kind: composite
name: workflow-script-nocp-norepo
version: 1
description: "Internal composite for kind: script nodes with cp_write=false and NO effective agent_repo (typed-workflows WF-COMP-31e, planner item e993c9fa). Brings only the shared-variables filesystem context: no repo-readonly clone, no CP credential, and therefore ZERO secrets_required entries. That makes the node eligible for an M45 tenant namespace (the NS-12 gate rejects any ESO account secret) and for the M33 egress broker sidecar, which supplies the node's credentials through bindings. Not model-bearing; the compiled shape is cli=\"shell\", params.cmd=<cmd>."

# Counterpart of workflow-script-nocp/v1 for templates that declare no agent_repo.
# The compiler (controlplane/script_composites.py resolve_script_composite) selects
# this only when effective_repo is False; with AGENT_REPO_URL unset the entrypoint
# V2 guard does not require /workspace/project. Never layer repo-readonly/v1 here:
# its gitea-ssh-readonly secret is exactly what this composite exists to avoid.
layers:
  # spec/workflow-variables.md WV-19 / spec/harness.md HD-14 — provides the
  # [shared-variables] tag.
  - context: shared-variables/v1