diff --git a/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts b/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts
index 45874957..dda18506 100644
--- a/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts
+++ b/scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts
@@ -5,8 +5,10 @@ import { repoRoot, rootPath } from "./config";
 import { readWebProbeSentinelConfigRefTarget } from "./hwlab-node-web-sentinel-config-ref";
 import { emitWebProbeSentinelSpan } from "./hwlab-node-web-sentinel-otel";
 import {
+  arrayAt,
   compactCommand,
   finiteNumberOrNull,
+  monitorWebBuildkitStatePlan,
   nonEmptyString,
   numberAt,
   numberAtNullable,
@@ -15,6 +17,8 @@ import {
   resolveSentinelChildJson,
   safeKubernetesSegment,
   sentinelCliSuffix,
+  sentinelPipelineRunName,
+  sentinelProgressEvent,
   sentinelSourceSnapshotStageRefPrefix,
   shellQuote,
   short,
@@ -132,7 +136,7 @@ function sentinelSourceMirrorSyncShell(state: SentinelCicdState, jobName: string
   return sentinelSourceMirrorSyncShellFromConfig(state.cicd, state.controlPlaneNode, jobName, state.sourceHead.commit);
 }
 
-function sentinelSourceMirrorSyncShellFromConfig(cicd: Record<string, unknown>, controlPlaneNode: Record<string, unknown>, jobName: string, selectedCommit: string | null): string {
+export function sentinelSourceMirrorSyncShellFromConfig(cicd: Record<string, unknown>, controlPlaneNode: Record<string, unknown>, jobName: string, selectedCommit: string | null): string {
   return [
     "set -eu",
     `job_name=${shellQuote(jobName)}`,
@@ -476,7 +480,7 @@ function sentinelGitMirrorCacheVolume(state: SentinelCicdState): Record<string,
   return sentinelGitMirrorCacheVolumeFromTarget(state.controlPlaneTarget);
 }
 
-function sentinelGitMirrorCacheVolumeFromTarget(controlPlaneTarget: Record<string, unknown>): Record<string, unknown> {
+export function sentinelGitMirrorCacheVolumeFromTarget(controlPlaneTarget: Record<string, unknown>): Record<string, unknown> {
   const hostPath = nonEmptyString(valueAtPath(controlPlaneTarget, "gitMirror.cacheHostPath"));
   if (hostPath !== null) return { name: "cache", hostPath: { path: hostPath, type: "DirectoryOrCreate" } };
   return { name: "cache", persistentVolumeClaim: { claimName: stringAt(controlPlaneTarget, "gitMirror.cachePvcName") } };
@@ -839,7 +843,7 @@ function applySentinelArgoApplication(state: SentinelCicdState, timeoutSeconds:
   return { ok: result.exitCode === 0, result: compactCommand(result), valuesRedacted: true };
 }
 
-function createK8sJobScript(namespace: string, manifest: Record<string, unknown>): string {
+export function createK8sJobScript(namespace: string, manifest: Record<string, unknown>): string {
   const yaml = `${Bun.YAML.stringify(manifest).trim()}\n`;
   return [
     "set -eu",
@@ -873,7 +877,7 @@ function createTektonPipelineRunScript(namespace: string, manifest: Record<strin
   ].join("\n");
 }
 
-function probeK8sJobScript(namespace: string, jobName: string): string {
+export function probeK8sJobScript(namespace: string, jobName: string): string {
   return [
     "set +e",
     `namespace=${shellQuote(namespace)}`,
@@ -919,7 +923,7 @@ function probeTektonPipelineRunScript(namespace: string, pipelineRunName: string
   ].join("\n");
 }
 
-function sentinelPayloadFromLogs(logsTail: string): Record<string, unknown> {
+export function sentinelPayloadFromLogs(logsTail: string): Record<string, unknown> {
   const lines = logsTail.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean);
   for (let index = lines.length - 1; index >= 0; index -= 1) {
     const line = lines[index];
diff --git a/scripts/src/hwlab-node-web-sentinel-cicd-shared.ts b/scripts/src/hwlab-node-web-sentinel-cicd-shared.ts
index 97e7a5d4..943b7d0e 100644
--- a/scripts/src/hwlab-node-web-sentinel-cicd-shared.ts
+++ b/scripts/src/hwlab-node-web-sentinel-cicd-shared.ts
@@ -825,6 +825,10 @@ export function rendered(ok: boolean, command: string, text: string): RenderedCl
   return { ok, command, renderedText: `${text.trimEnd()}\n`, contentType: "text/plain" };
 }
 
+export function sentinelProgressEvent(event: string, payload: Record<string, unknown>): void {
+  console.error(JSON.stringify({ event, at: new Date().toISOString(), ...payload, valuesRedacted: true }));
+}
+
 export function readConfigFile(file: string): unknown {
   if (file.startsWith("/") || file.includes("..") || !file.startsWith("config/")) throw new Error(`unsafe configRef file: ${file}`);
   const abs = rootPath(file);
diff --git a/scripts/src/hwlab-node-web-sentinel-cicd.ts b/scripts/src/hwlab-node-web-sentinel-cicd.ts
index 34bf0d39..fab7ed29 100644
--- a/scripts/src/hwlab-node-web-sentinel-cicd.ts
+++ b/scripts/src/hwlab-node-web-sentinel-cicd.ts
@@ -56,6 +56,7 @@ import {
   secretSourcePaths,
   sentinelCliSuffix,
   sentinelPipelineRunName,
+  sentinelProgressEvent,
   sentinelSourceSnapshotRef,
   sentinelSourceSnapshotStageRefPrefix,
   sha256,
@@ -83,12 +84,17 @@ import {
 } from "./hwlab-node-web-sentinel-cicd-shared";
 import {
   controlPlaneWaitWarningSeconds,
+  createK8sJobScript,
+  probeK8sJobScript,
   publishSatisfiedByObservedWarnings,
   runSentinelPublishJob,
   runSentinelSourceMirrorSyncJob,
   sentinelBlockedRemoteResult,
   sentinelCicdElapsedWarnings,
+  sentinelGitMirrorCacheVolumeFromTarget,
+  sentinelPayloadFromLogs,
   sentinelRemoteJobTimeoutWarnings,
+  sentinelSourceMirrorSyncShellFromConfig,
   sentinelSourceMirrorAlreadyPresentResult,
   sourceMirrorAlreadyReadyWarnings,
 } from "./hwlab-node-web-sentinel-cicd-jobs";
@@ -2212,10 +2218,6 @@ export function withWarnings(payload: Record<string, unknown>, warnings: readonl
   return merged.length === 0 ? payload : { ...payload, warnings: merged, valuesRedacted: true };
 }
 
-function sentinelProgressEvent(event: string, payload: Record<string, unknown>): void {
-  console.error(JSON.stringify({ event, at: new Date().toISOString(), ...payload, valuesRedacted: true }));
-}
-
 function installSentinelPublishInterruptHandler(state: SentinelCicdState, context: Record<string, unknown>): () => void {
   let handled = false;
   const handler = (signal: string) => {