@oisincoveney/pipeline 3.24.3 → 4.0.0

package/README.md

@@ -379,6 +379,18 @@ Package and container publishing is owned by GitHub Actions. Do not publish from
 a workstation with `npm publish`, `semantic-release`, Docker pushes, or direct
 registry commands.
 
+`@oisincoveney/pipeline` is published by `engine`'s own root-level
+`.github/workflows/publish-pipeline.yml`, from this directory's current
+(contract-v2) source, on every push to `main` under `runner/**`. The legacy
+`oisin-ee/pipeline-runner` repository's publish workflow is retired — it
+predates the ENG-67.3 contract-v2 bump and must not be used to cut a release.
+The workflow authenticates to `registry.npmjs.org` via npm Trusted Publishing
+(OIDC) rather than a static `NPM_TOKEN`; no npm credential is stored as a
+GitHub secret in this org. Trusted Publishing must be configured on
+npmjs.com for `@oisincoveney/pipeline`, bound to `oisin-ee/engine` and the
+`publish-pipeline.yml` workflow filename, before this workflow can publish. A
+successful release also triggers the runner container image build.
+
 The authoritative package version lives in the npm registry, not in this
 repository. `package.json` pins the `0.0.0-development` semantic-release
 sentinel and is never bumped in git; semantic-release derives and publishes the

package/dist/argo-graph.js

@@ -75,8 +75,9 @@ const assertUniqueNodeIds = (nodes) => {
 };
 const resolveDependencyTaskNames = (context, nodeIds) => uniqueStrings(resolveExecutableDependencyIds(context.nodeById, nodeIds).map((id) => argoTaskName(id)));
 const compileExecutableNode = (context, node, inheritedNeeds) => {
+	const dependencies = resolveDependencyTaskNames(context, [...inheritedNeeds, ...node.needs]);
 	return parseStrictWithSchema(argoExecutableTaskSchema, {
-		dependencies: resolveDependencyTaskNames(context, [...inheritedNeeds, ...node.needs]),
+		dependencies,
 		nodeId: node.id,
 		taskName: argoTaskName(node.id),
 		templateName: argoTemplateName(node.id)
@@ -90,7 +91,8 @@ const compileArgoNodes = (context, nodes, inheritedNeeds, initialTasks = []) =>
 }));
 const compileArgoNode = (input) => Match.value(input.node.kind).pipe(Match.whenOr("agent", "builtin", "command", () => [...input.tasks, compileExecutableNode(input.context, input.node, input.inheritedNeeds)]), Match.when("group", () => input.tasks), Match.when("parallel", () => compileArgoNodes(input.context, input.node.children ?? [], [...input.inheritedNeeds, ...input.node.needs], input.tasks)), Match.exhaustive);
 const compileArgoExecutionGraphUnchecked = (plan) => {
-	const tasks = compileArgoNodes({ nodeById: indexPlannedNodesById(plan.topologicalOrder) }, plan.topologicalOrder, []);
+	const context = { nodeById: indexPlannedNodesById(plan.topologicalOrder) };
+	const tasks = compileArgoNodes(context, plan.topologicalOrder, []);
 	const terminalTasks = terminalDependencyItems(tasks, (task) => task.taskName, (task) => task.dependencies);
 	return {
 		tasks,

package/dist/argo-submit.d.ts

@@ -1,8 +1,8 @@
 import { PipelineConfig } from "./config/schemas.js";
+import "./config.js";
 import { CoreApi, KubernetesArgoIoDependencies, WorkflowApi } from "./runtime/services/kubernetes-argo-service.js";
 import { workflowSubmitResultSchema } from "./workflow-submit-contract.js";
 import * as Schema from "effect/Schema";
-
 //#region src/argo-submit.d.ts
 declare const commandScheduleOptionsSchema: Schema.Struct<{
   readonly command: Schema.mutable<Schema.$Array<Schema.NonEmptyString>>;

package/dist/argo-submit.js

@@ -169,8 +169,9 @@ const ownRunConfigMaps = (input) => {
 		error: new ArgoSubmitError({ message: missingWorkflowUidMessage(input.result) }),
 		result: input.result
 	}).pipe(Effect.as(input.result));
+	const body = configMapOwnerReferencesPatch(ownerReference.value);
 	return patchRunConfigMapOwnerReferences({
-		body: configMapOwnerReferencesPatch(ownerReference.value),
+		body,
 		configMapNames: input.configMapNames,
 		dependencies: input.dependencies,
 		namespace: input.namespace,
@@ -229,12 +230,13 @@ const workflowSubmitResult = (response, workflow, base) => {
 const submitWorkflowManifest = (input) => Effect.gen(function* effectBody() {
 	const service = yield* KubernetesArgoService;
 	const workflow = applyWorkflowFieldOverrides(input.workflow, input.workflowFieldOverrides);
-	return workflowSubmitResult(yield* service.createWorkflow({
+	const response = yield* service.createWorkflow({
 		body: parseStrictWithSchema(runnerArgoWorkflowManifestSchema, workflow),
 		dependencies: input.dependencies,
 		namespace: input.namespace,
 		options: input.options
-	}), workflow, {
+	});
+	return workflowSubmitResult(response, workflow, {
 		namespace: input.namespace,
 		...input.resultExtras
 	});
@@ -294,8 +296,9 @@ const normalizeRunnerPayloadForSubmit = (input) => {
 const submitDynamicRunnerArgoWorkflowEffect = (rawOptions, dependencies) => {
 	const { config: _config, ...schemaOptions } = rawOptions;
 	const options = parseStrictWithSchema(submitDynamicRunnerArgoWorkflowOptionsSchema, schemaOptions);
+	const parsedPayload = parseStrictWithSchema(runnerCommandPayloadSchema, parseRunnerCommandPayload(options.payloadJson));
 	const { payload, payloadJson } = normalizeRunnerPayloadForSubmit({
-		payload: parseStrictWithSchema(runnerCommandPayloadSchema, parseRunnerCommandPayload(options.payloadJson)),
+		payload: parsedPayload,
 		payloadJson: options.payloadJson
 	});
 	if (payload.workflow.id !== options.workflowId) return Effect.fail(new ArgoSubmitError({ message: `Runner payload workflow '${payload.workflow.id}' does not match dynamic workflow '${options.workflowId}'` }));
@@ -335,18 +338,20 @@ const submitDynamicRunnerArgoWorkflowEffect = (rawOptions, dependencies) => {
 		workflowId: options.workflowId
 	});
 	return Effect.gen(function* effectBody() {
+		const configMaps = dynamicRunConfigMaps({
+			labels,
+			namespace: options.namespace,
+			payloadConfigMapName,
+			payloadJson
+		});
+		const createdConfigMapNames = yield* createRunConfigMaps({
+			configMaps,
+			dependencies,
+			namespace: options.namespace,
+			options
+		});
 		return yield* submitWorkflowWithRunConfigMaps({
-			configMapNames: yield* createRunConfigMaps({
-				configMaps: dynamicRunConfigMaps({
-					labels,
-					namespace: options.namespace,
-					payloadConfigMapName,
-					payloadJson
-				}),
-				dependencies,
-				namespace: options.namespace,
-				options
-			}),
+			configMapNames: createdConfigMapNames,
 			dependencies,
 			namespace: options.namespace,
 			options,
@@ -367,8 +372,9 @@ const compileSubmitArgoGraph = (compiled) => Effect.try({
 const submitRunnerArgoWorkflowEffect = (rawOptions, dependencies) => {
 	const { config, ...schemaOptions } = rawOptions;
 	const options = parseStrictWithSchema(submitRunnerArgoWorkflowOptionsSchema, schemaOptions);
+	const parsedPayload = parseStrictWithSchema(runnerCommandPayloadSchema, parseRunnerCommandPayload(options.payloadJson));
 	const { payload, payloadJson } = normalizeRunnerPayloadForSubmit({
-		payload: parseStrictWithSchema(runnerCommandPayloadSchema, parseRunnerCommandPayload(options.payloadJson)),
+		payload: parsedPayload,
 		payloadJson: options.payloadJson
 	});
 	const compiled = compileScheduleArtifact(config, parseScheduleArtifact(options.scheduleYaml, "schedule.yaml"));
@@ -415,22 +421,24 @@ const submitRunnerArgoWorkflowEffect = (rawOptions, dependencies) => {
 	});
 	return Effect.gen(function* effectBody() {
 		const graph = yield* graphEffect;
+		const configMaps = staticRunConfigMaps({
+			labels,
+			namespace: options.namespace,
+			payloadConfigMapName,
+			payloadJson,
+			scheduleConfigMapName: scheduleArtifactConfigMapName,
+			scheduleYaml: options.scheduleYaml,
+			taskDescriptorConfigMapName,
+			tasks: graph.tasks
+		});
+		const createdConfigMapNames = yield* createRunConfigMaps({
+			configMaps,
+			dependencies,
+			namespace: options.namespace,
+			options
+		});
 		return yield* submitWorkflowWithRunConfigMaps({
-			configMapNames: yield* createRunConfigMaps({
-				configMaps: staticRunConfigMaps({
-					labels,
-					namespace: options.namespace,
-					payloadConfigMapName,
-					payloadJson,
-					scheduleConfigMapName: scheduleArtifactConfigMapName,
-					scheduleYaml: options.scheduleYaml,
-					taskDescriptorConfigMapName,
-					tasks: graph.tasks
-				}),
-				dependencies,
-				namespace: options.namespace,
-				options
-			}),
+			configMapNames: createdConfigMapNames,
 			dependencies,
 			namespace: options.namespace,
 			options,

package/dist/argo-workflow.d.ts

@@ -1,6 +1,5 @@
 import { WorkflowExecutionPlan } from "./planning/compile.js";
 import { buildDynamicRunnerArgoWorkflowOptionsSchema, buildRunnerArgoWorkflowOptionsSchema } from "./remote/argo/model.js";
-
 //#region src/argo-workflow.d.ts
 declare const runnerArgoWorkflowManifestSchema: import("effect/Schema").Struct<{
   readonly apiVersion: import("effect/Schema").Literal<"argoproj.io/v1alpha1">;

package/dist/cli/doctor.js

@@ -188,10 +188,11 @@ const checkMokaAgents = async (cwd, config) => {
 		passed: true
 	} };
 	try {
-		const visible = visibleAgentNames((await execa("opencode", OPENCODE_AGENT_LIST_ARGS, {
+		const result = await execa("opencode", OPENCODE_AGENT_LIST_ARGS, {
 			cwd,
 			stdin: "ignore"
-		})).stdout);
+		});
+		const visible = visibleAgentNames(result.stdout);
 		if (!visible.recognized) return skippedAgentVisibility("OpenCode agent listing output was not recognized");
 		if (visible.ambiguous && expected.every((name) => !visible.names.has(name))) return skippedAgentVisibility("OpenCode agent listing output did not include recognizable MoKa agent names");
 		const missing = expected.filter((name) => !visible.names.has(name));
@@ -211,7 +212,8 @@ const checkMokaAgents = async (cwd, config) => {
 const headlessPermissionWarning = (path, entry) => {
 	try {
 		if (!statSync(path).isFile()) return [];
-		const risky = interactivePermissionPaths(matter(readFileSync(path, "utf-8")).data.permission);
+		const parsed = matter(readFileSync(path, "utf-8"));
+		const risky = interactivePermissionPaths(parsed.data.permission);
 		if (risky.length === 0) return [];
 		return [{
 			detail: `${entry} requires interactive permission prompts at ${risky.join(", ")}; headless MoKa runs may block.`,

package/dist/cli/factory-commands.js

@@ -4,14 +4,13 @@ import { Option } from "commander";
 //#region src/cli/factory-commands.ts
 const hasText = (value) => typeof value === "string" && value !== "";
 const registerFactoryCommands = (program) => {
-	program.command("create-experiment").description("Birth a fleet experiment: copier-stamp momokaya-template, create+push the org repo, register it in infra's fleet registry").requiredOption("--name <name>", "app name (kebab-case)").addOption(new Option("--flavor <flavor>", "app flavor").choices(["web", "expo-web"]).default("web")).option("--no-db", "skip the database surface").option("--no-previews", "skip per-PR preview environments").option("--org <org>", "GitHub org for the new repo").option("--template-src <source>", "copier template source").option("--template-ref <ref>", "template tag/ref (default: latest tag)").option("--infra-repo-url <url>", "infra repo the registry entry lands in").action(async (flags) => {
+	program.command("create-experiment").description("Birth a fleet experiment: copier-stamp momokaya-template, create+push the org repo, register it in infra's fleet registry").requiredOption("--name <name>", "app name (kebab-case)").addOption(new Option("--flavor <flavor>", "app flavor").choices(["web", "expo-web"]).default("web")).option("--no-db", "skip the database surface").option("--org <org>", "GitHub org for the new repo").option("--template-src <source>", "copier template source").option("--template-ref <ref>", "template tag/ref (default: latest tag)").option("--infra-repo-url <url>", "infra repo the registry entry lands in").action(async (flags) => {
 		const result = await runCreateExperiment({
 			db: flags.db,
 			flavor: flags.flavor,
 			...hasText(flags.infraRepoUrl) ? { infraRepoUrl: flags.infraRepoUrl } : {},
 			name: flags.name,
 			...hasText(flags.org) ? { org: flags.org } : {},
-			previews: flags.previews,
 			...hasText(flags.templateRef) ? { templateRef: flags.templateRef } : {},
 			...hasText(flags.templateSrc) ? { templateSource: flags.templateSrc } : {}
 		});

package/dist/cli/program.d.ts

@@ -1,8 +1,8 @@
 import { RunCommand } from "./run-command.js";
 import { TicketCommandOptions } from "../commands/ticket/shared.js";
+import "../commands/ticket-command.js";
 import { Effect } from "effect";
 import { Command } from "commander";
-
 //#region src/cli/program.d.ts
 interface CliProgramOptions {
   readonly runCommand?: RunCommand;

package/dist/cli/program.js

@@ -1,8 +1,10 @@
 import { loadPipelineConfig } from "../config/load.js";
 import "../config.js";
 import { registerBenchCommand } from "../commands/bench-command.js";
+import { registerCoordinatorCommand } from "../commands/coordinator-command.js";
 import { registerConfiguredEntrypointCommands } from "../commands/pipeline-command.js";
 import { registerRunnerCommandCommand } from "../commands/runner-command-command.js";
+import { registerRunnerNodeCommand } from "../commands/runner-node-command.js";
 import { registerTicketCommand } from "../commands/ticket-command.js";
 import { addMokaSubmitOptions, runMokaSubmitFromCli } from "./submit-options.js";
 import { registerRunControlCommands } from "../run-control/commands.js";
@@ -32,6 +34,8 @@ const registerApplicationCommands = (program, options) => {
 	registerLoopCommand(program);
 	registerFactoryCommands(program);
 	registerRunnerCommandCommand(program);
+	registerRunnerNodeCommand(program);
+	registerCoordinatorCommand(program);
 	registerBenchCommand(program);
 	registerTicketCommand(program, {
 		...options.ticketCommand,
@@ -49,7 +53,8 @@ const runEntrypointCommand = async (entrypoint, task) => {
 	await execute(task, { entrypoint });
 };
 const registerEntrypointCommands = (program, configuredPipeline) => {
-	configureEntrypointHelp(program, registerConfiguredEntrypointCommands(program, configuredPipeline, runEntrypointCommand));
+	const configuredEntrypointCommands = registerConfiguredEntrypointCommands(program, configuredPipeline, runEntrypointCommand);
+	configureEntrypointHelp(program, configuredEntrypointCommands);
 };
 const isPackageVersionRecord = (value) => typeof value === "object" && value !== null && "version" in value && typeof value.version === "string";
 const readPackageVersion = () => {
@@ -60,7 +65,8 @@ const readPackageVersion = () => {
 const createBaseProgram = () => new Command().name("moka").description("Submit work to Momokaya").version(readPackageVersion()).exitOverride();
 const loadConfiguredEntrypoints = (cwd) => loadPipelineConfig(cwd, { allowMissingLintFileReferences: true });
 const createCliProgram = (options = {}) => {
-	const configuredPipeline = loadConfiguredEntrypoints(process.env.PIPELINE_TARGET_PATH ?? process.cwd());
+	const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
+	const configuredPipeline = loadConfiguredEntrypoints(cwd);
 	const program = createBaseProgram();
 	registerApplicationCommands(program, options);
 	registerEntrypointCommands(program, configuredPipeline);

package/dist/cli/run-command.d.ts

@@ -1,5 +1,5 @@
+import "../run-control/contracts.js";
 import { RunResolution, RunResolverFlags } from "./run-resolver.js";
-
 //#region src/cli/run-command.d.ts
 interface RunCommandCall {
   readonly descriptionParts: string[];

package/dist/cli/run-commands.js

@@ -23,7 +23,8 @@ const createResolvedRunCommand = (options) => async (call) => {
 			await runLocalResolvedTask(resolvedTask, execution, runControl);
 		},
 		runRemoteSubmit: async ({ descriptionParts: parts, execution }) => {
-			printMokaSubmitResult(await runMokaSubmitFromCli(parts, remoteSubmitFlags(execution)));
+			const result = await runMokaSubmitFromCli(parts, remoteSubmitFlags(execution));
+			printMokaSubmitResult(result);
 		}
 	});
 };
@@ -31,13 +32,14 @@ const registerRunCommands = (program, options = {}) => {
 	const dispatchResolvedRunCommand = createResolvedRunCommand(options);
 	program.command("run").description("Primary command: run a workflow from package-owned @oisincoveney/pipeline config").argument("<description...>", "task description").option("--command", "treat input after -- as explicit argv for remote submission").option("--entrypoint <entrypoint>", "entrypoint id from package config").option("--detach", "start a supervised controller process in the background").addOption(new Option("--effort <effort>", "run effort").choices([...MOKA_RUN_EFFORTS]).default("normal")).option("--read-only", "run the read-only inspect workflow").option("--schedule <schedule>", "approved schedule YAML to execute").addOption(new Option("--target <target>", "execution target").choices([...MOKA_RUN_TARGETS]).default("local")).option("--workflow <workflow>", "workflow id from package config").action(async (descriptionParts, flags) => {
 		const task = descriptionParts.join(" ");
+		const resolution = resolveMokaRun({
+			flags,
+			task
+		});
 		await dispatchResolvedRunCommand({
 			descriptionParts,
 			flags,
-			resolution: resolveMokaRun({
-				flags,
-				task
-			}),
+			resolution,
 			task
 		});
 	});

package/dist/cli/run-service.d.ts

@@ -1,6 +1,5 @@
 import { RunEffort, RunMode, RunTarget } from "../run-control/contracts.js";
 import { runPipelineFromConfig } from "../pipeline-runtime.js";
-
 //#region src/cli/run-service.d.ts
 interface ExecuteOptions {
   entrypoint?: string;

package/dist/cli/run-service.js

@@ -171,7 +171,8 @@ const runPipelineSafely = async (inputs, runner, runStoreReporter) => await runW
 });
 const runAndPrintPipelineWithStore = async (inputs, store) => {
 	const runner = inputs.pipelineRunner ?? runPipelineFromConfig;
-	const runStoreReporter = await createRunStoreReporter(inputs, createTerminalRuntimeReporter(), store);
+	const terminalReporter = createTerminalRuntimeReporter();
+	const runStoreReporter = await createRunStoreReporter(inputs, terminalReporter, store);
 	printSupervisedFollowUp(inputs);
 	const result = await runPipelineSafely(inputs, runner, runStoreReporter);
 	console.log(formatRuntimeResult(result));
@@ -318,14 +319,16 @@ const prepareDetachedRun = async (input) => {
 const runDetachedResolvedTask = async (task, execution, runControl) => {
 	const worktreePath = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
 	const runId = generateRuntimeRunId();
+	const config = loadPipelineConfig(worktreePath, { allowMissingLintFileReferences: true });
+	const prepared = await prepareDetachedRun({
+		config,
+		execution,
+		runId,
+		task,
+		worktreePath
+	});
 	await persistDetachedRunController({
-		prepared: await prepareDetachedRun({
-			config: loadPipelineConfig(worktreePath, { allowMissingLintFileReferences: true }),
-			execution,
-			runId,
-			task,
-			worktreePath
-		}),
+		prepared,
 		runControl,
 		runId,
 		task,

package/dist/cli/submit-options.js

@@ -22,6 +22,10 @@ const resolveMokaBrokerAuth = (globalConfig) => {
 	if (brokerAuth === void 0) throw new Error("momokaya.submit.brokerAuth is required for remote submit");
 	return brokerAuth;
 };
+const deliveryFromFlags = (flags) => ({
+	...flags.preview === void 0 ? {} : { preview: flags.preview },
+	pullRequest: flags.openPr === true
+});
 const submitMokaCommandInput = (input, flags, commonOptions) => {
 	if (flags.quick === true || flags.schedule !== void 0 && flags.schedule !== "") throw new Error("--command cannot be combined with --quick or --schedule");
 	if (input.length === 0) throw new Error("Command argv is required when --command is set");
@@ -52,7 +56,7 @@ const addRunnerArgoOptions = (command, options = {}) => {
 		"Never"
 	]).default("Always")).option("--image-pull-secret <name>", "imagePullSecret name");
 };
-const addMokaSubmitOptions = (command) => addRunnerArgoOptions(command.option("--quick", "submit the compact graph").option("--command", "treat input after -- as explicit argv").option("--schedule <path>", "approved schedule YAML to submit").option("--event-url <url>", "runner event sink URL").option("--open-pr", "append an open-pull-request delivery node (preview-labelled PR)").option("--task <text>", "task description for command-mode metadata").option("--db-auth-secret-name <name>", "override momokaya.submit.dbAuth secret name").option("--db-auth-secret-key <key>", "override momokaya.submit.dbAuth secret key").option("--skip-db-auth", "omit MOKA_DB_URL injection regardless of global config").option("--mcp-gateway-auth-secret-name <name>", "override momokaya.submit.mcpGatewayAuth secret name").option("--mcp-gateway-auth-secret-key <key>", "override momokaya.submit.mcpGatewayAuth secret key").option("--skip-mcp-gateway-auth", "omit PIPELINE_MCP_GATEWAY_AUTHORIZATION injection regardless of global config").option("--npm-registry-auth-secret-name <name>", "override momokaya.submit.npmRegistryAuthSecretName").option("--skip-npm-registry-auth", "omit the /root/.npmrc mount regardless of global config"), { kubeconfig: true });
+const addMokaSubmitOptions = (command) => addRunnerArgoOptions(command.option("--quick", "submit the compact graph").option("--command", "treat input after -- as explicit argv").option("--schedule <path>", "approved schedule YAML to submit").option("--event-url <url>", "runner event sink URL").option("--open-pr", "append an open-pull-request delivery node").option("--preview", "add the canonical preview label to pull-request delivery").option("--no-preview", "remove the canonical preview label from existing pull-request delivery").option("--task <text>", "task description for command-mode metadata").option("--db-auth-secret-name <name>", "override momokaya.submit.dbAuth secret name").option("--db-auth-secret-key <key>", "override momokaya.submit.dbAuth secret key").option("--skip-db-auth", "omit MOKA_DB_URL injection regardless of global config").option("--mcp-gateway-auth-secret-name <name>", "override momokaya.submit.mcpGatewayAuth secret name").option("--mcp-gateway-auth-secret-key <key>", "override momokaya.submit.mcpGatewayAuth secret key").option("--skip-mcp-gateway-auth", "omit PIPELINE_MCP_GATEWAY_AUTHORIZATION injection regardless of global config").option("--npm-registry-auth-secret-name <name>", "override momokaya.submit.npmRegistryAuthSecretName").option("--skip-npm-registry-auth", "omit the /root/.npmrc mount regardless of global config"), { kubeconfig: true });
 const parseImagePullPolicy = (value) => {
 	if (value === "IfNotPresent" || value === "Never") return value;
 	return "Always";
@@ -67,7 +71,7 @@ const mokaCommonSubmitOptions = (input) => {
 			secretName: input.flags.dbAuthSecretName,
 			skip: input.flags.skipDbAuth
 		}, momokaya?.submit.dbAuth),
-		delivery: { pullRequest: input.flags.openPr === true },
+		delivery: deliveryFromFlags(input.flags),
 		eventAuthSecretKey: momokaya?.submit.eventAuthSecretKey,
 		eventAuthSecretName: momokaya?.submit.eventAuthSecretName,
 		eventUrl: input.eventUrl,
@@ -107,11 +111,13 @@ const buildMokaSubmitInputFromCli = (input) => {
 };
 const runMokaSubmitFromCli = async (input, flags) => {
 	const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
+	const config = loadPipelineConfig(cwd, { allowMissingLintFileReferences: true });
+	const globalConfig = loadMokaGlobalConfig() ?? void 0;
 	return await submitMoka(buildMokaSubmitInputFromCli({
-		config: loadPipelineConfig(cwd, { allowMissingLintFileReferences: true }),
+		config,
 		cwd,
 		flags,
-		globalConfig: loadMokaGlobalConfig() ?? void 0,
+		globalConfig,
 		input
 	}));
 };

package/dist/commands/coordinator-command.js

@@ -0,0 +1,35 @@
+import { createCoordinator } from "../coordinator/composition.js";
+//#region src/commands/coordinator-command.ts
+/**
+* `coordinator` — the deployed coordinator process entrypoint (ENG-57.1,
+* doc-1 decision 3). Starts the coordinator's RunSpec registry/HTTP server
+* and default Jobs transport from the validated `~/.config/moka/config.yaml`,
+* then blocks until SIGTERM/SIGINT (the chart Deployment's normal shutdown
+* signal) so the RunSpec server's listening socket is released cleanly
+* (AC#4) instead of the pod being killed out from under an open listener.
+*
+* Submission itself (`coordinator.submit`) is not triggered from this
+* command — ENG-57.2/57.4 own wiring a caller (dynamic wave scheduling, run
+* truth) onto the composed `Coordinator`. This command only owns the
+* process lifecycle the chart Deployment needs to keep that composition
+* alive and reachable.
+*/
+const registerCoordinatorCommand = (program) => {
+	program.command("coordinator").description("Start the coordinator's RunSpec service and Jobs-transport composition (ENG-57.1)").action(async () => {
+		const coordinator = await createCoordinator();
+		const shutdown = async () => {
+			await coordinator.close();
+			process.exitCode = 0;
+		};
+		await new Promise((resolve) => {
+			process.once("SIGTERM", () => {
+				shutdown().then(resolve);
+			});
+			process.once("SIGINT", () => {
+				shutdown().then(resolve);
+			});
+		});
+	});
+};
+//#endregion
+export { registerCoordinatorCommand };

package/dist/commands/pipeline-command.js

@@ -30,7 +30,8 @@ const configureEntrypointOptions = (command, entrypoint) => {
 	return command;
 };
 const createEntrypointCommand = (program, id, entrypoint) => {
-	return configureEntrypointOptions(program.command(id).description(entrypoint.description ?? `Run the ${id} workflow`).argument("<description...>", "task description"), entrypoint);
+	const command = program.command(id).description(entrypoint.description ?? `Run the ${id} workflow`).argument("<description...>", "task description");
+	return configureEntrypointOptions(command, entrypoint);
 };
 const registerEntrypointAction = (command, id, serviceLive) => {
 	command.action(async (descriptionParts, flags) => {
@@ -43,7 +44,8 @@ const registerConfiguredEntrypointCommands = (program, config, runEntrypoint) =>
 	const reservedCommands = new Set(program.commands.map((command) => command.name()));
 	for (const [id, entrypoint] of Object.entries(config.entrypoints)) {
 		if (reservedCommands.has(id)) continue;
-		registerEntrypointAction(createEntrypointCommand(program, id, entrypoint), id, serviceLive);
+		const command = createEntrypointCommand(program, id, entrypoint);
+		registerEntrypointAction(command, id, serviceLive);
 		registered.add(id);
 		reservedCommands.add(id);
 	}

package/dist/commands/runner-command-command.js

@@ -1,7 +1,7 @@
 import { runRunnerCommand } from "../runner-command/run.js";
+import { runPreSchedulePhase } from "../runner-command/pre-schedule.js";
 import { runRunnerFinalize } from "../runner-command/finalize.js";
 import { runRunnerLifecycle } from "../runner-command/lifecycle.js";
-import { runPreSchedulePhase } from "../runner-command/pre-schedule.js";
 import { runSelectReadyWave } from "../runner-command/select-ready-wave.js";
 import { Context, Effect, Layer } from "effect";
 //#region src/commands/runner-command-command.ts
@@ -32,19 +32,24 @@ const setProcessExitCode = (exitCode) => Effect.sync(() => {
 	process.exitCode = exitCode;
 });
 const runRunnerCommandEffect = (options) => Effect.gen(function* runRunnerCommandEffect() {
-	yield* setProcessExitCode(yield* (yield* RunnerCommandService).run(options));
+	const exitCode = yield* (yield* RunnerCommandService).run(options);
+	yield* setProcessExitCode(exitCode);
 });
 const runRunnerLifecycleEffect = (options) => Effect.gen(function* runRunnerLifecycleEffect() {
-	yield* setProcessExitCode(yield* (yield* RunnerCommandService).lifecycle(options));
+	const exitCode = yield* (yield* RunnerCommandService).lifecycle(options);
+	yield* setProcessExitCode(exitCode);
 });
 const runRunnerFinalizeEffect = (options) => Effect.gen(function* runRunnerFinalizeEffect() {
-	yield* setProcessExitCode(yield* (yield* RunnerCommandService).finalize(options));
+	const exitCode = yield* (yield* RunnerCommandService).finalize(options);
+	yield* setProcessExitCode(exitCode);
 });
 const runPreScheduleEffect = (options) => Effect.gen(function* runPreScheduleEffect() {
-	yield* setProcessExitCode(yield* (yield* RunnerCommandService).preSchedule(options));
+	const exitCode = yield* (yield* RunnerCommandService).preSchedule(options);
+	yield* setProcessExitCode(exitCode);
 });
 const runSelectReadyWaveEffect = (options) => Effect.gen(function* runSelectReadyWaveEffect() {
-	yield* setProcessExitCode(yield* (yield* RunnerCommandService).selectReadyWave(options));
+	const exitCode = yield* (yield* RunnerCommandService).selectReadyWave(options);
+	yield* setProcessExitCode(exitCode);
 });
 const runRunnerProgram = async (program) => await Effect.runPromise(Effect.provide(program, RunnerCommandServiceLive));
 const registerRunnerCommandCommand = (program) => {

package/dist/commands/runner-node-command.js

@@ -0,0 +1,31 @@
+import { runJobNodeFromEnv } from "../remote/jobs/node-bootstrap.js";
+//#region src/commands/runner-node-command.ts
+/** Parse a commander string option into a non-negative integer, failing loudly on a bad value. */
+const parseNonNegativeIntOption = (value, label) => {
+	if (value === void 0) return;
+	const parsed = Number(value);
+	if (!Number.isInteger(parsed) || parsed < 0) throw new Error(`--${label} must be a non-negative integer, got '${value}'`);
+	return parsed;
+};
+/**
+* `runner-node` — the Jobs transport container entrypoint (doc-1 decision 3,
+* ENG-18). Fetches this node's RunSpec from the coordinator API (base URL +
+* token supplied via the Job's env), runs it through the yeet executor, and
+* exits with the agent's exit code so the Job's backoffLimit only retries a
+* genuine crash (a non-zero process exit), never a semantic gate outcome.
+*/
+const registerRunnerNodeCommand = (program) => {
+	program.command("runner-node").description("Fetch a node's RunSpec from the coordinator API and run it via yeet (Jobs transport)").option("--run-id <id>", "Run id (defaults to the PIPELINE_RUN_ID env)").option("--node-id <id>", "Node id (defaults to the PIPELINE_NODE_ID env)").option("--generation <n>", "Execution generation (defaults to the PIPELINE_EXECUTION_GENERATION env, or 0)").option("--attempt <n>", "Crash-retry attempt (defaults to the PIPELINE_EXECUTION_ATTEMPT env, or 1)").action(async (options) => {
+		const generation = parseNonNegativeIntOption(options.generation, "generation");
+		const attempt = parseNonNegativeIntOption(options.attempt, "attempt");
+		const result = await runJobNodeFromEnv({
+			...options.nodeId === void 0 ? {} : { nodeId: options.nodeId },
+			...options.runId === void 0 ? {} : { runId: options.runId },
+			...generation === void 0 ? {} : { generation },
+			...attempt === void 0 ? {} : { attempt }
+		}, process.env);
+		process.exitCode = result.agentResult.exitCode;
+	});
+};
+//#endregion
+export { registerRunnerNodeCommand };

package/dist/commands/ticket/create.js

@@ -100,12 +100,14 @@ const runTicketScoperEffect = (launchPlan, executor) => Effect.gen(function* eff
 const formatAppliedTicketPlan = (applied) => ["Created tickets:", ...Object.entries(applied.taskIdsByKey).map(([key, taskId]) => `  ${key}: ${taskId}`)].join("\n");
 const printTicketCreateEffect = (worktreePath, request, flags, executor) => Effect.gen(function* effectBody() {
 	yield* validateTicketCreateFlagsEffect(flags);
-	const ticketPlan = yield* parseTicketPlanEffect(yield* runTicketScoperEffect(yield* ticketScoperLaunchPlanEffect(worktreePath, request), executor));
+	const launchPlan = yield* ticketScoperLaunchPlanEffect(worktreePath, request);
+	const ticketPlan = yield* parseTicketPlanEffect(yield* runTicketScoperEffect(launchPlan, executor));
 	if (flags.dryRun === true) {
 		yield* writeLineEffect(renderTicketPlanDryRun(ticketPlan));
 		return;
 	}
-	yield* writeLineEffect(formatAppliedTicketPlan(yield* applyTicketPlanEffect(ticketPlan, worktreePath, { parentId: flags.parent })));
+	const applied = yield* applyTicketPlanEffect(ticketPlan, worktreePath, { parentId: flags.parent });
+	yield* writeLineEffect(formatAppliedTicketPlan(applied));
 });
 const registerCreateSubcommand = (ticketCommand, options) => {
 	ticketCommand.command("create").description("Create a validated Backlog ticket plan").argument("<request...>", "ticket planning request").option("--dry-run", "render Backlog commands without writing tasks").option("--apply", "apply the validated ticket plan through Backlog").option("--parent <task-id>", "existing parent task for applied children").action(async (requestParts, flags) => {

package/dist/commands/ticket/sequence.js

@@ -5,7 +5,8 @@ import { Effect, Option } from "effect";
 const formatSequence = (batches) => batches.map((batch, index) => [`Sequence ${index + 1}:`, ...batch.map((id) => `  ${id}`)].join("\n")).join("\n\n");
 const printTicketSequenceEffect = (worktreePath, flags) => Effect.gen(function* effectBody() {
 	const loaded = yield* loadTicketGraphEffect(worktreePath, Option.fromUndefinedOr(flags.root));
-	yield* writeLineEffect(formatSequence(yield* sequenceTicketBatchesEffect(loaded.graph, loaded.scopedIds)));
+	const batches = yield* sequenceTicketBatchesEffect(loaded.graph, loaded.scopedIds);
+	yield* writeLineEffect(formatSequence(batches));
 });
 const registerSequenceSubcommand = (ticketCommand, _options) => {
 	ticketCommand.command("sequence").description("Print dependency execution batches for Backlog tickets").option("--root <ticket-id>", "sequence one ticket tree").option("--plain", "print plain text output").action(async (flags) => {

package/dist/commands/ticket/shared.d.ts

@@ -1,8 +1,11 @@
 import { RunCommand } from "../../cli/run-command.js";
 import { AgentResult, RunnerExecutionOptions, RunnerLaunchPlan } from "../../runner.js";
 import { BacklogService } from "../../runtime/services/backlog-service.js";
+import "../../runtime/services/repo-io-service.js";
+import "../../tickets/backlog-task-store.js";
+import "../../tickets/ticket-graph.js";
+import "../../tickets/ticket-selection.js";
 import { Effect, Layer, Option } from "effect";
-
 //#region src/commands/ticket/shared.d.ts
 type TicketPlanExecutor = (plan: RunnerLaunchPlan, options: RunnerExecutionOptions) => Promise<AgentResult>;
 interface TicketCommandOptions {

package/dist/config/defaults.d.ts

@@ -1,5 +1,4 @@
 import * as Schema from "effect/Schema";
-
 //#region src/config/defaults.d.ts
 declare const PIPELINE_CONFIG_PATH = ".pipeline/pipeline.yaml";
 declare const RUNNERS_CONFIG_PATH = ".pipeline/runners.yaml";

package/dist/config/load.d.ts

@@ -1,5 +1,4 @@
 import { PipelineConfig, PipelineConfigParts, PipelineConfigValidationOptions } from "./schemas.js";
-
 //#region src/config/load.d.ts
 declare const loadPackagePipelineConfig: (projectRoot: string, options?: PipelineConfigValidationOptions) => PipelineConfig;
 declare const loadPipelineConfig: (projectRoot: string, options?: PipelineConfigValidationOptions) => PipelineConfig;

package/dist/config/load.js

@@ -47,6 +47,7 @@ const assembledPipelineConfig = (pipeline, profiles, runners) => ({
 	rules: profiles.rules,
 	runner_command: pipeline.runner_command,
 	runners: runners.runners,
+	runtime: pipeline.runtime,
 	scheduler: pipeline.scheduler,
 	schedules: pipeline.schedules,
 	skills: profiles.skills,
@@ -58,7 +59,8 @@ const assembledPipelineConfig = (pipeline, profiles, runners) => ({
 const parsePipelineConfigPartsEffect = (sources, projectRoot = "", sourcePaths, options) => Effect.gen(function* effectBody() {
 	const runners = yield* parseConfigYamlAs(sources.runners, sourcePaths.runners, runnersFileSchema);
 	const profiles = yield* parseConfigYamlAs(sources.profiles, sourcePaths.profiles, profilesFileSchema);
-	return validatePipelineConfig(assembledPipelineConfig(yield* parsePipelineFileEffect(sources.pipeline, sourcePaths.pipeline), profiles, runners), projectRoot, options);
+	const pipeline = yield* parsePipelineFileEffect(sources.pipeline, sourcePaths.pipeline);
+	return validatePipelineConfig(assembledPipelineConfig(pipeline, profiles, runners), projectRoot, options);
 });
 const loadPackagePipelineConfig = (projectRoot, options = {}) => {
 	return runConfigIoSync(parsePipelineConfigPartsEffect({

package/dist/config/schema/catalog.d.ts

@@ -1,5 +1,6 @@
 //#region src/config/schema/catalog.d.ts
 declare const RUNNER_TYPES: readonly ["opencode", "command"];
+declare const RUNTIME_EXECUTORS: readonly ["sdk", "yeet"];
 declare const NODE_KINDS: readonly ["agent", "command", "builtin", "group", "parallel"];
 declare const HOOK_EVENTS: readonly ["workflow.start", "workflow.success", "workflow.failure", "workflow.complete", "node.start", "node.success", "node.error", "node.finish", "gate.failure"];
 declare const GATE_KINDS: readonly ["acceptance", "artifact", "builtin", "changed_files", "command", "json_schema", "verdict"];
@@ -8,4 +9,4 @@ declare const SCHEDULING_ROLES: readonly ["coverage", "implementation"];
 declare const MCP_GATEWAY_BACKEND_LOCALITIES: readonly ["repo-local", "repo-scoped-remote", "shared-remote"];
 declare const MCP_GATEWAY_WORKSPACE_PATH_SOURCES: readonly ["PIPELINE_TARGET_PATH", "cwd"];
 //#endregion
-export { GATE_KINDS, HOOK_EVENTS, MCP_GATEWAY_BACKEND_LOCALITIES, MCP_GATEWAY_WORKSPACE_PATH_SOURCES, NODE_KINDS, RUNNER_TYPES, SCHEDULE_BASELINES, SCHEDULING_ROLES };
+export { GATE_KINDS, HOOK_EVENTS, MCP_GATEWAY_BACKEND_LOCALITIES, MCP_GATEWAY_WORKSPACE_PATH_SOURCES, NODE_KINDS, RUNNER_TYPES, RUNTIME_EXECUTORS, SCHEDULE_BASELINES, SCHEDULING_ROLES };