feat: pi-taskflow v0.0.1 — lightweight workflow orchestration for pi

Declarative multi-phase taskflows:
- DAG runtime (agent/parallel/map/gate/reduce phases)
- dynamic map fan-out with bounded concurrency
- isolated subagent context (intermediate results stay out of main context)
- cross-session resumable runs
- saveable flows as /tf:<name> commands

Includes 23 unit tests + real end-to-end test (live subagent spawn).
CI + npm publish workflows (public registry, provenance).

Author: heggria

.github/workflows/ci.yml

@@ -0,0 +1,23 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          registry-url: "https://registry.npmjs.org"
+      - name: Install dependencies
+        run: npm install --registry https://registry.npmjs.org/
+      - name: Typecheck
+        run: npm run typecheck
+      - name: Unit tests
+        run: npm test

.github/workflows/publish.yml

@@ -0,0 +1,49 @@
+name: Publish to npm
+
+# Publishes to the public npm registry when a GitHub Release is published,
+# or when a v* tag is pushed. Requires the NPM_TOKEN repository secret
+# (an Automation token from your PUBLIC npm account).
+
+on:
+  release:
+    types: [published]
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # enables npm provenance
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install dependencies
+        run: npm install --registry https://registry.npmjs.org/
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Unit tests
+        run: npm test
+
+      - name: Verify tag matches package version
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: |
+          PKG_VERSION="v$(node -p "require('./package.json').version")"
+          TAG="${GITHUB_REF_NAME}"
+          if [ "$PKG_VERSION" != "$TAG" ]; then
+            echo "::error::Tag $TAG does not match package.json version $PKG_VERSION"
+            exit 1
+          fi
+
+      - name: Publish (public, with provenance)
+        run: npm publish --access public --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.gitignore

@@ -0,0 +1,8 @@
+node_modules/
+dist/
+*.log
+.DS_Store
+.pi/taskflows/runs/
+
+# Lockfile omitted: generated against internal mirror locally; CI installs from public npm
+package-lock.json