kind: composite
name: workflow-script-write
version: 1
description: "Internal composite for kind: script nodes with cp_write=true (typed-workflows WF-COMP-31c, Option C). Brings the shared-variables filesystem context, the AU-55 per-step CP write token (cp-write-token/v1 sets CP_WRITE_TOKEN_FILE; the dispatcher delivers the wfcw_ file into the script container only, AU-55b) and the read-only project-repo clone. Omits cp-service-token/v1: a cp_write=true container gets the AU-55 token only, never the AU-51 internal bearer. Not model-bearing; the compiled shape is cli=\"shell\", params.cmd=<cmd>."

# Top-down order (WF-COMP-31c / WF-COMP-34): shared-variables, cp-write-token,
# repo-readonly LAST. Never gitea-ssh/v1 (bug 45a48685) and never
# cp-service-token/v1.
layers:
  # spec/workflow-variables.md WV-19 / spec/harness.md HD-14.
  - context: shared-variables/v1
  # spec/authentication.md AU-55 / AU-55b — env-only layer; exports
  # CP_WRITE_TOKEN_FILE=/run/agent/cp-write-token/token.
  - context: cp-write-token/v1
  # spec/typed-workflows.md WF-COMP-34 — read-only project-repo clone.
  - context: repo-readonly/v1