@outerlayer/cli 0.34.0-next.20261024123749 → 0.34.0-next.20261024174615

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-24T12:39:11.572Z+879b236","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-24T17:47:37.980Z+5ab4e80","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-S6S7XIUP.js → check-K4I4EBEK.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-LW254XRN.js';
+import { probeCredentials } from './chunk-DFLHVTXI.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-PBIYM2Z6.js';
 import './chunk-E7R2GIAW.js';

package/dist/{chunk-LW254XRN.js → chunk-DFLHVTXI.js}

@@ -2842,7 +2842,7 @@ async function watchTick(state, active, nowMs, logMtimeMs) {
     await endJob(state, active, "idle");
   }
 }
-async function probeCredentials(config, fetchImpl = fetch) {
+async function probeCredentials(config, fetchImpl = fetch, keySource = "config") {
   try {
     await listStartable(config, config.queues[0] ?? "implement", fetchImpl);
     return { ok: true };
@@ -2859,10 +2859,12 @@ async function probeCredentials(config, fetchImpl = fetch) {
       };
     }
     if (status === 401 || status === 403) {
+      const source = keySource === "variable" ? "the OUTERLAYER_API_KEY variable" : `apiKey in ${config.configPath}`;
+      const cause = status === 401 ? `the gateway does not accept the API key (401): it is wrong, revoked or deleted.` : `the API key was refused (403). A runner key needs git.read and work.read to list and read work items, and work.claim to claim, renew and release.`;
       return {
         ok: false,
         fatal: true,
-        reason: `${config.configPath}: the API key was refused (${status}). A runner key needs git.read and work.read to list and read work items, and work.claim to claim, renew and release.`,
+        reason: `${config.configPath}: ${cause} The key came from ${source}.`,
         status,
         code
       };
@@ -3130,7 +3132,7 @@ async function startRunner(configPath, deps, startup) {
       check: update.check ? () => update.check(configPath) : async () => {
         const held = heldClaudeCredential();
         const env = held === void 0 ? process.env : { ...process.env, [held.variable]: held.value };
-        return (await import('./check-S6S7XIUP.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
+        return (await import('./check-K4I4EBEK.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl, env });
       },
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
@@ -3161,7 +3163,7 @@ async function startRunner(configPath, deps, startup) {
     }).catch((err) => log.error(`the runner's Docker identity could not be stored: ${describeCallFailure(err)} \xB7 using the names its folder's path gives`));
   }
   check = "credentials";
-  const probe = await probeCredentials(config, deps.fetchImpl);
+  const probe = await probeCredentials(config, deps.fetchImpl, deps.image === void 0 ? "config" : "variable");
   if (!probe.ok && probe.fatal) {
     probeRefusal = { status: probe.status, code: probe.code };
     throw new RunnerStartError(probe.reason);

package/dist/{cli-RL2R7YTM.js → cli-KDAKXVVE.js}

@@ -5109,7 +5109,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-WRHQDGVI.js');
-    const { start, RunnerStartError } = await import('./loop-VC3EE3RK.js');
+    const { start, RunnerStartError } = await import('./loop-E4YJ6BLL.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-5UDLYPMC.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -5128,8 +5128,8 @@ function registerRunnerCommands(program2) {
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-WRHQDGVI.js');
-    const { containerStart } = await import('./container-start-7QFR3JWO.js');
-    const { start, RunnerStartError } = await import('./loop-VC3EE3RK.js');
+    const { containerStart } = await import('./container-start-V5WVSWAB.js');
+    const { start, RunnerStartError } = await import('./loop-E4YJ6BLL.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-5UDLYPMC.js');
     try {
       const result = await containerStart({
@@ -5149,7 +5149,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-WRHQDGVI.js');
-    const { runRunnerCheck } = await import('./check-S6S7XIUP.js');
+    const { runRunnerCheck } = await import('./check-K4I4EBEK.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -5549,7 +5549,7 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-WRHQDGVI.js');
-    const { requestStop } = await import('./loop-VC3EE3RK.js');
+    const { requestStop } = await import('./loop-E4YJ6BLL.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-ADSLWXBA.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
@@ -5557,7 +5557,7 @@ Next:
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-WRHQDGVI.js');
     const { jobsDir, runnerDir } = await import('./paths-7HVTDE6J.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-VC3EE3RK.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-E4YJ6BLL.js');
     const { renderStatus } = await import('./status-6ISCZDBX.js');
     const { readHousekeepingRecord } = await import('./record-PPZEXAVA.js');
     const path2 = await import('path');
@@ -5618,7 +5618,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-WRHQDGVI.js');
-    const { listJobFiles } = await import('./loop-VC3EE3RK.js');
+    const { listJobFiles } = await import('./loop-E4YJ6BLL.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-HI46FO6Z.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);

package/dist/{container-start-7QFR3JWO.js → container-start-V5WVSWAB.js}

@@ -215,7 +215,7 @@ async function containerStart(deps) {
     const different = disagreements(stored, env);
     if (different.length > 0) {
       return refuse(
-        `the config in the volume and the container's variables disagree, so the runner does not start:
+        `the config in the volume (${configPath}) and the container's variables disagree, so the runner does not start:
   ${different.join("\n  ")}
 Change the variables to match the volume, or use a new volume to make a new runner.`
       );

package/dist/index.js

@@ -26,5 +26,5 @@ if (argv[0] === "claude") {
   process.exit(await runClaudeLauncher(argv.slice(1)));
 }
 (await import('./hook-fast-WENTLDMA.js')).recordLinkExitFailure(argv);
-var { runCli } = await import('./cli-RL2R7YTM.js');
+var { runCli } = await import('./cli-KDAKXVVE.js');
 await runCli(process.argv);

package/dist/{loop-VC3EE3RK.js → loop-E4YJ6BLL.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, sampleUsage, start, tick, watchTick } from './chunk-LW254XRN.js';
+export { RunnerStartError, leaseTimeLeftFor, listJobFiles, logUnusableHelper, probeBuild, probeCredentials, requestStop, runnerProcessState, runtimeOf, sampleUsage, start, tick, watchTick } from './chunk-DFLHVTXI.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-PBIYM2Z6.js';
 import './chunk-E7R2GIAW.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outerlayer/cli",
-  "version": "0.34.0-next.20261024123749",
+  "version": "0.34.0-next.20261024174615",
   "description": "OuterLayer CLI — commands: init, claude, connect, doctor, login, logout, sync, daemon (alias: watch), emit, findings, work, spec, runner, hooks, mcp, context. Capture and sync coding-agent sessions, and record proof of factory work.",
   "license": "Apache-2.0",
   "author": "Magu Studios, Inc.",

package/skill-pack/maintained/outerlayer-amend/SKILL.md

@@ -27,7 +27,7 @@ branch first, unless the working tree is on it.
 ## Arguments
 
 - `--unattended`: no person is watching. Never ask a question. A need for a
-  person becomes a hand-off (step 7), never a silent stop.
+  person becomes a hand-off (step 8), never a silent stop.
 
 ## Builds and local sessions
 
@@ -85,7 +85,7 @@ repository. Commit and push in each checkout you change, to its own branch only.
      declares one.
    - **The spec is wrong.** The criterion cannot be met as written, for
      example one that names a path a repository rule forbids. Never rewrite it:
-     hand it off (step 7) with the wording change.
+     hand it off (step 8) with the wording change.
    - **Cannot tell.** Hand an ambiguous comment off with `--ready`: quote it
      and ask one question.
 5. **Fix, prove, reply.** An answer needs no commit: reply on its criterion
@@ -112,30 +112,30 @@ repository. Commit and push in each checkout you change, to its own branch only.
    - **Otherwise**, reply with a sentence naming what changed and the commit:
      `outerlayer work comment --item "$OUTERLAYER_WORK" [--criterion <criterion>] --body "<what changed>" --ready`.
      Omit `--criterion` on the general thread.
-6. **Watch CI.** Skip this step when you pushed nothing. Run
+6. **Record the proofs again** before you watch CI: the evidence check waits
+   on them. Push any recipe edit (`.outerlayer/proofs/<item key>.yaml`) first.
+   Run `outerlayer work proofs --record --comment --pr <prNumber>` in each
+   checkout you pushed.
+7. **Watch CI.** Skip this step when you pushed nothing. Run
    `gh pr checks <prNumber> --repo <repository> --watch` on each pull request
    you pushed. Leave out any check that waits on results recorded after the
    session ends. "No checks reported" is not green: query again.
    - For a failed check, read `gh run view <run-id> --log-failed`, fix it, push
-     again.
+     again, and repeat step 6.
    - If it also fails on the base branch, or outside the code, change nothing.
    - Stop after two fixes for one check.
-7. **Hand off what you cannot fix.** Reply on the thread with `--ready`: one
+8. **Hand off what you cannot fix.** Reply on the thread with `--ready`: one
    sentence of fact, then the decision a person must make. For a spec problem,
    quote the criterion and give the replacement wording. `--ready` hands the
    thread back to a person.
-8. **Check nothing is left waiting.** Reread threads. A thread still waiting
+9. **Check nothing is left waiting.** Reread threads. A thread still waiting
    on an agent has a reply that did not land or was flagged `unchanged`. Fix
    or report it. Then run `outerlayer sync` and `outerlayer work proofs`.
-9. **Record the proofs again.** Skip this step when you pushed nothing. If a
-   fix changes how a proof is made, commit the recipe edit
-   (`.outerlayer/proofs/<item key>.yaml`). Push, run
-   `outerlayer work proofs --record --comment --pr <prNumber>` per pushed checkout.
 10. **Report.** Write one line per thread: the criterion (or the general
    thread), and fixed (with the replacement) or handed off (with the reason).
    Add a line for a merge conflict (merged with the base sha, or handed off
    with the reason), a CI line when you pushed (green, or each red check and
-   why), the lines from step 9, and a line naming each proof missing or
+   why), the lines from step 6, and a line naming each proof missing or
    out of date.
    Post the lines once on the general thread:
    `outerlayer work comment --item "$OUTERLAYER_WORK" --body "<the lines>"`.

package/skill-pack/maintained/outerlayer-build/SKILL.md

@@ -338,7 +338,8 @@ Run them in order.
    the criteria itself and records the `acceptance-criteria` check, as
    release.md says. It records one check item per criterion. When the state
    file holds no criteria, no judge runs.
-   Watch CI until every check has concluded.
+   Watch CI until every check has concluded. Start the Evidence phase at the
+   same time, as release.md's "Watch CI" says: CI never reads the proofs.
 6. **Evidence.** Run `outerlayer emit step "Evidence" --item "$OUTERLAYER_WORK"`,
    then apply the team's changes for this phase. Read [references/evidence.md](references/evidence.md)
    when the pull request opens, and run it. Write and commit the proof recipe