@outerlayer/cli 0.17.0 → 0.19.0

package/dist/{chunk-G5NPRL2K.js → chunk-6U3MV7TZ.js}

@@ -1,33 +1,36 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { writeJobFile, readJobFile } from './chunk-RMWLBUCJ.js';
-import { senderPidfile } from './chunk-NNRTPG7X.js';
-import { DOCKERD_LOG } from './chunk-HYZRY4KZ.js';
-import { installScrubContext } from './chunk-NWQTTSBB.js';
-import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-MAK5LYRF.js';
-import { childEnvironment } from './chunk-KMDLFI4P.js';
-import { waitForAgent, vmExecArgs } from './chunk-QKFB4K7X.js';
-import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-RSNSZ2LJ.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-S3NYLI2P.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-22RMZBGW.js';
-import { readBranchHead, diffBetween, fetchCommit } from './chunk-R7PF5OOU.js';
-import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
+import { writeJobFile, readJobFile } from './chunk-SADUQSO4.js';
+import { senderPidfile } from './chunk-5GHGAF6P.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-XNGMQ27R.js';
+import { installScrubContext } from './chunk-7SJPQWBM.js';
+import { AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-7KSSBQTS.js';
+import { childEnvironment } from './chunk-VMJPFQNE.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR } from './chunk-3UZTIRLF.js';
+import { waitForAgent, vmExecArgs } from './chunk-GGOMT6KF.js';
+import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-X5H2WYMB.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-XSZD4AZ6.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-HPJNLETG.js';
+import { planArtifactUpload } from './chunk-G3IJ3N6F.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-P53VEAOF.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { claudeCredential, repositoriesOf, primaryOf, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, withTunnelRecord, RELAY_PORT, checkEnvironment, EVAL_INPUT_DIR } from './chunk-4Q7OMKAT.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-3CWUOFV6.js';
 import { CLAUDE_CODE_VERSION } from './chunk-CX22S5BA.js';
-import { planArtifactUpload } from './chunk-WUYTWNMA.js';
-import { scrubText } from './chunk-JXYVA45C.js';
-import { withHooksPath, authorEnvironment, commitIdentityRecord } from './chunk-BYT5O5RV.js';
-import { parsePolicy } from './chunk-OHVJA253.js';
+import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
+import { scrubText } from './chunk-QNLX477Q.js';
+import { resolvePackRoot } from './chunk-NNLA7LLQ.js';
+import { parsePolicy } from './chunk-WFSUUUAN.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { resolveVersion } from './chunk-RA3O54FC.js';
-import { signerFor } from './chunk-V7NIVOFD.js';
-import { runnerDir, buildDir, vsockPath, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { resolveVersion } from './chunk-RA3O54FC.js';
+import { signerFor } from './chunk-M2ZWWTWZ.js';
+import { runnerDir, buildDir, vsockPath, RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
+import { claudeCredential, repositoriesOf, primaryOf, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, checkEnvironment, EVAL_INPUT_DIR } from './chunk-BQXFBI7T.js';
 import { spawn, spawnSync } from 'child_process';
 import { randomBytes, createHash } from 'crypto';
-import { mkdirSync, chmodSync, writeFileSync, appendFileSync, statSync, accessSync, constants, openSync, existsSync, readFileSync, closeSync, rmSync, readdirSync, lstatSync, realpathSync } from 'fs';
+import { mkdirSync, chmodSync, writeFileSync, appendFileSync, statSync, accessSync, constants, openSync, existsSync, readFileSync, closeSync, rmSync, readdirSync, lstatSync, fstatSync, readSync, realpathSync } from 'fs';
 import { join, isAbsolute, dirname, delimiter, sep } from 'path';
+import { pathToFileURL } from 'url';
 
 createRequire(import.meta.url);
 var DEFAULT_MEMORY = "8g";
@@ -103,11 +106,16 @@ async function provisionMicroVm(input) {
   } catch (err) {
     return fail(err instanceof AssetError ? err.message : `the microVM's assets could not be had: ${describeCallFailure(err)}`);
   }
+  const governing = await resolveGoverningSource({ config, repository, fetchImpl: input.fetchImpl });
+  if (!governing.ok) return fail(governing.reason);
+  const governingSource = governing.source;
   const obtained = await obtainImage({
     config,
     runtime,
     tokens,
-    repository,
+    repository: governingSource.kind === "governed" ? governingSource.repository : repository,
+    pinned: governingSource.kind === "governed" ? { commit: governingSource.sha, ref: governingSource.ref } : void 0,
+    governedRepository: repository,
     tag,
     log,
     aborted: input.aborted,
@@ -127,9 +135,10 @@ async function provisionMicroVm(input) {
     containerEnv: report.apply.containerEnv,
     builtIns: true,
     lifecycle: report.apply.lifecycle,
+    ...governingSource.kind === "governed" ? { governing: { repository: governingSource.repository, ref: governingSource.ref, commit: governingSource.sha } } : {},
     ...report.docker === true ? { docker: true } : {}
   };
-  const env = buildEnvironment({
+  const envInput = {
     config,
     item: item.number,
     itemKey,
@@ -138,7 +147,8 @@ async function provisionMicroVm(input) {
     hostEnv: runtime.hostEnv,
     containerEnv: report.apply.containerEnv,
     builtIns: true
-  });
+  };
+  const env = buildEnvironment(envInput);
   if (env.skippedTokenVariables.length > 0) {
     log.line(`${tag} not passing ${env.skippedTokenVariables.join(", ")} from runner.build.variables into the build: its repository token comes from the runner`);
   }
@@ -277,17 +287,24 @@ async function provisionMicroVm(input) {
   }
   state.agentUser = agentUser;
   const tools = await asRoot(runtime, state, ["cat", "/opt/outerlayer/tools.json"]);
-  environment.agentVersion = agentVersionOf(tools.status === 0 ? tools.stdout : "");
+  const agentVersion = agentVersionOf(tools.status === 0 ? tools.stdout : "");
+  environment.agentVersion = agentVersion;
+  const program = await asRoot(runtime, state, [...HASH_ARGV]);
+  const hashed = program.status === 0 ? parseProgramHash(program.stdout) : void 0;
+  if (hashed !== void 0) state.judgeProgram = { path: JUDGE_PROGRAM, sha256: hashed };
   input.save(state, environment);
   if (report.docker === true) {
     const failure = await waitForDocker(runtime, state, agentUser, input.now ?? (() => /* @__PURE__ */ new Date()));
     if (failure !== void 0) return bail(failure);
   }
-  const request = (argv, workdir) => ({ argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, env) });
+  const execEnv = buildEnvironment({ ...envInput, imageEnv: state.imageEnv });
+  const request = (argv, workdir) => ({ argv, user: agentUser, cwd: workdir, env: execEnvironment(state.imageEnv, execEnv) });
   const steps = await runBuildSteps({
     repository,
     branch: primary.branch,
     repositories,
+    ...governingSource.kind === "governed" ? { governing: { repository: governingSource.repository } } : {},
+    agentVersion,
     lifecycle: report.apply.lifecycle,
     exec: async (argv, workdir, opts) => {
       const ran = await vm.exec(state.vsockPath, request(argv, workdir));
@@ -300,6 +317,7 @@ async function provisionMicroVm(input) {
     stageContext: () => stageGovernedContext({
       config,
       repository,
+      source: pinnedSourceOf(governingSource),
       buildId,
       buildDir: buildDir2,
       fetchImpl: input.fetchImpl,
@@ -321,6 +339,7 @@ async function provisionMicroVm(input) {
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
   state.startCommit = steps.startCommit;
+  if (steps.controlPlane !== void 0) environment.controlPlane = steps.controlPlane;
   return { ok: true, workdir: CHECKOUT_DIR, state, environment };
 }
 async function waitForDocker(runtime, state, agentUser, now) {
@@ -365,7 +384,8 @@ function vmExecFor(input, argv) {
     hostEnv: input.runtime.hostEnv,
     containerEnv: state.containerEnv ?? {},
     builtIns: state.builtIns === true,
-    identity: input.job.commitIdentity
+    identity: input.job.commitIdentity,
+    imageEnv: state.imageEnv
   });
   const options = {
     socket: state.vsockPath,
@@ -378,7 +398,7 @@ function vmExecFor(input, argv) {
   return { options, env: { ...childEnvironment(input.runtime.hostEnv), ...env.passed } };
 }
 function microVmCommandLine(input) {
-  const { options, env } = vmExecFor(input, ["/bin/sh", "-c", input.cmdline]);
+  const { options, env } = vmExecFor(input, ["/bin/sh", "-c", commandWithShim(input.job, input.cmdline)]);
   return { line: [process.execPath, input.cli, "vm-exec", ...vmExecArgs(options)].map(shellQuote).join(" "), options, env };
 }
 function microVmSenderCommand(input) {
@@ -403,7 +423,8 @@ async function syncInMicroVm(input) {
       hostEnv: runtime.hostEnv,
       containerEnv: state.containerEnv ?? {},
       builtIns: state.builtIns === true,
-      identity: job.commitIdentity
+      identity: job.commitIdentity,
+      imageEnv: state.imageEnv
     });
     const result = await runtime.vm.exec(state.vsockPath, {
       argv: ["outerlayer", "sync"],
@@ -429,6 +450,98 @@ async function copyTranscriptsFromMicroVm(runtime, state) {
   if (!isRunning(runtime, state)) return { ok: false, reason: "the build's microVM is gone" };
   return copyTranscripts((argv) => asRoot(runtime, state, argv));
 }
+function guestStopScript(paths = { proc: "/proc", record: HELPER_RECORD }) {
+  return [
+    `record=${shellQuote(paths.record)}`,
+    '[ -r "$record" ] || exit 2',
+    'keep=" "',
+    'while read -r kpid kstart; do keep="$keep$kpid:$kstart "; done < "$record"',
+    "n=0",
+    "while [ $n -lt 50 ]; do",
+    '  left=""',
+    // The list of /proc entries is made once per pass, so the commands this script runs are not in it.
+    `  for p in ${shellQuote(paths.proc)}/[0-9]*; do`,
+    "    pid=${p##*/}",
+    '    [ "$pid" = 1 ] && continue',
+    '    [ "$pid" = "$$" ] && continue',
+    '    stat=$(cat "$p/stat" 2>/dev/null) || continue',
+    // Field 2 of stat is the command name, which can hold spaces, so the fields are counted from its closing ")":
+    // $1 is the state, $7 the flags, ${18} the thread count and ${20} the start time.
+    '    set -- ${stat##*") "}',
+    // 0x200000 is PF_KTHREAD.
+    "    [ $(($7 & 2097152)) -ne 0 ] && continue",
+    '    [ "$1" = Z ] && [ "${18}" -le 1 ] && continue',
+    '    case "$keep" in *" $pid:${20} "*) continue ;; esac',
+    '    left="$left $pid"',
+    "  done",
+    '  [ -z "$left" ] && exit 0',
+    "  for pid in $left; do kill -KILL $pid 2>/dev/null; done",
+    "  n=$((n+1))",
+    "  sleep 0.2",
+    "done",
+    "exit 1"
+  ].join("\n");
+}
+var GUEST_JUDGE_DIR = JUDGE_DIR;
+function microVmJudgeEnvironment(input) {
+  const { runtime, job } = input;
+  const state = job.microvm;
+  const agentUser = state.agentUser ?? ADDED_USER;
+  const needsVm = () => {
+    if (state.firecracker !== void 0 && !isRunning(runtime, state)) throw new Error("the build's microVM is gone");
+  };
+  return {
+    stop: async () => {
+      needsVm();
+      const stopped = await asRoot(runtime, state, ["/bin/sh", "-c", guestStopScript()]);
+      if (stopped.status === 2) throw new Error(`the guest has no record of the runner's helper processes at ${HELPER_RECORD}, so nothing was stopped`);
+      if (stopped.status !== 0) throw new Error(`processes of the build were still running after they were killed (exit ${stopped.status})`);
+    },
+    hashProgram: async () => {
+      needsVm();
+      const ran = await asRoot(runtime, state, [...HASH_ARGV]);
+      const sha256 = ran.status === 0 ? parseProgramHash(ran.stdout) : void 0;
+      return sha256 === void 0 ? { ok: false, reason: firstLine(ran.stderr) || `the hash could not be taken (exit ${ran.status})` } : { ok: true, sha256 };
+    },
+    prepare: async (files, tree) => {
+      needsVm();
+      const staging = join(input.jobDir, "judge-input");
+      rmSync(staging, { recursive: true, force: true });
+      mkdirSync(staging, { recursive: true });
+      try {
+        for (const [fileName, text2] of Object.entries(files)) writeFileSync(join(staging, fileName), text2);
+        if (tree !== void 0) copyJudgeTree(tree, join(staging, "tree"));
+        const dir = GUEST_JUDGE_DIR;
+        const script = [
+          "set -e",
+          `grep -q " ${dir} tmpfs " /proc/mounts || ${HELPER_PATH} mount --target ${dir} --source tmpfs --type tmpfs --options mode=0755`,
+          `find ${dir} -mindepth 1 -delete`,
+          `tar -x --no-same-owner -C ${dir}`,
+          `mkdir -p ${dir}/home/tmp`,
+          `chmod -R a+rX ${dir}`,
+          `chown -R ${shellQuote(agentUser)} ${dir}/home`,
+          `chmod 1777 ${dir}`
+        ].join("\n");
+        const result = await asRoot(runtime, state, ["/bin/sh", "-c", script], tarOf(staging));
+        if (result.status !== 0) throw new Error(`preparing ${dir} in the guest failed (exit ${result.status}): ${firstLine(result.stderr)}`);
+      } finally {
+        rmSync(staging, { recursive: true, force: true });
+      }
+    },
+    run: async (command, opts) => {
+      needsVm();
+      const ran = await runtime.vm.exec(state.vsockPath, { argv: command.argv, user: agentUser, cwd: command.cwd, env: command.env });
+      appendFileSync(opts.logPath, ran.stdout + ran.stderr);
+      return ran;
+    },
+    readReport: async () => {
+      needsVm();
+      const file = `${GUEST_JUDGE_DIR}/report.html`;
+      const read = await asRoot(runtime, state, ["/bin/sh", "-c", `[ -f ${file} ] && [ ! -L ${file} ] && head -c ${MAX_REPORT_BYTES + 1} ${file}`]);
+      return read.status === 0 && Buffer.byteLength(read.stdout) <= MAX_REPORT_BYTES ? read.stdout : void 0;
+    }
+  };
+}
 async function startCheckMicroVm(input) {
   const { config, runtime, job, jobDir, tokens, log } = input;
   const { vm } = runtime;
@@ -548,7 +661,7 @@ async function startCheckMicroVm(input) {
   const failed = await boot();
   if (failed !== void 0) return fail(failed);
   if (abandoned()) return fail(ABANDONED);
-  const env = checkEnvironment({ config, item: job.item, repository, hostEnv: runtime.hostEnv, containerEnv: built.containerEnv ?? {} });
+  const env = checkEnvironment({ config, item: job.item, repository, hostEnv: runtime.hostEnv, containerEnv: built.containerEnv ?? {}, imageEnv: built.imageEnv });
   const evalInput = { dir: join(checksDir, EVAL_INPUT_NAME), delivered: false };
   const deliverEvalInput = async () => {
     await unpackIntoGuest(runtime, state, evalInput.dir, EVAL_INPUT_DIR, { readOnly: true });
@@ -734,6 +847,7 @@ function hostCommandEnvironment(base, build, config, hooksPath) {
     Object.assign(env, proxyEnvironment(proxyUrlFor(build), brokerHost));
   } else if (build.proxyPort !== void 0) {
     Object.assign(env, proxyEnvironment(`http://127.0.0.1:${build.proxyPort}`));
+    env.NODE_OPTIONS = withProxyWarningHidden(env.NODE_OPTIONS);
   }
   const ports = build.destinations ?? [];
   const portOf = (name) => ports.find((entry) => entry.name === name)?.port;
@@ -875,11 +989,123 @@ async function settleVerdict(deps) {
     await deps.sleep(everyMs);
   }
 }
+var RUNNER_LOG_FILE = "runner.log";
+var RUNNER_LOG_KEEP_BYTES = 65536;
+function isTailedStage(stage) {
+  const tailed = ["provision", "sync", "cleanup", "report"];
+  return tailed.includes(stage);
+}
+var READ_LIMIT_BYTES = 1048576;
+var ITEM_LINE = /^#(\d+)\b/;
+var AttemptLogBook = class {
+  constructor(now = () => /* @__PURE__ */ new Date()) {
+    this.now = now;
+    this.dirs = /* @__PURE__ */ new Map();
+    this.lastByKey = /* @__PURE__ */ new Map();
+  }
+  /** Starts keeping lines for `item` in `jobDirPath`. Idempotent. */
+  open(item, jobDirPath) {
+    this.dirs.set(Number(item), jobDirPath);
+  }
+  /** Stops keeping lines for `item`; its file stays on disk until housekeeping removes the job directory. */
+  close(item) {
+    const number = Number(item);
+    this.dirs.delete(number);
+    for (const key of [...this.lastByKey.keys()]) {
+      if (key.startsWith(`${number}:`)) this.lastByKey.delete(key);
+    }
+  }
+  /** The log with every line it writes for an open item also kept in that item's file. */
+  wrap(log) {
+    return {
+      line: (text2) => {
+        log.line(text2);
+        this.keepItemLine(text2);
+      },
+      error: (text2) => {
+        log.error(text2);
+        this.keepItemLine(text2);
+      }
+    };
+  }
+  /** One line for `item` that does not itself start with its number. */
+  note(item, text2) {
+    this.append(Number(item), text2);
+  }
+  /** One line, written only when `text` differs from the last one written under `key` for the item. */
+  noteChanged(item, key, text2) {
+    const number = Number(item);
+    const slot = `${number}:${key}`;
+    if (this.lastByKey.get(slot) === text2) return;
+    this.lastByKey.set(slot, text2);
+    this.append(number, text2);
+  }
+  keepItemLine(text2) {
+    const match = ITEM_LINE.exec(text2);
+    if (match !== null) this.append(Number(match[1]), text2);
+  }
+  append(item, text2) {
+    const dir = this.dirs.get(item);
+    if (dir === void 0) return;
+    try {
+      appendFileSync(join(dir, RUNNER_LOG_FILE), `${logStamp(this.now())} ${text2.replace(/[\r\n]+/g, " ")}
+`, { mode: 384 });
+    } catch {
+    }
+  }
+};
+function readEnd(path, maxBytes) {
+  let fd;
+  try {
+    fd = openSync(path, "r");
+    const size = fstatSync(fd).size;
+    const length = Math.min(size, maxBytes);
+    const buffer = Buffer.alloc(length);
+    readSync(fd, buffer, 0, length, size - length);
+    return buffer.toString("utf8");
+  } catch {
+    return void 0;
+  } finally {
+    if (fd !== void 0) closeSync(fd);
+  }
+}
+function lastLines(text2, count) {
+  const lines = text2.split("\n");
+  if (lines.at(-1) === "") lines.pop();
+  return lines.slice(-200);
+}
+function capRunnerLog(text2) {
+  const bytes = Buffer.from(text2, "utf8");
+  if (bytes.length <= RUNNER_LOG_KEEP_BYTES) return text2;
+  let start = bytes.length - RUNNER_LOG_KEEP_BYTES;
+  if (bytes[start - 1] !== 10) {
+    const newline = bytes.indexOf(10, start);
+    if (newline + 1 < bytes.length) {
+      start = newline + 1;
+    } else {
+      while ((bytes[start] & 192) === 128) start++;
+    }
+  }
+  return `[runner log truncated: the first ${start} bytes were cut]
+${bytes.subarray(start).toString("utf8")}`;
+}
+function buildReleaseLog(jobDirPath, endStage, scrub) {
+  const parts = [];
+  const own = readEnd(join(jobDirPath, RUNNER_LOG_FILE), READ_LIMIT_BYTES);
+  if (own !== void 0 && own.trim() !== "") parts.push(own.endsWith("\n") ? own.slice(0, -1) : own);
+  if (isTailedStage(endStage)) {
+    const file = `${endStage}.log`;
+    const stage = readEnd(join(jobDirPath, file), READ_LIMIT_BYTES);
+    const tail = stage === void 0 ? [] : lastLines(stage);
+    if (tail.length > 0) parts.push(`--- the last ${tail.length} lines of ${file} ---`, ...tail);
+  }
+  if (parts.length === 0) return void 0;
+  return capRunnerLog(scrub(parts.join("\n")) + "\n");
+}
 var ENDED = "ended before provision finished";
 async function provisionProcess(input) {
-  const { config, runtime, item, jobDir } = input;
+  const { config, runtime, item, repository, jobDir } = input;
   if (claudeCredential(runtime.hostEnv) === void 0) return { ok: false, reason: AGENT_CREDENTIAL_MISSING };
-  const repository = item.specRepository;
   if (repository === void 0 || repository === null || repository === "") {
     return { ok: false, reason: "the work item names no repository to clone" };
   }
@@ -921,6 +1147,9 @@ var MAX_VALIDATOR_FILES = 20;
 var VALIDATORS_DIR = ".outerlayer/validators";
 var POLICY_FILE = ".outerlayer/policy.yaml";
 var LIMIT_KEY_TAIL = " (runner.checks.timeLimitMinutes)";
+function isJudgeCheck(check) {
+  return "judge" in check;
+}
 function lastLine(text2) {
   return text2.split(/\r\n|\r|\n/).map((line) => line.trim()).filter((line) => line !== "").at(-1);
 }
@@ -956,17 +1185,24 @@ function checksIn(root, log, tag) {
   const policy = readInside(root, POLICY_FILE);
   const loaded = parsePolicy(policy === void 0 ? null : { path: POLICY_FILE, content: policy }, validatorFilesIn(root));
   for (const problem of loaded.problems) log.error(`${tag} ${problem.file}: ${problem.problem}`);
-  const hostChecks = loaded.customs.filter((def) => def.runWhere === "host" && def.level !== "off" && def.declaresEmit !== null && def.command !== void 0);
-  return hostChecks.map((def) => ({ name: def.declaresEmit, command: def.command }));
+  const hostChecks = loaded.customs.filter((def) => def.runWhere === "host" && def.level !== "off" && def.declaresEmit !== null);
+  const checks = [];
+  for (const def of hostChecks) {
+    if (def.judge !== void 0) checks.push({ name: def.declaresEmit, judge: { brief: def.judge.brief, text: readInside(root, def.judge.brief) } });
+    else if (def.command !== void 0) checks.push({ name: def.declaresEmit, command: def.command });
+  }
+  return checks;
 }
 async function readDefinitions(input, repository, scratch, token, tokens) {
   const { config, job, deps } = input;
   const tag = `#${job.item}`;
   const stage = deps.stage ?? stageGovernedContext;
   const controlPlaneUrl = (controlPlane) => deps.runtime.remoteFor?.(controlPlane) ?? `${deps.runtime.github.gitUrl}/${controlPlane}.git`;
+  const governing = (job.container ?? job.microvm)?.governing;
   const staged = await stage({
     config,
     repository,
+    ...governing === void 0 ? {} : { source: { repository: governing.repository, ref: governing.ref, sha: governing.commit } },
     buildId: `checks-${randomBytes(4).toString("hex")}`,
     buildDir: scratch,
     fetchImpl: deps.fetchImpl,
@@ -1004,6 +1240,33 @@ function noCleanEnvironment(job) {
   const ran = job.build?.workDir !== void 0 ? "builtin:process" : "a provision hook of the host's own";
   return `the host has no clean environment for checks: this build ran under ${ran}, and checks run only in a new container or microVM from a build's image`;
 }
+function makeRecorder(input) {
+  const { config, job, deps } = input;
+  const tag = `#${job.item}`;
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  let signer;
+  return async (name, result, sentence, opts = {}) => {
+    signer ??= await signerFor(config.configPath);
+    const keyTail = opts.keyTail ?? "";
+    const body = sentence === void 0 ? void 0 : cutReasonLine(`${scrubReason(sentence, config) ?? "check failed"}${keyTail}`);
+    const clientEmitId = `host-${createHash("sha256").update(`${job.claimId}:${job.startedAt}:${name}${opts.idTag === void 0 ? "" : `:${opts.idTag}`}`).digest("hex").slice(0, 40)}`;
+    const sent = await retrySend(
+      () => postJson(
+        config.url,
+        "/v1/emitted-results",
+        config.apiKey,
+        config.appId,
+        { schemaVersion: 1, emit: { clientEmitId, name, result, ...body === void 0 ? {} : { body }, ...opts.link === void 0 ? {} : { link: opts.link }, emittedAt: now().toISOString(), item: { number: Number(job.item) } } },
+        deps.fetchImpl,
+        void 0,
+        signer
+      ),
+      { now: deps.now }
+    );
+    if (sent.ok) deps.log.line(`${tag} check ${name} ${result}${body === void 0 ? "" : `: ${body}`}`);
+    else deps.log.error(`${tag} check ${name} ${result} could not be recorded: ${sent.reason}`);
+  };
+}
 async function runHostChecks(input) {
   const { config, job, jobDir, deps } = input;
   const { runtime, log } = deps;
@@ -1035,34 +1298,15 @@ async function runHostChecks(input) {
     rmSync(scratch, { recursive: true, force: true });
     return;
   }
-  const checks = definitions.checks;
+  const checks = definitions.checks.filter((check) => !isJudgeCheck(check));
   if (checks.length === 0) {
     rmSync(scratch, { recursive: true, force: true });
     return;
   }
   log.line(`${tag} checks started (${checks.map((check) => check.name).join(", ")})`);
   const startedMs = now().getTime();
-  let signer;
-  const record = async (check, result, sentence, keyTail = "") => {
-    signer ??= await signerFor(config.configPath);
-    const body = sentence === void 0 ? void 0 : cutReasonLine(`${scrubReason(sentence, config) ?? "check failed"}${keyTail}`);
-    const clientEmitId = `host-${createHash("sha256").update(`${job.claimId}:${job.startedAt}:${check.name}`).digest("hex").slice(0, 40)}`;
-    const sent = await retrySend(
-      () => postJson(
-        config.url,
-        "/v1/emitted-results",
-        config.apiKey,
-        config.appId,
-        { schemaVersion: 1, emit: { clientEmitId, name: check.name, result, ...body === void 0 ? {} : { body }, emittedAt: now().toISOString(), item: { number: Number(job.item) } } },
-        deps.fetchImpl,
-        void 0,
-        signer
-      ),
-      { now: deps.now }
-    );
-    if (sent.ok) log.line(`${tag} check ${check.name} ${result}${body === void 0 ? "" : `: ${body}`}`);
-    else log.error(`${tag} check ${check.name} ${result} could not be recorded: ${sent.reason}`);
-  };
+  const recorder = makeRecorder({ config, job, deps });
+  const record = (check, result, sentence, keyTail = "") => recorder(check.name, result, sentence, { keyTail });
   const failAll = async (reason, keyTail = "") => {
     log.error(`${tag} checks failed: ${reason}${keyTail}`);
     for (const check of checks) await record(check, "fail", reason, keyTail);
@@ -1070,12 +1314,36 @@ async function runHostChecks(input) {
   try {
     if (job.container === void 0 && job.microvm === void 0) return await failAll(noCleanEnvironment(job));
     if (tokens === void 0) return await failAll("the build's repository tokens are no longer held, so the branch cannot be fetched");
-    const branch = job.branch;
-    if (branch === void 0) return await failAll("the build pushed no branch: the claim names none");
-    const remote = runtime.remoteFor?.(repository) ?? `${runtime.github.gitUrl}/${repository}.git`;
-    const read = await (deps.readBranch ?? readBranchHead)({ remote, dir: scratch, branch, token: readToken });
-    if (read.kind === "absent") return await failAll(`the build pushed no branch: ${branch} does not exist on ${repository}`);
-    if (read.kind === "unreadable") return await failAll(`the branch ${branch} could not be read: ${read.reason}`);
+    if (job.branch === void 0) return await failAll("the build pushed no branch: the claim names none");
+    const claimed = repositoriesOf({ repositories: job.repositories, repository, branch: job.branch });
+    if (claimed.length === 0) return await failAll("the claim names no repository to check out");
+    const remoteOf = (name) => runtime.remoteFor?.(name) ?? `${runtime.github.gitUrl}/${name}.git`;
+    const remote = remoteOf(repository);
+    const pushed = /* @__PURE__ */ new Map();
+    const unpushed = [];
+    let primaryHead;
+    for (const entry of claimed) {
+      let entryToken = readToken;
+      if (!entry.primary) {
+        try {
+          entryToken = await tokens.token("read", entry.repository);
+        } catch (err) {
+          return await failAll(`no read token for ${entry.repository}: ${describeCallFailure(err)}`);
+        }
+      }
+      const read = await (deps.readBranch ?? readBranchHead)({ remote: remoteOf(entry.repository), dir: scratch, branch: entry.branch, token: entryToken });
+      if (read.kind === "unreadable") return await failAll(`the branch ${entry.branch} could not be read${entry.primary ? "" : ` on ${entry.repository}`}: ${read.reason}`);
+      if (read.kind === "absent") {
+        unpushed.push(entry);
+        continue;
+      }
+      pushed.set(entry.repository, entry.branch);
+      if (entry.primary) primaryHead = read.sha;
+    }
+    if (pushed.size === 0) {
+      return await failAll(`the build pushed no branch: ${unpushed.map((entry) => `${entry.branch} does not exist on ${entry.repository}`).join("; ")}`);
+    }
+    const repositoriesToCheckOut = claimed;
     const limitMinutes = config.checks?.timeLimitMinutes ?? DEFAULT_CHECK_TIME_LIMIT_MINUTES;
     const minutes = `${limitMinutes} ${limitMinutes === 1 ? "minute" : "minutes"}`;
     const environmentLog = join(jobDir, "checks", "environment.log");
@@ -1130,20 +1398,33 @@ async function runHostChecks(input) {
           workdir: "/build/work",
           failed: (status) => `configuring git failed (exit ${status})`
         },
-        {
-          argv: ["git", "clone", "--filter=blob:none", "--single-branch", "--branch", branch, `https://github.com/${repository}.git`, CHECKOUT_DIR],
-          workdir: "/build/work",
-          failed: (status) => `the clone of ${branch} failed (exit ${status})`
-        }
+        ...repositoriesToCheckOut.flatMap((entry) => {
+          const branch = pushed.get(entry.repository);
+          const path = entry.primary ? CHECKOUT_DIR : repositoryPath(entry.repository);
+          const clone = {
+            argv: ["git", "clone", "--filter=blob:none", "--single-branch", ...branch === void 0 ? [] : ["--branch", branch], `https://github.com/${entry.repository}.git`, path],
+            workdir: "/build/work",
+            failed: (status) => `the clone of ${branch ?? `the default branch of ${entry.repository}`} failed (exit ${status})`
+          };
+          return entry.primary && repositoriesToCheckOut.length > 1 ? [
+            clone,
+            {
+              argv: ["sh", "-c", 'mkdir -p "$(dirname "$1")" && ln -s "$2" "$1"', "link", repositoryPath(entry.repository), CHECKOUT_DIR],
+              workdir: "/build/work",
+              failed: (status) => `linking ${entry.repository} at ${repositoryPath(entry.repository)} failed (exit ${status})`
+            }
+          ] : [clone];
+        })
       ];
       for (const step of steps) {
         if (abandoned) return "the check environment setup ran out of time";
         const ran = await made.exec(step.argv, step.workdir, { logPath: environmentLog });
         if (ran.status !== 0) return `the check environment could not be prepared: ${step.failed(ran.status)}`;
       }
+      const lifecycleDir = lifecycleWorkdir(repositoriesToCheckOut, (job.container ?? job.microvm)?.governing?.repository);
       for (const step of lifecycleSteps((job.container ?? job.microvm)?.lifecycle ?? {})) {
         log.line(`${tag} checks lifecycle ${step.name} (${step.source})`);
-        const ran = await made.exec(step.argv, CHECKOUT_DIR, { logPath: environmentLog });
+        const ran = await made.exec(step.argv, lifecycleDir, { logPath: environmentLog });
         if (ran.status !== 0) return `the check environment could not be prepared: ${lifecycleFailureReason(step, ran.status)}`;
       }
       return made;
@@ -1172,7 +1453,7 @@ async function runHostChecks(input) {
         scratch,
         remote,
         readToken,
-        branchHead: read.sha,
+        branchHead: primaryHead ?? (job.container ?? job.microvm)?.startCommit ?? "",
         transcripts,
         scrub: transcriptScrub(config, [config.apiKey, job.itemKey, readToken]),
         readWorkItem: () => readWorkItem(config, job.item, deps.fetchImpl),
@@ -1239,6 +1520,296 @@ async function runHostChecks(input) {
   }
 }
 
+// src/runner/judge-verdict.ts
+function mechanicalFailures(criteria, citations) {
+  return criteria.filter((criterion) => criterion.proof === null && (citations[criterion.id]?.length ?? 0) === 0).map((criterion) => criterion.id);
+}
+function firstLine2(text2) {
+  return text2.trim().split(/\r\n|\r|\n/)[0]?.trim() ?? "";
+}
+function parseOutput(stdout) {
+  try {
+    const parsed = JSON.parse(stdout);
+    if (typeof parsed !== "object" || parsed === null) return void 0;
+    const { subtype, result } = parsed;
+    return { subtype: typeof subtype === "string" ? subtype : void 0, result: typeof result === "string" ? result : "" };
+  } catch {
+    return void 0;
+  }
+}
+var RESULT_LINE = /^result:\s*(pass|fail)\s*$/i;
+var UNMET_LINE = /^unmet:\s*(\S+)\s*$/i;
+function decideVerdict(input) {
+  const { run, criteria } = input;
+  if (run.kind === "timeout") return { result: "fail", reason: `the judge ran out of time after ${input.minutes}`, limitKey: true };
+  const output = parseOutput(run.stdout);
+  if (output === void 0) {
+    const said = firstLine2(run.stderr);
+    return { result: "fail", reason: `the judge exited ${run.status} and printed no result${said === "" ? "" : `: ${said}`}` };
+  }
+  if (output.subtype === "error_max_turns") return { result: "fail", reason: `the judge reached the turn limit of ${JUDGE_MAX_TURNS} turns before it gave a result` };
+  const lines = output.result.split(/\r\n|\r|\n/).map((line) => line.trim()).filter((line) => line !== "");
+  const verdict = RESULT_LINE.exec(lines.at(-1) ?? "")?.[1]?.toLowerCase();
+  if (verdict === void 0) return { result: "fail", reason: "the judge gave no `result:` line" };
+  const named = new Set(lines.flatMap((line) => UNMET_LINE.exec(line)?.[1] ?? []));
+  const mechanical = new Set(mechanicalFailures(criteria, input.citations));
+  const unmet = criteria.map((criterion) => criterion.id).filter((id) => named.has(id) || mechanical.has(id));
+  if (verdict === "pass" && unmet.length === 0) return { result: "pass" };
+  const ruled = unmet.filter((id) => mechanical.has(id));
+  const rule = ruled.length === 0 ? "" : `: the mechanical rule found no proof annotation and no citing test for ${ruled.join(", ")}`;
+  if (unmet.length === 0) return { result: "fail", reason: "the judge failed the change and named no criterion" };
+  return { result: "fail", reason: `${unmet.length} of ${criteria.length} criteria not satisfied, first ${unmet[0]}${rule}` };
+}
+
+// src/runner/judge.ts
+var LIMIT_KEY_TAIL2 = " (runner.checks.timeLimitMinutes)";
+var MAX_DIFF_BYTES = 4 * 1024 * 1024;
+var MAX_TEST_FILES = 2e4;
+var MAX_TEST_FILE_BYTES = 1024 * 1024;
+var NO_CLAUDE = "the image has no Claude Code for the judge";
+var REPORT_CAPTION = "The host's criteria judge, each criterion judged against the test that cites it";
+async function loadCitationFinder() {
+  return await import(pathToFileURL(join(resolvePackRoot(), "template", "build", "scripts", "criterion-citations.mjs")).href);
+}
+function testFilesIn(root, isTest, limits = { files: MAX_TEST_FILES, bytes: MAX_TEST_FILE_BYTES }) {
+  const files = [];
+  const walk = (dir, prefix) => {
+    for (const name of readdirSync(dir).sort()) {
+      if (files.length >= limits.files) return;
+      if (prefix === "" && name === ".git") continue;
+      const path = join(dir, name);
+      const rel = prefix === "" ? name : `${prefix}/${name}`;
+      const stat = lstatSync(path);
+      if (stat.isDirectory()) walk(path, rel);
+      else if (stat.isFile() && isTest.test(rel) && stat.size <= limits.bytes) files.push({ path: rel, contents: readFileSync(path, "utf8") });
+    }
+  };
+  walk(root, "");
+  return files;
+}
+async function hostPassedNames(config, item, fetchImpl) {
+  const workItemId = Object(await readWorkItem(config, item, fetchImpl)).workItemId;
+  if (typeof workItemId !== "string") throw new WorkCommandError("the work item read named no id");
+  const signer = await signerFor(config.configPath);
+  const latest = /* @__PURE__ */ new Map();
+  let since = null;
+  do {
+    const query = since === null ? "" : `?since=${encodeURIComponent(since)}`;
+    const page = await getJson(config.url, `/v1/work-items/${encodeURIComponent(workItemId)}/changes${query}`, config.apiKey, config.appId, fetchImpl, signer);
+    for (const entry of Array.isArray(page.data) ? page.data : []) {
+      const { name, result, source } = Object(entry);
+      if (source === "host" && typeof name === "string" && typeof result === "string") latest.set(name, result);
+    }
+    since = page.pagination?.cursor ?? null;
+  } while (since !== null);
+  return [...latest].filter(([, result]) => result === "pass").map(([name]) => name);
+}
+function criteriaOf(workItem) {
+  const criteria = Object(Object(workItem).criteria);
+  if (!Array.isArray(criteria?.items)) return void 0;
+  const drafted = criteria.drafted === true;
+  const items = [];
+  for (const entry of criteria.items) {
+    const { id, text: text2, proof } = Object(entry);
+    if (typeof id !== "string" || typeof text2 !== "string") continue;
+    items.push({ id, text: text2, proof: typeof proof === "string" ? proof : null, drafted });
+  }
+  return items.length === 0 ? void 0 : items;
+}
+function environmentFor(input) {
+  const { config, job, jobDir, deps } = input;
+  if (deps.judgeEnvironment !== void 0) return deps.judgeEnvironment;
+  if (job.container !== void 0) return containerJudgeEnvironment({ runtime: deps.runtime, config, job, jobDir });
+  if (job.microvm !== void 0) return microVmJudgeEnvironment({ runtime: deps.runtime, job, jobDir });
+  return void 0;
+}
+async function runJudge(input) {
+  const { config, job, jobDir, deps } = input;
+  const { runtime, log } = deps;
+  const tag = `#${job.item}`;
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const repository = job.repository ?? job.container?.repository;
+  if (repository === void 0) return;
+  const repo = repository;
+  const tokens = runtime.credentials.get(jobDir);
+  let readToken;
+  try {
+    readToken = await tokens?.token("read");
+  } catch (err) {
+    log.error(`${tag} no read token for the judge: ${describeCallFailure(err)}`);
+  }
+  const scratch = join(jobDir, "judge-scratch");
+  rmSync(scratch, { recursive: true, force: true });
+  const definitionsDir = join(scratch, "definitions");
+  mkdirSync(definitionsDir, { recursive: true });
+  let definitions;
+  try {
+    definitions = await readDefinitions(input, repository, definitionsDir, readToken, tokens);
+  } catch (err) {
+    definitions = { ok: false, reason: describeCallFailure(err) };
+  } finally {
+    removeStagedContext(definitionsDir);
+  }
+  if (!definitions.ok) {
+    rmSync(scratch, { recursive: true, force: true });
+    log.line(`${tag} judge not run: the definitions could not be read: ${definitions.reason}`);
+    const passed = await retrySend(() => hostPassedNames(config, job.item, deps.fetchImpl), { now: deps.now });
+    if (!passed.ok) {
+      log.error(`${tag} the item's host results could not be read, so none was failed: ${passed.reason}`);
+      return;
+    }
+    const record2 = makeRecorder({ config, job, deps });
+    for (const name of passed.value) await record2(name, "fail", `the definitions could not be read: ${definitions.reason}`, { idTag: "judge-unread" });
+    return;
+  }
+  const checks = definitions.checks.filter(isJudgeCheck);
+  if (checks.length === 0) {
+    rmSync(scratch, { recursive: true, force: true });
+    return;
+  }
+  log.line(`${tag} judge started (${checks.map((check) => check.name).join(", ")})`);
+  const startedMs = now().getTime();
+  const record = makeRecorder({ config, job, deps });
+  const fail = (check, reason) => {
+    log.error(`${tag} judge failed: ${reason}`);
+    return record(check.name, "fail", reason);
+  };
+  try {
+    for (const check of checks) {
+      try {
+        await judgeOne(check);
+      } catch (err) {
+        await fail(check, `the judge could not be run: ${describeCallFailure(err)}`);
+      }
+    }
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+    log.line(`${tag} judge done (${formatDuration(now().getTime() - startedMs)})`);
+  }
+  async function judgeOne(check) {
+    const environment = environmentFor(input);
+    if (environment === void 0) return await fail(check, `${NO_CLAUDE}: this build ran outside a container or microVM`);
+    const expected = (job.container ?? job.microvm)?.judgeProgram;
+    if (expected === void 0) return await fail(check, NO_CLAUDE);
+    if (check.judge.text === void 0) return await fail(check, `the brief ${check.judge.brief} is not in the definitions repository`);
+    if (tokens === void 0) return await fail(check, "the build's repository tokens are no longer held, so the branch cannot be fetched");
+    const credential = claudeCredential(runtime.hostEnv);
+    if (credential === void 0) return await fail(check, "the host holds no Claude credential for the judge");
+    const branch = job.branch;
+    if (branch === void 0) return await fail(check, "the build pushed no branch: the claim names none");
+    const remote = runtime.remoteFor?.(repo) ?? `${runtime.github.gitUrl}/${repo}.git`;
+    try {
+      await environment.stop();
+    } catch (err) {
+      return await fail(check, `the build's processes could not be stopped: ${describeCallFailure(err)}`);
+    }
+    const hashed = await environment.hashProgram();
+    if (!hashed.ok) return await fail(check, `${NO_CLAUDE}: ${hashed.reason}`);
+    if (hashed.sha256 !== expected.sha256) return await fail(check, "the judge program changed during the build");
+    const read = await (deps.readBranch ?? readBranchHead)({ remote, dir: scratch, branch, token: readToken });
+    if (read.kind === "absent") return await fail(check, `the build pushed no branch: ${branch} does not exist on ${repo}`);
+    if (read.kind === "unreadable") return await fail(check, `the branch ${branch} could not be read: ${read.reason}`);
+    const head = read.sha;
+    let criteria;
+    try {
+      criteria = criteriaOf(await readWorkItem(config, job.item, deps.fetchImpl));
+    } catch (err) {
+      return await fail(check, `the item's criteria could not be read: ${describeCallFailure(err)}`);
+    }
+    if (criteria === void 0) return await fail(check, "no criteria are recorded for the item");
+    const branchDir = join(scratch, "branch");
+    const fetched = await (deps.fetchCommit ?? fetchCommit)({ remote, dir: branchDir, commit: head, token: readToken });
+    if (!fetched.ok) return await fail(check, `the build's tests could not be fetched: ${fetched.reason}`);
+    const finder = await loadCitationFinder();
+    const citations = finder.buildCitations({ ids: criteria.map((criterion) => criterion.id), files: testFilesIn(branchDir, finder.TEST_FILE), repository: repo, sha: head });
+    let diff = "";
+    const startCommit = (job.container ?? job.microvm)?.startCommit;
+    if (startCommit !== void 0) {
+      const output = join(scratch, "diff.patch");
+      const made = await (deps.fetchDiff ?? ((request) => diffBetween(request)))({ remote, dir: join(scratch, "diff"), base: startCommit, head, token: readToken, output });
+      if (!made.ok) return await fail(check, `the build's diff could not be read: ${made.reason}`);
+      const bytes = readFileSync(output);
+      diff = bytes.length > MAX_DIFF_BYTES ? `${bytes.subarray(0, MAX_DIFF_BYTES).toString("utf8")}
+[the diff was cut at ${MAX_DIFF_BYTES} bytes]
+` : bytes.toString("utf8");
+    }
+    await environment.prepare({
+      "criteria.json": `${JSON.stringify({ criteria }, null, 2)}
+`,
+      "citations.json": `${JSON.stringify(citations, null, 2)}
+`,
+      "diff.patch": diff
+    }, branchDir);
+    const limitMinutes = config.checks?.timeLimitMinutes ?? DEFAULT_CHECK_TIME_LIMIT_MINUTES;
+    const minutes = `${limitMinutes} ${limitMinutes === 1 ? "minute" : "minutes"}`;
+    const clear = async () => {
+      await environment.clear?.().catch((err) => log.error(`${tag} what the judge left in its folder could not be removed: ${describeCallFailure(err)}`));
+    };
+    const running = environment.run(judgeCommand({ brief: check.judge.text, credential }), { logPath: join(jobDir, "judge.log") });
+    running.catch(() => void 0);
+    const timer = timeoutAfter(limitMinutes * 6e4, deps.sleep);
+    let outcome;
+    try {
+      outcome = await Promise.race([running, timer.done]);
+    } catch (err) {
+      await clear();
+      return await fail(check, `the judge could not be run: ${describeCallFailure(err)}`);
+    } finally {
+      timer.cancel();
+    }
+    if (outcome === "timeout") await environment.stop().catch((err) => log.error(`${tag} the judge could not be stopped after its time ran out: ${describeCallFailure(err)}`));
+    const decision = decideVerdict({
+      run: outcome === "timeout" ? { kind: "timeout" } : { kind: "exited", status: outcome.status, stdout: outcome.stdout, stderr: outcome.stderr },
+      criteria,
+      citations,
+      minutes
+    });
+    let report;
+    try {
+      report = await environment.readReport();
+    } catch (err) {
+      log.error(`${tag} the judge's report could not be read: ${describeCallFailure(err)}`);
+    }
+    await clear();
+    const link = report === void 0 ? void 0 : await uploadReport(check, report, { branch, head });
+    await record(check.name, decision.result, decision.reason, { keyTail: decision.limitKey === true ? LIMIT_KEY_TAIL2 : "", link });
+  }
+  async function uploadReport(check, report, at) {
+    const bytes = Buffer.from(report, "utf8");
+    if (bytes.length === 0 || bytes.length > MAX_REPORT_BYTES) {
+      log.error(`${tag} the judge's report was not uploaded: it is ${bytes.length === 0 ? "empty" : `larger than ${MAX_REPORT_BYTES} bytes`}`);
+      return void 0;
+    }
+    const clientArtifactId = `host-judge-${createHash("sha256").update(`${job.claimId}:${job.startedAt}:${check.name}`).digest("hex").slice(0, 40)}`;
+    const request = {
+      schemaVersion: 1,
+      artifact: {
+        clientArtifactId,
+        filename: "criteria-judge-report.html",
+        mediaType: "text/html",
+        bytes: bytes.length,
+        sha256: createHash("sha256").update(bytes).digest("hex"),
+        caption: REPORT_CAPTION,
+        criterionId: check.name,
+        emittedAt: now().toISOString(),
+        repository: repo,
+        gitRepo: repo,
+        gitBranch: at.branch,
+        commitSha: at.head
+      },
+      blob: { data: bytes.toString("base64") }
+    };
+    const signer = await signerFor(config.configPath);
+    const sent = await retrySend(() => postJson(config.url, "/v1/artifacts", config.apiKey, config.appId, request, deps.fetchImpl, void 0, signer), { now: deps.now });
+    if (!sent.ok) {
+      log.error(`${tag} the judge's report could not be uploaded: ${sent.reason}`);
+      return void 0;
+    }
+    const url = sent.value.data?.url;
+    return typeof url === "string" && /^https?:\/\/\S+$/.test(url) ? url : void 0;
+  }
+}
+
 // src/runner/job.ts
 var LEASE_SECONDS = 900;
 var RENEW_INTERVAL_SECONDS = 300;
@@ -1440,6 +2011,14 @@ function transcriptScrub(config, secrets) {
 function stripUnsendableReasonChars(text2) {
   return text2.replace(/\u0000/g, "").replace(/\p{Cs}/gu, "");
 }
+function stripTerminalControls(text2) {
+  return text2.replace(/\u001b\[[0-?]*[ -\/]*[@-~]/g, "").replace(/\u001b\][^\u0007\u001b\r\n]*(?:\u0007|\u001b\\)?/g, "").replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, "");
+}
+function releaseLogFor(jobDirPath, job, config) {
+  const home = homeFromEnv();
+  installScrubContext(home, transcriptScrub(config, [job.itemKey, config.apiKey]));
+  return buildReleaseLog(jobDirPath, job.endStage, (text2) => scrubText(stripTerminalControls(stripUnsendableReasonChars(text2))));
+}
 function readReasonLine(jobDirPath, config, home = homeFromEnv()) {
   let raw;
   try {
@@ -1574,28 +2153,34 @@ async function renewLease(config, item, fetchImpl) {
 }
 var ALREADY_RELEASED = "already released";
 async function releaseLease(config, item, outcome, detail, fetchImpl) {
-  const send = async (environment2, sent2) => postJson(
+  const send = async (environment2, sent2, log2) => postJson(
     config.url,
     `/v1/work-items/${item}/claim/release`,
     config.apiKey,
     config.appId,
-    { host: config.host, outcome: sent2, stage: detail.stage, exitCode: detail.exitCode, reason: detail.reason, environment: environment2 },
+    { host: config.host, outcome: sent2, stage: detail.stage, exitCode: detail.exitCode, reason: detail.reason, environment: environment2, log: log2 },
     fetchImpl,
     void 0,
     await signerFor(config.configPath)
   );
   let environment = detail.environment;
   let sent = outcome;
+  let log = detail.log;
   let data;
   for (; ; ) {
     try {
-      ({ data } = await send(environment, sent));
+      ({ data } = await send(environment, sent, log));
       break;
     } catch (err) {
       if (!(err instanceof WorkCommandError) || err.status !== 400 || err.code !== "invalid_request_body") throw err;
       const namesOutcome = /\boutcome\b/.test(err.message);
       if (sent === "incomplete" && namesOutcome) {
         sent = "ok";
+      } else if (log !== void 0 && /\blog\b/.test(err.message)) {
+        log = void 0;
+      } else if (environment?.controlPlane !== void 0) {
+        const { controlPlane: _omittedPlane, ...withoutPlane } = environment;
+        environment = withoutPlane;
       } else if (environment?.commitIdentity !== void 0) {
         const { commitIdentity: _omitted, ...withoutIdentity } = environment;
         environment = withoutIdentity;
@@ -1689,6 +2274,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
   const jobFilePath = join(jobDirPath, "job.json");
   const logPath = join(jobDirPath, "command.log");
   const tag = `#${job.item}`;
+  deps.attemptLogs?.open(job.item, jobDirPath);
   if (job.sender !== void 0) {
     await stopSender({ job, deps: { spawnFn, runtime: deps.container, log } });
     delete job.sender;
@@ -1706,7 +2292,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     await stopProcessGroup(job.pid);
   }
   if (outcome !== void 0 && job.endStage === void 0) {
-    const TEARDOWN_STAGES = ["checks", "sync", "cleanup", "report"];
+    const TEARDOWN_STAGES = ["judge", "checks", "sync", "cleanup", "report"];
     const staleTeardownStage = job.stage !== void 0 && TEARDOWN_STAGES.includes(job.stage);
     job.endStage = ending?.stage ?? (staleTeardownStage ? job.exitCode !== void 0 ? "command" : void 0 : job.stage);
     job.endExitCode = ending?.exitCode ?? (outcome === "ok" || outcome === "failed" ? job.exitCode : void 0);
@@ -1738,6 +2324,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
       }
     }
   };
+  let buildVmStopLogged = false;
   const endBuildMicroVm = vmBuild === void 0 ? void 0 : async () => {
     if (job.workdir && job.sessionsSynced !== true) {
       await uploadSessions(job.workdir);
@@ -1745,6 +2332,8 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
       writeJobFile(jobFilePath, job);
     }
     await stopBuildMicroVm(vmBuild.runtime, vmBuild.state, jobDirPath);
+    log.line(`${tag} build microVM stopped`);
+    buildVmStopLogged = true;
   };
   const collectSessions = build !== void 0 ? () => copyTranscriptsFromContainer(build.runtime, build.state) : vmBuild !== void 0 ? () => copyTranscriptsFromMicroVm(vmBuild.runtime, vmBuild.state) : void 0;
   if (job.checkContainer !== void 0 && job.checksRan === true) {
@@ -1765,6 +2354,21 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
       log.error(`${tag} removing an earlier attempt's check environment failed: ${describeCallFailure(err)} \xB7 continuing`);
     }
   }
+  if (outcome === "ok" && !job.cleanupRan && job.judgeRan !== true) {
+    setStage(job, jobDirPath, "judge");
+    job.judgeRan = true;
+    writeJobFile(jobFilePath, job);
+    try {
+      await runJudge({
+        config,
+        job,
+        jobDir: jobDirPath,
+        deps: { fetchImpl: deps.fetchImpl, runtime: deps.container ?? createContainerRuntime(), log, now: deps.now, endBuildMicroVm, collectSessions, ...deps.hostChecks }
+      });
+    } catch (err) {
+      log.error(`${tag} the host's judge stopped: ${describeCallFailure(err)} \xB7 continuing`);
+    }
+  }
   if (outcome === "ok" && !job.cleanupRan && job.checksRan !== true) {
     setStage(job, jobDirPath, "checks");
     job.checksRan = true;
@@ -1819,6 +2423,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
         cleanedUp = false;
         log.error(`${tag} cleanup failed: ${describeCallFailure(err)} \xB7 continuing`);
       }
+      if (cleanedUp && !buildVmStopLogged) log.line(`${tag} build microVM stopped`);
       if (cleanedUp) log.line(`${tag} cleanup ok (${formatDuration(now().getTime() - cleanupStartedMs)})`);
     } else if (build !== void 0 || !hostMade && isBuiltinContainer(config.hooks.cleanup)) {
       let cleanedUp = true;
@@ -1944,6 +2549,9 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     } else if (ending?.reason === void 0) {
       job.reason = (outcome === "ok" ? void 0 : held?.reason) ?? (isolated ? fromHook ?? job.reason : fromHook);
     }
+    if (outcome === "failed" && job.reason === void 0 && job.commandEndReason !== void 0) {
+      job.reason = scrubReason(job.commandEndReason, config);
+    }
     const cliVersion = deps.cliVersion ?? resolveVersion();
     const base = job.environment ?? (job.microvm !== void 0 ? { isolation: "vm", cliVersion } : job.container === void 0 ? sharedUserEnvironment(cliVersion) : { isolation: "container", cliVersion });
     if (isolated || job.build !== void 0) {
@@ -1956,7 +2564,8 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
     writeJobFile(jobFilePath, job);
   }
   const sentAtMs = now().getTime();
-  const detail = outcome === void 0 ? {} : { stage: job.endStage, exitCode: job.endExitCode, reason: job.reason, environment: job.environment };
+  const runnerLog = releaseLogFor(jobDirPath, job, config);
+  const detail = outcome === void 0 ? { log: runnerLog } : { stage: job.endStage, exitCode: job.endExitCode, reason: job.reason, environment: job.environment, log: runnerLog };
   const release = await retrySend(() => releaseLease(config, job.item, outcome, detail, deps.fetchImpl), {
     now: deps.now,
     sleep: deps.sleep
@@ -1967,6 +2576,7 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
   job.endedAt = endedAt.toISOString();
   job.releaseFailed = release.ok ? alreadyReleased ? ALREADY_RELEASED : void 0 : release.reason;
   writeJobFile(jobFilePath, job);
+  deps.attemptLogs?.close(job.item);
   const total = formatDuration(endedAt.getTime() - new Date(job.startedAt).getTime());
   if (alreadyReleased) {
     log.line(
@@ -2012,7 +2622,8 @@ async function retryFailedReleases(jobsDirPath, config, deps) {
     if (!job || job.releaseFailed === void 0 || job.releaseFailed === ALREADY_RELEASED || isUnfinished(job)) {
       continue;
     }
-    const detail = job.outcome === void 0 ? {} : { stage: job.endStage, exitCode: job.endExitCode, reason: job.reason, environment: job.environment };
+    const runnerLog = releaseLogFor(dirPath, job, config);
+    const detail = job.outcome === void 0 ? { log: runnerLog } : { stage: job.endStage, exitCode: job.endExitCode, reason: job.reason, environment: job.environment, log: runnerLog };
     const release = await retrySend(() => releaseLease(config, job.item, job.outcome, detail, deps.fetchImpl), {
       now: deps.now,
       sleep: deps.sleep
@@ -2185,4 +2796,4 @@ async function stopSender(input) {
   }
 }
 
-export { ALREADY_RELEASED, LEASE_SECONDS, RENEW_INTERVAL_SECONDS, deliverCommitHooks, describeHookEnd, execArgv, execCommandLine, finishJob, hookLimitsFor, hostCommandEnvironment, hostEnvironment, isGroupAlive, isIdle, isTimedOut, isUnfinished, jobEnv, listAdoptableJobs, listenOnBroker, microVmCommandLine, needsRenew, outcomeFromExitCode, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, retryFailedReleases, runCommand, runHook, setStage, startHostServices, startSender, stopOrphanedMicroVms, unfinishedJobs, workdirProblem };
+export { ALREADY_RELEASED, AttemptLogBook, LEASE_SECONDS, RENEW_INTERVAL_SECONDS, deliverCommitHooks, describeHookEnd, execArgv, execCommandLine, finishJob, hookLimitsFor, hostCommandEnvironment, hostEnvironment, isGroupAlive, isIdle, isTimedOut, isUnfinished, jobEnv, listAdoptableJobs, listenOnBroker, microVmCommandLine, needsRenew, outcomeFromExitCode, provisionEnvironment, provisionMicroVm, provisionProcess, readCpuUsec, readProvisionOut, recoverLostJobs, releaseLease, renewLease, resolveHostBuild, retryFailedReleases, runCommand, runHook, setStage, startHostServices, startSender, stopOrphanedMicroVms, unfinishedJobs, workdirProblem };