrator's
+   `CREATE`/`ALTER TABLE ... SET SCHEMA` succeed) — e.g. `ALTER SCHEMA moka OWNER TO moka;` plus reassignment of the
+   existing `moka.*` tables from `momokaya` to `moka`.
+3. **No** grant on schema `public`. On PostgreSQL 15+ the default `PUBLIC` `CREATE` grant on `public` is already
+   removed, so a fresh non-owner role has no `public` access unless one is added — infra must simply not add one.
+4. Point the runner's `dbAuthSecretName` / `dbAuthSecretKey` (chart `pipeline.runner.secretRefs`) at the `moka`-role
+   DSN secret, so `MOKA_DB_URL` uses the limited role rather than the owner.
+
+### Grant assertion (recorded 2026-07-09, `momokaya-db-v3`, PostgreSQL 18.4)
+
+Verified with `psql` as superuser against the reachable prod DB. The limited-role model was exercised for real inside a
+rolled-back transaction (`CREATE ROLE` + `GRANT` + `SET ROLE` + a `CREATE TABLE public.*` attempt), leaving no persisted
+prod change:
+
+```
+[roles]   only momokaya (db/schema owner), postgres, cnpg_metrics_exporter, streaming_replica — no dedicated moka role
+[schemas] moka   owner=momokaya  acl=(owner-only; no PUBLIC/other grants)
+          public owner=momokaya  acl={momokaya=UC/momokaya}   (no PUBLIC grant — PG18 default)
+[today]   momokaya USAGE public = t,  CREATE public = t        # MOKA_DB_URL uses the owner => full public access
+[probe: limited moka role granted ONLY schema moka, rolled back]
+          moka_probe USAGE moka   = t,  CREATE moka   = t
+          moka_probe USAGE public = f,  CREATE public = f
+          SET ROLE moka_probe; CREATE TABLE public.x  => ERROR: permission denied for schema public
+[cleanup] probe rolled back — 0 moka_probe rows persist
+```
+
+The assertion confirms the design holds — a role granted only `moka` cannot touch `public` — and that the enforcing
+role is still absent on prod, so item 1–4 above remain outstanding infra work.

package/docs/adr-opencode-first-goal-loop-runtime.md

@@ -32,17 +32,17 @@ The package still needs its own scheduler and state model because the pipeline c
 
 ## Library-First Vetting
 
-| Item | Role in the Stack | Decision |
-| --- | --- | --- |
-| `@opencode-ai/plugin` | Official plugin API for OpenCode lifecycle hooks | Use when package code implements OpenCode plugins. |
-| `@opencode-ai/sdk` | Official programmatic API for OpenCode integration | Use when package code needs OpenCode API access outside generated config. |
-| `opencode-handoff` | Handoff/session capture pattern | Incorporate the relevant handoff behaviour into package-owned continuation flows. |
-| DCP code | Dynamic context pruning for long OpenCode sessions | Include in the default OpenCode stack and wire it into continuation/context policy. |
-| `@devtheops/opencode-plugin-otel` | OpenTelemetry plugin reference | Use as telemetry pattern input for package-owned runtime observability. |
-| `opencode-snip` | Snippet/prompt helper pattern | Use as prompt-discipline and reusable snippet input. |
-| `opencode-background-agents` | Background/delegated agent pattern | Use as delegation input for scheduler-generated team mode. |
-| `opencode-mem` | Memory/context helper pattern | Use as input for durable goal context and memory projection. |
-| `cupcake` | OpenCode ecosystem utility surfaced during research | Keep in the surfaced ecosystem inventory when relevant to package workflows. |
+| Item                              | Role in the Stack                                   | Decision                                                                            |
+| --------------------------------- | --------------------------------------------------- | ----------------------------------------------------------------------------------- |
+| `@opencode-ai/plugin`             | Official plugin API for OpenCode lifecycle hooks    | Use when package code implements OpenCode plugins.                                  |
+| `@opencode-ai/sdk`                | Official programmatic API for OpenCode integration  | Use when package code needs OpenCode API access outside generated config.           |
+| `opencode-handoff`                | Handoff/session capture pattern                     | Incorporate the relevant handoff behaviour into package-owned continuation flows.   |
+| DCP code                          | Dynamic context pruning for long OpenCode sessions  | Include in the default OpenCode stack and wire it into continuation/context policy. |
+| `@devtheops/opencode-plugin-otel` | OpenTelemetry plugin reference                      | Use as telemetry pattern input for package-owned runtime observability.             |
+| `opencode-snip`                   | Snippet/prompt helper pattern                       | Use as prompt-discipline and reusable snippet input.                                |
+| `opencode-background-agents`      | Background/delegated agent pattern                  | Use as delegation input for scheduler-generated team mode.                          |
+| `opencode-mem`                    | Memory/context helper pattern                       | Use as input for durable goal context and memory projection.                        |
+| `cupcake`                         | OpenCode ecosystem utility surfaced during research | Keep in the surfaced ecosystem inventory when relevant to package workflows.        |
 
 ## Consequences
 

package/docs/config-architecture.md

@@ -322,11 +322,11 @@ timeouts, output limits, sanitized env, and explicit trust flags.
 
 ## Host Support Matrix
 
-| Runner      | Native subagents | Rules | Skills | MCP | Outputs                   | Generated resources             |
-| ----------- | ---------------- | ----- | ------ | --- | ------------------------- | ------------------------------- |
-| OpenCode    | yes              | yes   | yes    | yes | text, JSON, JSONL, schema | commands, agents, skills, plugins, LSP |
-| Claude Code | via `opencode run` | yes (skill) | yes | yes | declared by runner | commands, wrapper agents, settings |
-| command     | no               | no    | no     | no  | declared by runner        | subprocess argv                 |
+| Runner      | Native subagents   | Rules       | Skills | MCP | Outputs                   | Generated resources                    |
+| ----------- | ------------------ | ----------- | ------ | --- | ------------------------- | -------------------------------------- |
+| OpenCode    | yes                | yes         | yes    | yes | text, JSON, JSONL, schema | commands, agents, skills, plugins, LSP |
+| Claude Code | via `opencode run` | yes (skill) | yes    | yes | declared by runner        | commands, wrapper agents, settings     |
+| command     | no                 | no          | no     | no  | declared by runner        | subprocess argv                        |
 
 Generated host resources follow a native runner rule. OpenCode runner nodes use
 OpenCode native agents. The Claude Code host does not run MoKa profiles natively:
@@ -373,15 +373,15 @@ overflow the call stack on deep generated workflow chains.
 The shipped `defaults/pipeline.yaml` turns **`context_handoff`, `repo_map`, and
 `durability` ON** — moka uses its architecture by default; `parallel_worktrees`
 is opt-in. Each block can be overridden in `pipeline.yaml`; the per-block
-`# default …` notes below mark the *schema* default that applies when a block is
+`# default …` notes below mark the _schema_ default that applies when a block is
 omitted entirely.
 
 ### `context_handoff` — curated node-to-node handoffs
 
 ```yaml
 context_handoff:
-  enabled: true          # default false
-  model: openai/gpt-5.5-fast   # optional cheap model for the deriving call
+  enabled: true # default false
+  model: openai/gpt-5.5-fast # optional cheap model for the deriving call
 ```
 
 When enabled, each agent node derives a structured `NodeHandoff`
@@ -396,7 +396,7 @@ raw output text, so disabling the flag is byte-identical to prior behaviour.
 
 ```yaml
 parallel_worktrees:
-  enabled: true          # default false
+  enabled: true # default false
 ```
 
 When enabled, every child of a `kind: parallel` node runs in its own git
@@ -404,15 +404,15 @@ worktree on an auto-named branch (`.pipeline/worktrees/...`), so concurrent
 candidate edits cannot collide. Teardown is idempotent and crash-safe: a
 worktree with dirty or unpushed work is retained (never deleted), and orphaned
 worktrees are GC'd on the next parallel node under the same guard. A worktree is
-*not* a sandbox (node_modules/build state are shared) — real isolation remains
+_not_ a sandbox (node_modules/build state are shared) — real isolation remains
 k8s mode. SDK-runner nodes honour the per-child directory via `plan.cwd`.
 
 ### `durability` — durable crash-resume
 
 ```yaml
 durability:
-  enabled: true              # default false
-  dir: .pipeline/journal     # default
+  enabled: true # default false
+  dir: .pipeline/journal # default
 ```
 
 When enabled, the scheduler journals each terminal node result to an
@@ -431,7 +431,7 @@ default → the scheduler runs purely in-memory, exactly as before.
 mcp_gateway:
   provider: toolhive
   mode: hosted
-  host_scope: global       # default "project"
+  host_scope: global # default "project"
 ```
 
 The singleton pipeline gateway is normally synthesized into each repo's

package/docs/mcp-host-isolation.md

@@ -11,6 +11,7 @@ OpenCode project config is generated at `.opencode/opencode.json` with only the
 config environment variables; agents inherit the project-level config.
 
 References:
+
 - https://opencode.ai/docs/config/
 - https://dev.opencode.ai/docs/mcp-servers/