@outerlayer/cli 0.32.0-next.20261020192323 → 0.32.0-next.20261020194118

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-20T19:25:22.302Z+42873e1","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-20T19:43:21.965Z+8773b66","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-IM42OERH.js → check-LKB5L6SJ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-LXQFFR5R.js';
-import './chunk-TGOKGACN.js';
+import { probeCredentials } from './chunk-ORLL2A45.js';
+import './chunk-P7RX33YS.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-WHSYPR3U.js';
 import './chunk-E7R2GIAW.js';
@@ -16,16 +16,16 @@ import './chunk-KCB6V5XH.js';
 import './chunk-XKZPL3GE.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-XTNMIV77.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-CWNAQN3P.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-NMF4EUVS.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-ZZSQYOY5.js';
 import './chunk-TBT347UY.js';
-import './chunk-ONBASD7N.js';
-import './chunk-KIGKMHGN.js';
-import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-A3T5EMLD.js';
+import './chunk-4TIZUKGG.js';
+import './chunk-C4C34DUG.js';
+import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-OYSZGHJF.js';
 import './chunk-QQGZ5THT.js';
 import './chunk-HIGJTX5U.js';
-import './chunk-MPBWMLDU.js';
+import './chunk-SXJVL7NS.js';
 import './chunk-YV7WULXQ.js';
 import './chunk-TQMI335S.js';
 import './chunk-NJS7JJYN.js';

package/dist/{chunk-ONBASD7N.js → chunk-4TIZUKGG.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-KIGKMHGN.js';
-import { MIN_ENGINE_MAJOR } from './chunk-A3T5EMLD.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-C4C34DUG.js';
+import { MIN_ENGINE_MAJOR } from './chunk-OYSZGHJF.js';
 import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-NJS7JJYN.js';
 import { runnerCredentialProblem } from './chunk-P7BEZAEU.js';
 import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-KP6R7CV3.js';

package/dist/{chunk-KIGKMHGN.js → chunk-C4C34DUG.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-A3T5EMLD.js';
+import { MIN_ENGINE_MAJOR } from './chunk-OYSZGHJF.js';
 import { runnerImageVersion } from './chunk-YV7WULXQ.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-SJZL5F3F.js';
 import { spawnSync } from 'child_process';

package/dist/{chunk-VILNOSYL.js → chunk-ITOWHQSZ.js}

@@ -1211,7 +1211,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-43GRLQBJ.js');
+    const { runnerHostChecks } = await import('./doctor-NGBSBISG.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);

package/dist/{chunk-CWNAQN3P.js → chunk-NMF4EUVS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-ONBASD7N.js';
-import { describeCallFailure } from './chunk-MPBWMLDU.js';
+import { isPlaceholderCommand } from './chunk-4TIZUKGG.js';
+import { describeCallFailure } from './chunk-SXJVL7NS.js';
 import { checkFit } from './chunk-RQGHHEM7.js';
 import { builtinKind } from './chunk-P7BEZAEU.js';
 import { WorkCommandError, getJson } from './chunk-U4HMGT3L.js';

package/dist/{chunk-LXQFFR5R.js → chunk-ORLL2A45.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-TGOKGACN.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, MICROVM_COMMAND_DIR, commandLogOffset, startMicroVmCommand, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, isMicroVmTracked, probeMicroVmCommand, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isTracked, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listUnreadableJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, microVmOomKills, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, serveLease, vmAlive, writeGuestGhConfig, ALREADY_RELEASED, inTeardown } from './chunk-P7RX33YS.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fitImageBuildMemory } from './chunk-WHSYPR3U.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-E7R2GIAW.js';
@@ -8,12 +8,12 @@ import { RUNNER_PROTOCOL } from './chunk-WRU3K5AN.js';
 import { writePendingUpdate } from './chunk-TZQIEUDE.js';
 import { JOB_STATE_FORMAT, readsJobState, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-X7UUIHGH.js';
-import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-CWNAQN3P.js';
+import { currentSkillCommand, formerSkillProblem, realBlockedProbes, checkBlocked } from './chunk-NMF4EUVS.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, isInLayout, cleanVersions, stagingDir } from './chunk-ZZSQYOY5.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-A3T5EMLD.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-MPBWMLDU.js';
+import { leaseTimeLeftMs, createContainerRuntime, withTunnelLog, LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, setUpRunnerCgroup, measureDisk, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied, gitRemoteFor, startServicesFor, createLeaseChannel } from './chunk-OYSZGHJF.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-SXJVL7NS.js';
 import { tagToPull, pullInstruction, imageTag, writeUpdateStatus } from './chunk-YV7WULXQ.js';
 import { isVersion, compareVersions, satisfiesRange } from './chunk-TQMI335S.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-P7BEZAEU.js';
@@ -2932,7 +2932,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-IM42OERH.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-LKB5L6SJ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log

package/dist/{chunk-A3T5EMLD.js → chunk-OYSZGHJF.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { execCapture } from './chunk-QQGZ5THT.js';
 import { GUEST_CID } from './chunk-HIGJTX5U.js';
-import { keepStagedContext, describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-MPBWMLDU.js';
+import { keepStagedContext, describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-SXJVL7NS.js';
 import { runnerImageVersion } from './chunk-YV7WULXQ.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-Z7HAIZ6X.js';
@@ -2684,7 +2684,6 @@ var RELAY_ATTEMPTS = 20;
 var RELAY_WAIT_MS = 500;
 var BUSY_IMAGE_WAIT_MS = 5e3;
 var VOLUME_REMOVE_ATTEMPTS = 4;
-var WORKFLOW_PERMISSION_REASON = "workflow_permission_required";
 function withTunnelLog(opts, log) {
   return { ...opts, tunnelOptions: { log, ...opts?.tunnelOptions } };
 }

package/dist/{chunk-TGOKGACN.js → chunk-P7RX33YS.js}

@@ -6,10 +6,10 @@ import { zodProblem } from './chunk-I3LTIAOR.js';
 import { senderPidfile } from './chunk-JFLVUA43.js';
 import { installScrubContext } from './chunk-KCB6V5XH.js';
 import { writeDockerClientConfig } from './chunk-XTNMIV77.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-A3T5EMLD.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, helperFirecrackerNote, HelperRefusal, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-OYSZGHJF.js';
 import { waitForAgent, vmExecArgs } from './chunk-QQGZ5THT.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-HIGJTX5U.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree } from './chunk-MPBWMLDU.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, WORKFLOW_PERMISSION_REASON, keptContextTree } from './chunk-SXJVL7NS.js';
 import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-P7BEZAEU.js';
 import { readBranchHead, fetchCommit, diffBetween } from './chunk-Z7HAIZ6X.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
@@ -1378,6 +1378,9 @@ function decideFromEvaluation(read) {
 function incompleteReason(reason, judgeNotRun) {
   return judgeNotRun === void 0 ? reason : `the judge did not run (${judgeNotRun}) \xB7 ${reason}`;
 }
+function unfinishedRelease(verdictReason, learned) {
+  return learned === WORKFLOW_PERMISSION_REASON ? { outcome: "failed", reason: WORKFLOW_PERMISSION_REASON } : { outcome: "incomplete", reason: verdictReason };
+}
 function waitMs(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -3229,8 +3232,12 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
       sleep: deps.sleep ?? waitMs
     });
     if (decision.outcome === "incomplete") {
-      outcome = "incomplete";
-      verdictReason = scrubReason(incompleteReason(decision.reason, job.judgeNotRun), config);
+      const release2 = unfinishedRelease(
+        scrubReason(incompleteReason(decision.reason, job.judgeNotRun), config),
+        deps.container?.credentials.get(jobDirPath)?.reason
+      );
+      outcome = release2.outcome;
+      verdictReason = release2.reason;
       log.error(`${tag} the command exited 0 but the item is not done: ${verdictReason}`);
     }
   }

package/dist/{chunk-MPBWMLDU.js → chunk-SXJVL7NS.js}

@@ -107,6 +107,7 @@ var REVOKE_TIMEOUT_MS = 15e3;
 function isDue(expiresAtMs, nowMs) {
   return nowMs >= expiresAtMs - 10 * 6e4;
 }
+var WORKFLOW_PERMISSION_REASON = "workflow_permission_required";
 function classifyRefusal(err) {
   if (!(err instanceof WorkCommandError)) return { kind: "retry" };
   if (err.status === 401 || err.code === "claim_expired" || err.code === "claim_not_held") return { kind: "lease_lost" };
@@ -515,4 +516,4 @@ async function imageTargetFor(input) {
   return { ok: true, repository: resolved.source.repository, pinned: { commit: resolved.source.sha, ref: resolved.source.ref } };
 }
 
-export { BuildTokens, classifyRefusal, commandWithShim, controlPlaneTokenFailure, createRunnerLog, describeCallFailure, formatClock, formatDuration, imageTargetFor, keepStagedContext, keptContextTree, logStamp, pinnedSourceOf, refusalCode, relativeToRunner, removeKeptContext, removeStagedContext, resolveGoverningSource, retrySend, shimScript, shortClaim, stageGovernedContext };
+export { BuildTokens, WORKFLOW_PERMISSION_REASON, classifyRefusal, commandWithShim, controlPlaneTokenFailure, createRunnerLog, describeCallFailure, formatClock, formatDuration, imageTargetFor, keepStagedContext, keptContextTree, logStamp, pinnedSourceOf, refusalCode, relativeToRunner, removeKeptContext, removeStagedContext, resolveGoverningSource, retrySend, shimScript, shortClaim, stageGovernedContext };

package/dist/{cli-27XGLDZJ.js → cli-C6PUAMNE.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-VILNOSYL.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-ITOWHQSZ.js';
 import './chunk-BCWVTWS7.js';
 import './chunk-4XPAQXJF.js';
 import './chunk-KT4CN6OU.js';
@@ -3926,13 +3926,13 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-LXPYD2JM.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-KD2XQYAL.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + skillsLine + (shell?.text ?? ""));
       return;
     }
     await installMachineSkillsForSetup();
-    const { runInitCommand } = await import('./init-cmd-LXPYD2JM.js');
+    const { runInitCommand } = await import('./init-cmd-KD2XQYAL.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -4978,7 +4978,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-3JRFDYZL.js');
-    const { start, RunnerStartError } = await import('./loop-TU67Q3TS.js');
+    const { start, RunnerStartError } = await import('./loop-O5L6X3EM.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-BMFAUQAI.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -4997,8 +4997,8 @@ function registerRunnerCommands(program2) {
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-3JRFDYZL.js');
-    const { containerStart } = await import('./container-start-DHWE6AZT.js');
-    const { start, RunnerStartError } = await import('./loop-TU67Q3TS.js');
+    const { containerStart } = await import('./container-start-7I7AVIZB.js');
+    const { start, RunnerStartError } = await import('./loop-O5L6X3EM.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-BMFAUQAI.js');
     try {
       const result = await containerStart({
@@ -5018,7 +5018,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-3JRFDYZL.js');
-    const { runRunnerCheck } = await import('./check-IM42OERH.js');
+    const { runRunnerCheck } = await import('./check-LKB5L6SJ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -5052,7 +5052,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-4FSYHKJW.js');
+        const { installServiceCommand } = await import('./command-OUIWHVFD.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -5108,7 +5108,7 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       return;
     }
     const { defaultRunnerConfigPath } = await import('./config-3JRFDYZL.js');
-    const { uninstallServiceCommand } = await import('./command-4FSYHKJW.js');
+    const { uninstallServiceCommand } = await import('./command-OUIWHVFD.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -5136,10 +5136,10 @@ already in claude.env is used.
 `
   ).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-3JRFDYZL.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-UEPORNAG.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-WBXZQ4LO.js');
-    const { detectMachine } = await import('./machine-TPWIXJ37.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-TPCLCJKI.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-5BSNNTP2.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-SQBHTUGH.js');
+    const { detectMachine } = await import('./machine-2PKCFQN7.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-6FHIUU4M.js');
     const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-66RAFIDJ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
@@ -5290,7 +5290,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-4FSYHKJW.js');
+        const { installServiceCommand } = await import('./command-OUIWHVFD.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5354,7 +5354,7 @@ Next:
       await ensureRunnerIdentity(configPath, { log: (line) => console.error(line) }).catch((err) => {
         console.error(`the runner's Docker identity could not be stored: ${err instanceof Error ? err.message : String(err)}`);
       });
-      const { imageTargetFor } = await import('./governing-source-QESDNFMZ.js');
+      const { imageTargetFor } = await import('./governing-source-JSYW4RCL.js');
       const target = await imageTargetFor({ config: loaded, repository: opts.repository, fetchImpl: fetch });
       if (!target.ok) {
         if (opts.json) {
@@ -5418,7 +5418,7 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-3JRFDYZL.js');
-    const { requestStop } = await import('./loop-TU67Q3TS.js');
+    const { requestStop } = await import('./loop-O5L6X3EM.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-OYT7UG7Y.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
@@ -5426,8 +5426,8 @@ Next:
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-3JRFDYZL.js');
     const { jobsDir, runnerDir } = await import('./paths-OK2EZS7W.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-TU67Q3TS.js');
-    const { renderStatus } = await import('./status-NEKJ4HJP.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-O5L6X3EM.js');
+    const { renderStatus } = await import('./status-AMA4IOL4.js');
     const { readHousekeepingRecord } = await import('./record-26AH6WDB.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5487,7 +5487,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-3JRFDYZL.js');
-    const { listJobFiles } = await import('./loop-TU67Q3TS.js');
+    const { listJobFiles } = await import('./loop-O5L6X3EM.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-C3RJ3ZTC.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);

package/dist/{command-4FSYHKJW.js → command-OUIWHVFD.js}

@@ -3,11 +3,11 @@ import { createRequire } from 'node:module';
 import { runRunnerInstall, launcherSummary, restartNote } from './chunk-77F7NGAZ.js';
 import './chunk-ZBN4JGTJ.js';
 import { currentLink, execStartCommand } from './chunk-ZZSQYOY5.js';
-import { detectMachine } from './chunk-KIGKMHGN.js';
-import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-A3T5EMLD.js';
+import { detectMachine } from './chunk-C4C34DUG.js';
+import { helperSocketPath, ensureFirecrackerAndJailer } from './chunk-OYSZGHJF.js';
 import './chunk-QQGZ5THT.js';
 import './chunk-HIGJTX5U.js';
-import './chunk-MPBWMLDU.js';
+import './chunk-SXJVL7NS.js';
 import './chunk-YV7WULXQ.js';
 import './chunk-TQMI335S.js';
 import { DEFAULT_UNIT_NAME, installService, uninstallService, realTaskScheduler, UNIT_MARKER } from './chunk-RQGHHEM7.js';

package/dist/{container-start-DHWE6AZT.js → container-start-7I7AVIZB.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { BUILD_MEMORY_VARIABLE } from './chunk-WHSYPR3U.js';
-import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-ONBASD7N.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-KIGKMHGN.js';
-import { MIN_ENGINE_MAJOR } from './chunk-A3T5EMLD.js';
+import { RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-4TIZUKGG.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker } from './chunk-C4C34DUG.js';
+import { MIN_ENGINE_MAJOR } from './chunk-OYSZGHJF.js';
 import './chunk-QQGZ5THT.js';
 import './chunk-HIGJTX5U.js';
-import './chunk-MPBWMLDU.js';
+import './chunk-SXJVL7NS.js';
 import { runnerImageVersion, IMAGE_VERSION_VARIABLE } from './chunk-YV7WULXQ.js';
 import './chunk-TQMI335S.js';
 import { isAgentName, AGENT_COMMANDS } from './chunk-NJS7JJYN.js';

package/dist/{doctor-43GRLQBJ.js → doctor-NGBSBISG.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { needsClaudeCredential, claudeCredentialCheck, managedProblems, missingPermissionOf, missingPermissionFix } from './chunk-CWNAQN3P.js';
+import { needsClaudeCredential, claudeCredentialCheck, managedProblems, missingPermissionOf, missingPermissionFix } from './chunk-NMF4EUVS.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { launcherCheck } from './chunk-ZBN4JGTJ.js';
 import './chunk-ZZSQYOY5.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import './chunk-ONBASD7N.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-KIGKMHGN.js';
-import { MIN_ENGINE_MAJOR, helperFirecrackerNote, probeHelper, helperSocketPath } from './chunk-A3T5EMLD.js';
+import './chunk-4TIZUKGG.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-C4C34DUG.js';
+import { MIN_ENGINE_MAJOR, helperFirecrackerNote, probeHelper, helperSocketPath } from './chunk-OYSZGHJF.js';
 import './chunk-QQGZ5THT.js';
 import './chunk-HIGJTX5U.js';
-import './chunk-MPBWMLDU.js';
+import './chunk-SXJVL7NS.js';
 import { runnerImageVersion, imageAdvice, readUpdateStatus, imageTag, pullInstruction } from './chunk-YV7WULXQ.js';
 import './chunk-TQMI335S.js';
 import './chunk-NJS7JJYN.js';

package/dist/{governing-source-QESDNFMZ.js → governing-source-JSYW4RCL.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { imageTargetFor, pinnedSourceOf, resolveGoverningSource } from './chunk-MPBWMLDU.js';
+export { imageTargetFor, pinnedSourceOf, resolveGoverningSource } from './chunk-SXJVL7NS.js';
 import './chunk-U4HMGT3L.js';
 import './chunk-3DSC2FN3.js';
 import './chunk-IGIGNYZK.js';

package/dist/index.js

@@ -26,5 +26,5 @@ if (argv[0] === "claude") {
   process.exit(await runClaudeLauncher(argv.slice(1)));
 }
 (await import('./hook-fast-UFHR6EKZ.js')).recordLinkExitFailure(argv);
-var { runCli } = await import('./cli-27XGLDZJ.js');
+var { runCli } = await import('./cli-C6PUAMNE.js');
 await runCli(process.argv);

package/dist/{init-UEPORNAG.js → init-5BSNNTP2.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-ONBASD7N.js';
-import './chunk-KIGKMHGN.js';
-import './chunk-A3T5EMLD.js';
+export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-4TIZUKGG.js';
+import './chunk-C4C34DUG.js';
+import './chunk-OYSZGHJF.js';
 import './chunk-QQGZ5THT.js';
 import './chunk-HIGJTX5U.js';
-import './chunk-MPBWMLDU.js';
+import './chunk-SXJVL7NS.js';
 import './chunk-YV7WULXQ.js';
 import './chunk-TQMI335S.js';
 import './chunk-NJS7JJYN.js';

package/dist/{init-TPCLCJKI.js → init-6FHIUU4M.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { npmSupportsProvenance } from './chunk-E7R2GIAW.js';
-import { RunnerInitError, readConfigObject } from './chunk-ONBASD7N.js';
-import './chunk-KIGKMHGN.js';
-import './chunk-A3T5EMLD.js';
+import { RunnerInitError, readConfigObject } from './chunk-4TIZUKGG.js';
+import './chunk-C4C34DUG.js';
+import './chunk-OYSZGHJF.js';
 import './chunk-QQGZ5THT.js';
 import './chunk-HIGJTX5U.js';
-import './chunk-MPBWMLDU.js';
+import './chunk-SXJVL7NS.js';
 import './chunk-YV7WULXQ.js';
 import './chunk-TQMI335S.js';
 import './chunk-NJS7JJYN.js';

package/dist/{init-cmd-LXPYD2JM.js → init-cmd-KD2XQYAL.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { summarizeChecks, summaryText, renderDoctorText } from './chunk-VILNOSYL.js';
+import { summarizeChecks, summaryText, renderDoctorText } from './chunk-ITOWHQSZ.js';
 import './chunk-BCWVTWS7.js';
 import { shellFunctionInstalled, removeShellFunction, installShellFunction, SHELL_FUNCTION_LINE } from './chunk-CJJDJ7AT.js';
 import './chunk-4XPAQXJF.js';

package/dist/{loop-TU67Q3TS.js → loop-O5L6X3EM.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, start, tick, watchTick } from './chunk-LXQFFR5R.js';
-import './chunk-TGOKGACN.js';
+export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, start, tick, watchTick } from './chunk-ORLL2A45.js';
+import './chunk-P7RX33YS.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-WHSYPR3U.js';
 import './chunk-E7R2GIAW.js';
@@ -16,16 +16,16 @@ import './chunk-KCB6V5XH.js';
 import './chunk-XKZPL3GE.js';
 import './chunk-ESVW4MJY.js';
 import './chunk-XTNMIV77.js';
-import './chunk-CWNAQN3P.js';
+import './chunk-NMF4EUVS.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-ZZSQYOY5.js';
 import './chunk-TBT347UY.js';
-import './chunk-ONBASD7N.js';
-import './chunk-KIGKMHGN.js';
-import './chunk-A3T5EMLD.js';
+import './chunk-4TIZUKGG.js';
+import './chunk-C4C34DUG.js';
+import './chunk-OYSZGHJF.js';
 import './chunk-QQGZ5THT.js';
 import './chunk-HIGJTX5U.js';
-import './chunk-MPBWMLDU.js';
+import './chunk-SXJVL7NS.js';
 import './chunk-YV7WULXQ.js';
 import './chunk-TQMI335S.js';
 import './chunk-NJS7JJYN.js';

package/dist/{machine-TPWIXJ37.js → machine-2PKCFQN7.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-KIGKMHGN.js';
-import './chunk-A3T5EMLD.js';
+export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-C4C34DUG.js';
+import './chunk-OYSZGHJF.js';
 import './chunk-QQGZ5THT.js';
 import './chunk-HIGJTX5U.js';
-import './chunk-MPBWMLDU.js';
+import './chunk-SXJVL7NS.js';
 import './chunk-YV7WULXQ.js';
 import './chunk-TQMI335S.js';
 import './chunk-UXYLWVTQ.js';

package/dist/{runner-key-WBXZQ4LO.js → runner-key-SQBHTUGH.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readConfigObject, RunnerInitError } from './chunk-ONBASD7N.js';
-import './chunk-KIGKMHGN.js';
-import './chunk-A3T5EMLD.js';
+import { readConfigObject, RunnerInitError } from './chunk-4TIZUKGG.js';
+import './chunk-C4C34DUG.js';
+import './chunk-OYSZGHJF.js';
 import './chunk-QQGZ5THT.js';
 import './chunk-HIGJTX5U.js';
-import './chunk-MPBWMLDU.js';
+import './chunk-SXJVL7NS.js';
 import './chunk-YV7WULXQ.js';
 import './chunk-TQMI335S.js';
 import './chunk-NJS7JJYN.js';

package/dist/{status-NEKJ4HJP.js → status-AMA4IOL4.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-TGOKGACN.js';
+import { isReadable, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-P7RX33YS.js';
 import { jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import './chunk-RJYKTWUP.js';
 import './chunk-I3LTIAOR.js';
@@ -11,10 +11,10 @@ import './chunk-ESVW4MJY.js';
 import './chunk-XTNMIV77.js';
 import { formatBytes } from './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import { LEASE_SECONDS } from './chunk-A3T5EMLD.js';
+import { LEASE_SECONDS } from './chunk-OYSZGHJF.js';
 import './chunk-QQGZ5THT.js';
 import './chunk-HIGJTX5U.js';
-import { formatDuration, formatClock, relativeToRunner } from './chunk-MPBWMLDU.js';
+import { formatDuration, formatClock, relativeToRunner } from './chunk-SXJVL7NS.js';
 import { pullInstruction } from './chunk-YV7WULXQ.js';
 import './chunk-TQMI335S.js';
 import './chunk-P7BEZAEU.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outerlayer/cli",
-  "version": "0.32.0-next.20261020192323",
+  "version": "0.32.0-next.20261020194118",
   "description": "OuterLayer CLI — commands: init, claude, connect, doctor, login, logout, sync, daemon (alias: watch), emit, findings, work, spec, runner, hooks, mcp, context. Capture and sync coding-agent sessions, and record proof of factory work.",
   "license": "Apache-2.0",
   "author": "Magu Studios, Inc.",

package/skill-pack/maintained/outerlayer-build/SKILL.md

@@ -279,7 +279,11 @@ Run them in order.
 3. **Implement.** Run `outerlayer emit step "Implement" --item "$OUTERLAYER_WORK"`,
    then apply the team's changes for this phase. When `OUTERLAYER_BRANCH` is set, as it is in a host's
    build, work on that branch, checking it out if it is not current, and
-   push only to it: the host refuses a push to any other branch. Otherwise
+   push only to it: the host refuses a push to any other branch. When GitHub
+   refuses a push that changes a file under `.github/workflows/`, push it
+   under no other identity. Stop, and say in the final report that the
+   repository's default branch must set `build.workflows: allow` in
+   `.outerlayer/policy.yaml`. Otherwise
    branch `feat/<slug>` from the default branch, with the branch prefix setting in place of `feat/`. Spawn the implementer with the Implementer brief from
    [references/agent-briefs.md](references/agent-briefs.md), the issue, the
    drafted criteria with their ids when the build drafted them, the branch