@oisincoveney/pipeline 3.24.3 → 4.0.1

package/dist/config/schema/catalog.js

@@ -8,6 +8,7 @@ const REASONING_EFFORTS = [
 	"xhigh"
 ];
 const RUNNER_TYPES = ["opencode", "command"];
+const RUNTIME_EXECUTORS = ["sdk", "yeet"];
 const HOOK_EVENTS = [
 	"workflow.start",
 	"workflow.success",
@@ -65,4 +66,4 @@ const DEFAULT_RUNNER_COMMAND_GIT_COMMITTER = {
 	name: "oisin-bot"
 };
 //#endregion
-export { BUILTIN_GATES, DEFAULT_RUNNER_COMMAND_GIT_COMMITTER, FILESYSTEM_MODES, HOOK_EVENTS, ID_RE, MCP_GATEWAY_BACKEND_LOCALITIES, MCP_GATEWAY_WORKSPACE_PATH_SOURCES, NETWORK_MODES, OUTPUT_FORMATS, PIPELINE_GATEWAY_SERVER_ID, REASONING_EFFORTS, RETRY_REASONS, RUNNER_TYPES, SCHEDULE_BASELINES, SCHEDULE_STRATEGIES, SCHEDULING_ROLES, TOOL_NAMES };
+export { BUILTIN_GATES, DEFAULT_RUNNER_COMMAND_GIT_COMMITTER, FILESYSTEM_MODES, HOOK_EVENTS, ID_RE, MCP_GATEWAY_BACKEND_LOCALITIES, MCP_GATEWAY_WORKSPACE_PATH_SOURCES, NETWORK_MODES, OUTPUT_FORMATS, PIPELINE_GATEWAY_SERVER_ID, REASONING_EFFORTS, RETRY_REASONS, RUNNER_TYPES, RUNTIME_EXECUTORS, SCHEDULE_BASELINES, SCHEDULE_STRATEGIES, SCHEDULING_ROLES, TOOL_NAMES };

package/dist/config/schemas.d.ts

@@ -1,6 +1,6 @@
-import { GATE_KINDS, HOOK_EVENTS, MCP_GATEWAY_BACKEND_LOCALITIES, MCP_GATEWAY_WORKSPACE_PATH_SOURCES, NODE_KINDS, RUNNER_TYPES, SCHEDULE_BASELINES, SCHEDULING_ROLES } from "./schema/catalog.js";
+import "../schema-boundary.js";
+import { GATE_KINDS, HOOK_EVENTS, MCP_GATEWAY_BACKEND_LOCALITIES, MCP_GATEWAY_WORKSPACE_PATH_SOURCES, NODE_KINDS, RUNNER_TYPES, RUNTIME_EXECUTORS, SCHEDULE_BASELINES, SCHEDULING_ROLES } from "./schema/catalog.js";
 import * as Schema from "effect/Schema";
-
 //#region src/config/schemas.d.ts
 type PipelineConfigErrorCode = "PIPELINE_CONFIG_LEGACY_UNSUPPORTED" | "PIPELINE_CONFIG_PARSE_ERROR" | "PIPELINE_CONFIG_VALIDATION_ERROR";
 interface PipelineConfigIssue {
@@ -214,6 +214,9 @@ declare const configSchema: Schema.Struct<{
     readonly enabled: Schema.withDecodingDefault<Schema.Boolean, never>;
     readonly token_budget: Schema.withDecodingDefault<Schema.Number, never>;
   }>>;
+  readonly runtime: Schema.withDecodingDefault<Schema.Struct<{
+    readonly executor: Schema.withDecodingDefault<Schema.Literals<readonly ["sdk", "yeet"]>, never>;
+  }>, never>;
   readonly runner_command: Schema.withDecodingDefault<Schema.Struct<{
     readonly environment: Schema.withDecodingDefault<Schema.Struct<{
       readonly setup: Schema.withDecodingDefault<Schema.mutable<Schema.$Array<Schema.Struct<{
@@ -417,6 +420,7 @@ declare const configSchema: Schema.Struct<{
 }>;
 type PipelineConfig = typeof configSchema.Type;
 type RunnerType = (typeof RUNNER_TYPES)[number];
+type RuntimeExecutorKind = (typeof RUNTIME_EXECUTORS)[number];
 type WorkflowNodeKind = (typeof NODE_KINDS)[number];
 type HookEvent = (typeof HOOK_EVENTS)[number];
 type GateKind = (typeof GATE_KINDS)[number];
@@ -433,4 +437,4 @@ interface PipelineConfigValidationOptions {
   allowMissingLintFileReferences?: boolean;
 }
 //#endregion
-export { GateKind, HookEvent, McpGatewayBackendLocality, McpGatewayWorkspacePathSource, PipelineConfig, PipelineConfigError, PipelineConfigErrorCode, PipelineConfigIssue, PipelineConfigParts, PipelineConfigValidationOptions, RunnerType, ScheduleBaseline, SchedulingRole, WorkflowNodeKind, configSchema, workflowSchema };
+export { GateKind, HookEvent, McpGatewayBackendLocality, McpGatewayWorkspacePathSource, PipelineConfig, PipelineConfigError, PipelineConfigErrorCode, PipelineConfigIssue, PipelineConfigParts, PipelineConfigValidationOptions, RunnerType, RuntimeExecutorKind, ScheduleBaseline, SchedulingRole, WorkflowNodeKind, configSchema, workflowSchema };

package/dist/config/schemas.js

@@ -1,5 +1,5 @@
 import { mutableArray, nonEmptyMutableArray, nonNegativeInteger, positiveInteger, positiveNumber, requiredString, stringRecord, struct, unknownRecord, withDefault } from "../schema-boundary.js";
-import { BUILTIN_GATES, DEFAULT_RUNNER_COMMAND_GIT_COMMITTER, FILESYSTEM_MODES, NETWORK_MODES, OUTPUT_FORMATS, REASONING_EFFORTS, RETRY_REASONS, RUNNER_TYPES, SCHEDULE_BASELINES, SCHEDULE_STRATEGIES, SCHEDULING_ROLES, TOOL_NAMES } from "./schema/catalog.js";
+import { BUILTIN_GATES, DEFAULT_RUNNER_COMMAND_GIT_COMMITTER, FILESYSTEM_MODES, NETWORK_MODES, OUTPUT_FORMATS, REASONING_EFFORTS, RETRY_REASONS, RUNNER_TYPES, RUNTIME_EXECUTORS, SCHEDULE_BASELINES, SCHEDULE_STRATEGIES, SCHEDULING_ROLES, TOOL_NAMES } from "./schema/catalog.js";
 import { mcpGatewaySchema, mcpServerSchema } from "./schema/mcp.js";
 import * as Schema from "effect/Schema";
 //#region src/config/schemas.ts
@@ -363,6 +363,7 @@ const tokenBudgetSchema = struct({
 	max_context_pct: withDefault(positiveNumber.check(Schema.isLessThanOrEqualTo(100)), 50),
 	model_context_windows: withDefault(strictRecord(positiveInteger), {})
 });
+const runtimeConfigSchema = struct({ executor: withDefault(Schema.Literals(RUNTIME_EXECUTORS), "sdk") });
 const contextHandoffSchema = struct({
 	enabled: withDefault(Schema.Boolean, false),
 	model: Schema.optional(Schema.String)
@@ -390,6 +391,7 @@ const pipelineConfigCoreShape = {
 	orchestrator: Schema.optional(orchestratorSchema),
 	parallel_worktrees: Schema.optional(parallelWorktreesSchema),
 	repo_map: Schema.optional(repoMapSchema),
+	runtime: withDefault(runtimeConfigSchema, { executor: "sdk" }),
 	runner_command: withDefault(runnerCommandConfigSchema, {
 		environment: {
 			setup: [],

package/dist/config/validate.d.ts

@@ -1,5 +1,4 @@
 import { PipelineConfig, PipelineConfigValidationOptions } from "./schemas.js";
-
 //#region src/config/validate.d.ts
 declare const validatePipelineConfig: (rawConfig: PipelineConfig, projectRoot?: string, options?: PipelineConfigValidationOptions) => PipelineConfig;
 //#endregion

package/dist/config.d.ts

@@ -1,5 +1,5 @@
 import { DEFAULT_OPENCODE_ECOSYSTEM_MANIFEST, OPENCODE_ECOSYSTEM_MANIFEST_PATH, OpenCodeEcosystemManifest, PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, RUNNERS_CONFIG_PATH, parseOpenCodeEcosystemManifest } from "./config/defaults.js";
-import { GateKind, HookEvent, McpGatewayBackendLocality, McpGatewayWorkspacePathSource, PipelineConfig, PipelineConfigError, PipelineConfigErrorCode, PipelineConfigIssue, PipelineConfigParts, PipelineConfigValidationOptions, RunnerType, ScheduleBaseline, SchedulingRole, WorkflowNodeKind, workflowSchema } from "./config/schemas.js";
+import { GateKind, HookEvent, McpGatewayBackendLocality, McpGatewayWorkspacePathSource, PipelineConfig, PipelineConfigError, PipelineConfigErrorCode, PipelineConfigIssue, PipelineConfigParts, PipelineConfigValidationOptions, RunnerType, RuntimeExecutorKind, ScheduleBaseline, SchedulingRole, WorkflowNodeKind, workflowSchema } from "./config/schemas.js";
 import { loadPackagePipelineConfig, loadPipelineConfig, parsePipelineConfigParts, parsePipelineConfigYaml } from "./config/load.js";
 import { validatePipelineConfig } from "./config/validate.js";
-export { DEFAULT_OPENCODE_ECOSYSTEM_MANIFEST, type GateKind, type HookEvent, type McpGatewayBackendLocality, type McpGatewayWorkspacePathSource, OPENCODE_ECOSYSTEM_MANIFEST_PATH, type OpenCodeEcosystemManifest, PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, type PipelineConfig, PipelineConfigError, type PipelineConfigErrorCode, type PipelineConfigIssue, type PipelineConfigParts, type PipelineConfigValidationOptions, RUNNERS_CONFIG_PATH, type RunnerType, type ScheduleBaseline, type SchedulingRole, type WorkflowNodeKind, loadPackagePipelineConfig, loadPipelineConfig, parseOpenCodeEcosystemManifest, parsePipelineConfigParts, parsePipelineConfigYaml, validatePipelineConfig, workflowSchema };
+export { DEFAULT_OPENCODE_ECOSYSTEM_MANIFEST, type GateKind, type HookEvent, type McpGatewayBackendLocality, type McpGatewayWorkspacePathSource, OPENCODE_ECOSYSTEM_MANIFEST_PATH, type OpenCodeEcosystemManifest, PIPELINE_CONFIG_PATH, PROFILES_CONFIG_PATH, type PipelineConfig, PipelineConfigError, type PipelineConfigErrorCode, type PipelineConfigIssue, type PipelineConfigParts, type PipelineConfigValidationOptions, RUNNERS_CONFIG_PATH, type RunnerType, type RuntimeExecutorKind, type ScheduleBaseline, type SchedulingRole, type WorkflowNodeKind, loadPackagePipelineConfig, loadPipelineConfig, parseOpenCodeEcosystemManifest, parsePipelineConfigParts, parsePipelineConfigYaml, validatePipelineConfig, workflowSchema };

package/dist/context/repo-map.js

@@ -100,7 +100,9 @@ const parseFileTags = (root, file, parser, content) => {
 };
 const tagFileEffect = (root, file) => Effect.gen(function* effectBody() {
 	const service = yield* RepoIoService;
-	return yield* parseFileTags(root, file, yield* service.createParser(), yield* service.readText(file));
+	const parser = yield* service.createParser();
+	const content = yield* service.readText(file);
+	return yield* parseFileTags(root, file, parser, content);
 });
 const definitionKey = (def) => `def:${def.path}#${def.name}#${def.startLine}`;
 const isSeeded = (def, seedNames, artifacts) => {
@@ -187,7 +189,8 @@ const selectWithinBudget = (ranked, budget, estimateTokens) => {
 const buildRepoMapContextEffect = (input) => Effect.gen(function* effectBody() {
 	const estimateTokens$1 = input.estimateTokens ?? estimateTokens;
 	const files = yield* discoverFilesEffect(input.worktreePath);
-	const ranked = rankDefinitions(buildGraph(yield* Effect.all(files.map((file) => tagFileEffect(input.worktreePath, file)), { concurrency: "unbounded" }), input));
+	const fileTags = yield* Effect.all(files.map((file) => tagFileEffect(input.worktreePath, file)), { concurrency: "unbounded" });
+	const ranked = rankDefinitions(buildGraph(fileTags, input));
 	const { context, estimatedTokens, selected } = selectWithinBudget(ranked, input.tokenBudget, estimateTokens$1);
 	return {
 		budget: input.tokenBudget,

package/dist/coordinator/composition.js

@@ -0,0 +1,169 @@
+import { reconcileAllRuns } from "../remote/jobs/reconcile.js";
+import { createRunSpecRegistry, startRunSpecServer } from "../remote/jobs/run-spec-server.js";
+import { runJobFleetWatchLoop } from "../remote/jobs/watch.js";
+import { submitParsedMoka } from "../remote/submit/service.js";
+import { withRunControlStore } from "../run-control/command-context.js";
+import { kubernetesJobFleetReadApi } from "../runtime/services/kubernetes-jobs-read-service.js";
+import { kubernetesJobFleetWatchApi } from "../runtime/services/kubernetes-jobs-watch-service.js";
+import { loadCoordinatorJobsConfig } from "./config.js";
+import { createRunScopedOwnerReference } from "./run-owner.js";
+import { submitWaveJobs } from "./wave-advance.js";
+import * as DateTime from "effect/DateTime";
+import * as Effect from "effect/Effect";
+import * as ManagedRuntime from "effect/ManagedRuntime";
+import * as Layer from "effect/Layer";
+import * as Cause from "effect/Cause";
+import { randomBytes } from "node:crypto";
+import * as Fiber from "effect/Fiber";
+//#region src/coordinator/composition.ts
+/**
+* ENG-57.1/57.2/57.3: the coordinator's composition root (doc-1 decision 3,
+* ENG-56/57). Wires the coordinator's own {@link RunSpecRegistry} + HTTP server,
+* its Jobs transport (`submitWaveJobs`, ENG-57.2's terminal-gated wave scheduler
+* — the one scheduler both static and dynamic schedules share) from a validated
+* {@link loadCoordinatorJobsConfig} config, and (ENG-57.3) the always-finalize
+* Job/pod watch loop (`runJobFleetWatchLoop`, ENG-19) over the durable
+* {@link RunControlStore} the ENG-19 reconciler already understands. `submit`
+* populates `jobsTransport` on every call, so a compiled (static) run submits
+* through Jobs waves. A dynamic run's planner stays on the Argo path (ENG-57.2
+* Option B, see `../remote/submit/service`) until ENG-57.8 moves it onto Jobs.
+*
+* ENG-57.3: the watch loop is started as its own fiber (`Effect.runFork`) so it
+* runs the coordinator's whole lifetime alongside the RunSpec HTTP server,
+* rather than blocking `createCoordinator`. `runJobFleetWatchLoop` itself
+* reconciles once on startup (before any watch event can arrive), on every
+* Job/pod change, and after every reconnect — so coordinator restart, watch
+* loss, and normal operation all drive the same reconcile path (AC#1/AC#3). The
+* fiber is interrupted from `close()`, which — because the loop's store
+* resolution runs inside `Effect.scoped` (`withRunControlStore` /
+* `withRunControlStoreScoped`) — also releases the store's connection in the
+* same step. A permanent loop failure (reconnects exhausted) is never silent:
+* it is logged and, by default, treated as fatal for the process so an
+* orchestrator (k8s liveness) restarts the coordinator, which reconciles again
+* on the next startup.
+*/
+/** Coordinator process env vars — all optional, all default to existing
+* loopback/ephemeral-port behaviour so local dev and tests are unaffected;
+* the chart Deployment sets these explicitly for cluster reachability. */
+const RUN_SPEC_HOST_ENV = "COORDINATOR_RUN_SPEC_HOST";
+const RUN_SPEC_PORT_ENV = "COORDINATOR_RUN_SPEC_PORT";
+const RUN_SPEC_BASE_URL_ENV = "COORDINATOR_RUN_SPEC_BASE_URL";
+const RUN_SPEC_TOKEN_ENV = "COORDINATOR_RUN_SPEC_TOKEN";
+var CoordinatorRunSpecPortEnvError = class extends Error {
+	constructor(value) {
+		super(`${RUN_SPEC_PORT_ENV}=${JSON.stringify(value)} is not a positive integer port (1-65535)`);
+		this.name = "CoordinatorRunSpecPortEnvError";
+	}
+};
+const parseRunSpecPortEnv = (env) => {
+	const raw = env[RUN_SPEC_PORT_ENV];
+	if (raw === void 0 || raw.length === 0) return;
+	const port = Number(raw);
+	if (!Number.isInteger(port) || port <= 0 || port > 65535) throw new CoordinatorRunSpecPortEnvError(raw);
+	return port;
+};
+const generateFallbackRunId = () => `run-${randomBytes(8).toString("hex")}`;
+/** ENG-57.3: boundary-bridge runtime for the coordinator's watch-loop fiber —
+* mirrors `wave-advance.ts`'s `waveRuntime`/`run-owner.ts`'s `leaseRuntime`.
+* `Effect.runFork`/`Effect.runPromise` are reserved for this one composition-root
+* seam; domain code never calls them directly. */
+const watchLoopRuntime = ManagedRuntime.make(Layer.empty);
+/** ENG-57.3 default `onWatchLoopFailure`: a permanently-failed watch loop is
+* never left running silently — log it and exit so an orchestrator restarts
+* the coordinator (which reconciles again on the next startup). */
+const defaultOnWatchLoopFailure = (error) => {
+	console.error(`coordinator: job fleet watch loop failed permanently: ${String(error)}`);
+	process.exit(1);
+};
+/** ENG-57.3: builds the always-finalize watch-loop effect for one resolved
+* {@link RunControlStore} — the same reconcile path (`reconcileAllRuns`, ENG-19)
+* drives the startup pass, every event-triggered pass, and every
+* post-reconnect pass, so dynamic and static Jobs runs finalize through one
+* run-id-keyed path (AC#4). */
+const buildWatchLoopEffect = (dependencies, config, store) => runJobFleetWatchLoop({
+	...dependencies.watchLoop,
+	namespace: config.namespace,
+	reconcile: reconcileAllRuns({
+		fleet: dependencies.jobFleetReadApi ?? kubernetesJobFleetReadApi({}),
+		namespace: config.namespace,
+		now: () => DateTime.formatIso(DateTime.nowUnsafe()),
+		store
+	}).pipe(Effect.tap((reports) => Effect.sync(() => dependencies.onReconcile?.(reports))), Effect.asVoid),
+	watch: dependencies.jobFleetWatchApi ?? kubernetesJobFleetWatchApi({})
+});
+/** ENG-57.3: starts the watch loop as its own fiber over the coordinator's
+* lifetime. Resolves the store via the injected test override, or the
+* production `withRunControlStore` seam (Postgres-backed, scoped so
+* interrupting the returned fiber also releases the store's connection). A
+* permanent failure is reported via `onWatchLoopFailure`, never left silent. */
+const startWatchLoop = (dependencies, config) => {
+	const onWatchLoopFailure = dependencies.onWatchLoopFailure ?? defaultOnWatchLoopFailure;
+	const watchLoopEffect = dependencies.runControlStore === void 0 ? withRunControlStore((store) => buildWatchLoopEffect(dependencies, config, store)) : buildWatchLoopEffect(dependencies, config, dependencies.runControlStore);
+	return watchLoopRuntime.runFork(watchLoopEffect.pipe(Effect.tapCause((cause) => Effect.sync(() => onWatchLoopFailure(Cause.squash(cause))))));
+};
+const resolveRunSpecBind = (dependencies, env) => {
+	const host = dependencies.runSpecBind?.host ?? env[RUN_SPEC_HOST_ENV];
+	const port = dependencies.runSpecBind?.port ?? parseRunSpecPortEnv(env);
+	return {
+		...host === void 0 ? {} : { host },
+		...port === void 0 ? {} : { port }
+	};
+};
+const resolveExpectedToken = (dependencies, env) => {
+	const token = dependencies.expectedToken ?? env[RUN_SPEC_TOKEN_ENV];
+	return token === void 0 || token.length === 0 ? void 0 : token;
+};
+/** AC#1: fills in the coordinator's own defaults ONLY where the caller's
+* options left them unset — mirrors how `sharedJobOptions`
+* (`../remote/submit/jobs-submission`) reads `imagePullSecretName` /
+* `serviceAccountName` straight off `options`. */
+const resolveSubmitOptions = (options, config) => ({
+	...options,
+	...options.imagePullSecretName === void 0 && config.imagePullSecretName !== void 0 ? { imagePullSecretName: config.imagePullSecretName } : {},
+	...options.serviceAccountName === void 0 && config.serviceAccountName !== void 0 ? { serviceAccountName: config.serviceAccountName } : {}
+});
+const createCoordinator = async (dependencies = {}) => {
+	const env = dependencies.env ?? process.env;
+	const config = loadCoordinatorJobsConfig(dependencies.homeDir);
+	const registry = createRunSpecRegistry();
+	const expectedToken = resolveExpectedToken(dependencies, env);
+	const runSpecServer = await startRunSpecServer({
+		...expectedToken === void 0 ? {} : { expectedToken },
+		registry
+	}, resolveRunSpecBind(dependencies, env));
+	const runSpecBaseUrl = dependencies.runSpecBaseUrl ?? env[RUN_SPEC_BASE_URL_ENV] ?? runSpecServer.baseUrl;
+	const watchLoopFiber = startWatchLoop(dependencies, config);
+	const submit = async (options, callerDependencies = {}) => {
+		const runId = options.run?.id ?? (dependencies.generateRunId ?? generateFallbackRunId)();
+		const ownerReference = await createRunScopedOwnerReference({
+			...dependencies.leaseDependencies === void 0 ? {} : { dependencies: dependencies.leaseDependencies },
+			namespace: config.namespace,
+			runId
+		});
+		const jobsTransport = {
+			envFromSecretNames: config.envFromSecretNames,
+			ownerReference,
+			registry,
+			runSpecBaseUrl,
+			submitJobs: submitWaveJobs,
+			...dependencies.jobsDependencies === void 0 ? {} : { jobsDependencies: dependencies.jobsDependencies }
+		};
+		return await submitParsedMoka(resolveSubmitOptions(options, config), {
+			...callerDependencies,
+			generateRunId: () => runId,
+			jobsTransport
+		});
+	};
+	return {
+		close: async () => {
+			await watchLoopRuntime.runPromise(Fiber.interrupt(watchLoopFiber));
+			await runSpecServer.close();
+		},
+		config,
+		registry,
+		runSpecServer,
+		submit
+	};
+};
+//#endregion
+export { CoordinatorRunSpecPortEnvError, createCoordinator };

package/dist/coordinator/config.js

@@ -0,0 +1,71 @@
+import { parseResultWithSchema, requiredString, struct } from "../schema-boundary.js";
+import { PipelineConfigError, configIssuesFromSchemaIssues } from "../config/schemas.js";
+import { ConfigIoService, runConfigIoSync } from "../runtime/services/config-io-service.js";
+import "../config.js";
+import { mokaGlobalConfigPath } from "../moka-global-config.js";
+import * as Effect from "effect/Effect";
+import * as Option$1 from "effect/Option";
+import * as Schema from "effect/Schema";
+//#region src/coordinator/config.ts
+/**
+* ENG-57.1: the coordinator's own narrow slice of the moka global config
+* (`~/.config/moka/config.yaml` inside the coordinator pod, same fixed path
+* {@link mokaGlobalConfigPath} resolves for the laptop `moka submit` CLI).
+* Deliberately narrower than `mokaGlobalConfigSchema` (`../moka-global-config`):
+* the coordinator only ever drives the Jobs transport (doc-1 decision 3), so
+* broker/event-bridge fields (`brokerAuth`, `eventUrl`, `eventAuthSecretName`,
+* ...) that only the Argo path needs are not required here.
+*/
+const coordinatorSubmitConfigSchema = struct({
+	gitCredentialsSecretName: requiredString,
+	githubAuthSecretName: requiredString,
+	imagePullSecretName: Schema.optional(requiredString),
+	npmRegistryAuthSecretName: Schema.optional(requiredString),
+	serviceAccountName: Schema.optional(requiredString)
+});
+const coordinatorConfigSchema = struct({ momokaya: struct({
+	kubernetes: struct({ namespace: requiredString }),
+	submit: coordinatorSubmitConfigSchema
+}) });
+const configValidationError = (sourcePath, issues) => new PipelineConfigError("PIPELINE_CONFIG_VALIDATION_ERROR", [`Invalid ${sourcePath}:`, ...issues.map((issue) => issue.path !== void 0 && issue.path !== "" ? `- ${issue.path}: ${issue.message}` : `- ${issue.message}`)].join("\n"), issues);
+const configMissingError = (sourcePath) => new PipelineConfigError("PIPELINE_CONFIG_VALIDATION_ERROR", `Coordinator config not found at ${sourcePath}. Configure momokaya.kubernetes.namespace and momokaya.submit.gitCredentialsSecretName/githubAuthSecretName (Jobs transport prerequisites, doc-1 decision 3) in ${sourcePath}.`, []);
+const noEnvFromSecretsError = (sourcePath) => new PipelineConfigError("PIPELINE_CONFIG_VALIDATION_ERROR", `${sourcePath}: momokaya.submit must configure at least one of gitCredentialsSecretName, githubAuthSecretName, npmRegistryAuthSecretName for the Jobs transport (buildRunnerNodeJobOptionsSchema requires a non-empty envFromSecretNames).`, []);
+const toJobsConfig = (config, sourcePath) => {
+	const submit = config.momokaya.submit;
+	const envFromSecretNames = [
+		submit.gitCredentialsSecretName,
+		submit.githubAuthSecretName,
+		submit.npmRegistryAuthSecretName
+	].filter((name) => name !== void 0);
+	if (envFromSecretNames.length === 0) return Effect.fail(noEnvFromSecretsError(sourcePath));
+	return Effect.succeed({
+		envFromSecretNames,
+		namespace: config.momokaya.kubernetes.namespace,
+		...submit.imagePullSecretName === void 0 ? {} : { imagePullSecretName: submit.imagePullSecretName },
+		...submit.serviceAccountName === void 0 ? {} : { serviceAccountName: submit.serviceAccountName }
+	});
+};
+const parseCoordinatorConfigEffect = Effect.fn("parseCoordinatorConfig")(function* (source, sourcePath) {
+	const yaml = yield* (yield* ConfigIoService).parseYaml(source, sourcePath);
+	const parsed = parseResultWithSchema(coordinatorConfigSchema, yaml, { onExcessProperty: "preserve" });
+	if (!parsed.ok) return yield* Effect.fail(configValidationError(sourcePath, configIssuesFromSchemaIssues(parsed.issues)));
+	return parsed.value;
+});
+/**
+* Loads + validates the coordinator's config file from disk (the fixed
+* `~/.config/moka/config.yaml` path). AC#1 ("VALIDATED config") / AC#3
+* ("missing Jobs prerequisites -> TYPED config error before run creation"):
+* both a missing file and an empty `envFromSecretNames` list throw a
+* {@link PipelineConfigError} before any RunSpec server or Job gets created.
+*/
+const loadCoordinatorJobsConfig = (homeDir) => {
+	const sourcePath = mokaGlobalConfigPath(homeDir);
+	return runConfigIoSync(Effect.fn("loadCoordinatorJobsConfig")(function* () {
+		const source = yield* (yield* ConfigIoService).readOptionalText(sourcePath);
+		if (Option$1.isNone(source)) return yield* Effect.fail(configMissingError(sourcePath));
+		const config = yield* parseCoordinatorConfigEffect(source.value, sourcePath);
+		return yield* toJobsConfig(config, sourcePath);
+	})());
+};
+//#endregion
+export { coordinatorConfigSchema, loadCoordinatorJobsConfig };

package/dist/coordinator/run-owner.js

@@ -0,0 +1,64 @@
+import { parseStrictWithSchema, parseWithSchema, requiredString, struct } from "../schema-boundary.js";
+import { jobOwnerReferenceSchema } from "../remote/jobs/model.js";
+import { KubernetesLeaseService, KubernetesLeaseServiceLive } from "../runtime/services/kubernetes-lease-service.js";
+import * as Effect from "effect/Effect";
+import * as ManagedRuntime from "effect/ManagedRuntime";
+import * as Schema from "effect/Schema";
+//#region src/coordinator/run-owner.ts
+/**
+* ENG-57.1: the coordinator's run-scoped ownerReference (doc-1 decision 3).
+* One `coordination.k8s.io/v1` Lease per run; every Job the run submits
+* carries this Lease as its ownerReference, so deleting/expiring the Lease
+* garbage-collects the run's Jobs without a per-run ConfigMap.
+*/
+var RunOwnerLeaseError = class extends Error {
+	constructor(runId, cause) {
+		super(`Failed to create the run-scoped ownerReference Lease for run "${runId}": ${String(cause)}`);
+		this.name = "RunOwnerLeaseError";
+		this.cause = cause;
+	}
+};
+const leaseRuntime = ManagedRuntime.make(KubernetesLeaseServiceLive);
+const runLeaseEffect = async (effect) => await leaseRuntime.runPromise(effect);
+const createdLeaseSchema = struct({ metadata: struct({
+	name: Schema.optional(requiredString),
+	namespace: Schema.optional(requiredString),
+	uid: Schema.optional(requiredString)
+}) });
+const leaseBody = (runId) => ({
+	apiVersion: "coordination.k8s.io/v1",
+	kind: "Lease",
+	metadata: { name: `run-${runId}` }
+});
+/**
+* Creates the run's ownerReference Lease and returns the validated
+* {@link JobOwnerReference} every submitted Job points at. Wraps both
+* client rejection (e.g. the API server refuses the Lease) and schema
+* validation failure (e.g. the response carries an empty/missing `uid`)
+* in one typed {@link RunOwnerLeaseError} — never a bare throw, never a
+* swallowed failure.
+*/
+const createRunScopedOwnerReference = async (input) => {
+	const body = leaseBody(input.runId);
+	try {
+		const response = await runLeaseEffect(Effect.suspend(() => Effect.gen(function* effectBody() {
+			return yield* (yield* KubernetesLeaseService).createLease({
+				body,
+				dependencies: input.dependencies ?? {},
+				namespace: input.namespace,
+				options: input.options ?? {}
+			});
+		})));
+		const created = parseWithSchema(createdLeaseSchema, response, { onExcessProperty: "preserve" });
+		return parseStrictWithSchema(jobOwnerReferenceSchema, {
+			apiVersion: "coordination.k8s.io/v1",
+			kind: "Lease",
+			name: created.metadata.name ?? body.metadata?.name ?? `run-${input.runId}`,
+			uid: created.metadata.uid
+		});
+	} catch (error) {
+		throw new RunOwnerLeaseError(input.runId, error);
+	}
+};
+//#endregion
+export { RunOwnerLeaseError, createRunScopedOwnerReference };

package/dist/coordinator/wave-advance.js

@@ -0,0 +1,148 @@
+import "../schema-boundary.js";
+import { compileScheduleArtifact, parseScheduleArtifact } from "../planning/generate.js";
+import "../remote/jobs/job-outcome.js";
+import { submitRunnerNodeJobs } from "../remote/jobs/submit.js";
+import { parseJobsSubmitResult } from "../remote/submit/jobs-submit-result.js";
+import { defaultBuildNodeRunSpec, requireCompiledSchedule, requireSubmitNamespace, sharedJobOptions } from "../remote/submit/jobs-submission.js";
+import { inMemoryExecutionStore } from "../run-control/execution-store.js";
+import { planNextWave } from "./wave-scheduler.js";
+import * as DateTime from "effect/DateTime";
+import * as Effect from "effect/Effect";
+import * as ManagedRuntime from "effect/ManagedRuntime";
+import * as Option$1 from "effect/Option";
+import * as R from "effect/Record";
+import * as Schema from "effect/Schema";
+import * as Arr from "effect/Array";
+import * as HashMap from "effect/HashMap";
+import * as Layer from "effect/Layer";
+import * as Str from "effect/String";
+//#region src/coordinator/wave-advance.ts
+/**
+* ENG-57.2: the wave-advance orchestrator — the single scheduler both static and
+* dynamic (post-planner) schedules run through. It is a re-entrant TICK: given
+* the run's full node list and the durable {@link ExecutionStore}, it decides the
+* next wave with the pure {@link planNextWave} state machine, terminalizes
+* dependents of failed predecessors, and submits ONLY the currently ready nodes
+* through ENG-57.1's create-or-observe single-node primitive (generation-fenced
+* by ENG-57.6). Re-running the tick with unchanged inputs is a no-op: the
+* ExecutionStore CAS and the Job create-or-observe make it idempotent across
+* duplicate callbacks, repeated reconciliation, and coordinator restart.
+*
+* The FIRST tick runs at submit time ({@link submitWaveJobs}) over an empty store
+* → the root wave. Later ticks are driven by the reconcile loop through
+* {@link runWaveTick}, which first folds cluster truth into the ExecutionStore.
+*/
+/**
+* All first-time node submissions in this ticket share execution generation 0:
+* ENG-57.2 CONSUMES execution generations (ENG-57.6) but does not manage
+* semantic retries, so every node's first (and only) execution here is g0.
+*/
+const FIRST_EXECUTION_GENERATION = 0;
+/** {@link submitWaveJobs} is the `SubmitMokaJobsTransport.submitJobs` seam itself
+* (a Promise-returning transport), so it is the boundary that bridges the Effect
+* world back to Promise — same pattern as run-owner's `leaseRuntime` and
+* remote/jobs/submit's `jobsRuntime`. `advanceWave` needs no services. */
+const waveRuntime = ManagedRuntime.make(Layer.empty);
+const runWaveEffect = async (effect) => await waveRuntime.runPromise(effect);
+/** Build the terminal-status map {@link planNextWave} gates on by reading the
+* authoritative record per node from the ExecutionStore (no bulk read exists). */
+const buildTerminalMap = (store, nodes, runId) => Effect.forEach(nodes, (node) => store.getExecution({
+	nodeId: node.id,
+	runId
+}).pipe(Effect.map((record) => [node.id, record])), { concurrency: 1 }).pipe(Effect.map((entries) => HashMap.fromIterable(entries.flatMap(([nodeId, record]) => Arr.map(Arr.fromOption(record), (stored) => [nodeId, stored.status])))));
+/** CAS-terminalize one node to `blocked` (a failed predecessor cut it off). The
+* store's compare-and-set makes a repeat write idempotent, never a regression. */
+const recordBlocked = (deps, nodeId) => deps.executionStore.recordTerminal({
+	at: deps.now(),
+	attempt: 1,
+	identity: {
+		generation: FIRST_EXECUTION_GENERATION,
+		nodeId,
+		runId: deps.runId
+	},
+	status: "blocked"
+}).pipe(Effect.asVoid);
+/**
+* One scheduler tick: plan the next wave, terminalize newly-blocked dependents,
+* and submit the ready nodes. Pure of k8s/clock specifics — those arrive through
+* {@link AdvanceWaveDeps.submitReadyNodes} and {@link AdvanceWaveDeps.now}.
+*/
+const advanceWave = (deps) => Effect.gen(function* body() {
+	const terminalStatus = yield* buildTerminalMap(deps.executionStore, deps.nodes, deps.runId);
+	const plan = planNextWave(deps.nodes, terminalStatus);
+	yield* Effect.forEach(plan.blocked, (nodeId) => recordBlocked(deps, nodeId), { concurrency: 1 });
+	return {
+		plan,
+		submitted: yield* Arr.match(plan.ready, {
+			onEmpty: () => Effect.succeed([]),
+			onNonEmpty: (ready) => deps.submitReadyNodes(ready, FIRST_EXECUTION_GENERATION)
+		})
+	};
+});
+/** A wave-submit requested a node id absent from the compiled schedule — a
+* scheduler invariant violation, never expected in normal operation. */
+var WaveSubmitMissingNodeError = class extends Schema.TaggedErrorClass()("WaveSubmitMissingNodeError", { message: Schema.String }) {
+	constructor(nodeId, runId) {
+		super({ message: `wave submit: node ${nodeId} missing from compiled schedule for run ${runId}` });
+	}
+};
+/**
+* The `SubmitMokaJobsTransport.submitJobs` seam (ENG-57.1/57.2): submit a run's
+* FIRST wave as per-node Jobs. Compiles the schedule, then runs a single
+* {@link advanceWave} tick over a fresh (empty) ExecutionStore — which resolves
+* to the root wave (nodes with no predecessors), fanning parallel roots out and
+* NEVER eagerly submitting a downstream node. Later waves are the reconcile
+* driver's concern ({@link runWaveTick}). Replaces ENG-57.1's single-ready-node
+* primitive so static and dynamic (post-schedule) runs share this one scheduler.
+*/
+const submitWaveJobs = async (input) => {
+	const scheduleYaml = requireCompiledSchedule(input.plan);
+	const namespace = requireSubmitNamespace(input.options);
+	const nodes = compileScheduleArtifact(input.plan.config, parseScheduleArtifact(scheduleYaml, "schedule.yaml"), input.worktreePath).plan.topologicalOrder;
+	const nodeById = HashMap.fromIterable(Arr.map(nodes, (node) => [node.id, node]));
+	const buildRunSpec = input.buildRunSpec ?? defaultBuildNodeRunSpec;
+	const nodeCwd = input.nodeCwd ?? "/workspace";
+	const submitNodeJobs = input.submitNodeJobs ?? submitRunnerNodeJobs;
+	const shared = sharedJobOptions(input, namespace);
+	const jobsDependencies = input.jobsDependencies ?? {};
+	const submitReadyNodes = (nodeIds, generation) => Effect.tryPromise({
+		catch: (error) => error,
+		try: async () => {
+			const specs = R.fromEntries(Arr.map(nodeIds, (id) => {
+				const node = Option$1.getOrThrowWith(HashMap.get(nodeById, id), () => new WaveSubmitMissingNodeError(id, input.plan.runId));
+				return [id, buildRunSpec({
+					context: input.context,
+					node,
+					nodeCwd,
+					plan: input.plan
+				})];
+			}));
+			input.registry.register({
+				runId: input.plan.runId,
+				specs
+			});
+			return await submitNodeJobs({
+				...shared,
+				generation,
+				nodeIds: [...nodeIds]
+			}, jobsDependencies);
+		}
+	});
+	const result = await runWaveEffect(advanceWave({
+		executionStore: inMemoryExecutionStore(),
+		nodes,
+		now: () => DateTime.formatIso(DateTime.nowUnsafe()),
+		runId: input.plan.runId,
+		submitReadyNodes
+	}));
+	return parseJobsSubmitResult({
+		jobs: [...result.submitted],
+		namespace,
+		runId: input.plan.runId,
+		waves: [{ nodeIds: [...result.plan.ready] }],
+		workflowName: input.plan.workflowId,
+		...Str.isEmpty(input.ownerReference.uid) ? {} : { workflowUid: input.ownerReference.uid }
+	});
+};
+//#endregion
+export { WaveSubmitMissingNodeError, advanceWave, submitWaveJobs };

package/dist/coordinator/wave-scheduler.js

@@ -0,0 +1,50 @@
+import * as Option$1 from "effect/Option";
+import * as Arr from "effect/Array";
+import * as HashMap from "effect/HashMap";
+import * as Result from "effect/Result";
+import * as HashSet from "effect/HashSet";
+//#region src/coordinator/wave-scheduler.ts
+/**
+* ENG-57.2: the pure terminal-gated wave state machine shared by static and
+* dynamic schedules. Given the full node list and the current terminal-status
+* map (sourced from `ExecutionStore`), decides which nodes are ready to
+* submit THIS tick, which are permanently blocked by a failed/terminal-failed
+* predecessor, and whether the whole run is complete.
+*
+* No IO, no clock, no k8s client — a node's "already submitted" state lives
+* outside this module (derived from cluster observation), so calling this
+* repeatedly with the same inputs is always safe and side-effect free.
+*/
+/** Terminal statuses that block dependents rather than releasing them (AC#5). */
+const FAILURE_STATUSES = HashSet.fromIterable([
+	"failed",
+	"timed_out",
+	"aborted",
+	"blocked"
+]);
+const statusOf = (terminalStatus, nodeId) => HashMap.get(terminalStatus, nodeId);
+const nodeVerdict = (node, terminalStatus) => {
+	if (Option$1.isSome(statusOf(terminalStatus, node.id))) return "settled";
+	if (node.needs.some((needId) => Option$1.match(statusOf(terminalStatus, needId), {
+		onNone: () => false,
+		onSome: (needStatus) => HashSet.has(FAILURE_STATUSES, needStatus)
+	}))) return "blocked";
+	return node.needs.every((needId) => Option$1.match(statusOf(terminalStatus, needId), {
+		onNone: () => false,
+		onSome: (needStatus) => needStatus === "passed"
+	})) ? "ready" : "waiting";
+};
+const planNextWave = (nodes, terminalStatus) => {
+	const verdicts = Arr.map(nodes, (node) => ({
+		id: node.id,
+		verdict: nodeVerdict(node, terminalStatus)
+	}));
+	const ready = Arr.filterMap(verdicts, (v) => v.verdict === "ready" ? Result.succeed(v.id) : Result.failVoid);
+	return {
+		blocked: Arr.filterMap(verdicts, (v) => v.verdict === "blocked" ? Result.succeed(v.id) : Result.failVoid),
+		ready,
+		runComplete: nodes.every((node) => Option$1.isSome(statusOf(terminalStatus, node.id)))
+	};
+};
+//#endregion
+export { planNextWave };