kind: composite
name: workflow-script-nocp
version: 1
description: "Internal composite for kind: script nodes with cp_write=false (typed-workflows WF-COMP-31b, Option C). Brings the shared-variables filesystem context and the read-only project-repo clone, and NO CP credential: it layers neither cp-service-token/v1 (the AU-51 internal bearer) nor cp-write-token/v1 (the AU-55 per-step write token). Its only forge credential is repo-readonly/v1's read-only deploy key. Not model-bearing; the compiled shape is cli=\"shell\", params.cmd=<cmd>."

# Top-down order (WF-COMP-31b / WF-COMP-34): shared-variables first, repo-readonly
# LAST so its clone runs after the variable wiring and before the script starts.
# Never gitea-ssh/v1 (bug 45a48685). repo-readonly/v1 cannot be dropped: the
# entrypoint V2 guard trips when AGENT_REPO_URL is set and /workspace/project is
# missing, and every shipped script template declares agent_repo.
layers:
  # spec/workflow-variables.md WV-19 / spec/harness.md HD-14 — agent-facing
  # /variables/ context; provides the [shared-variables] tag.
  - context: shared-variables/v1
  # spec/typed-workflows.md WF-COMP-34 — read-only project-repo clone.
  - context: repo-readonly/v1