@outerlayer/cli 0.34.0-next.20261028122415 → 0.34.0-next.20261028152714

package/dist/{chunk-YGU43DH4.js → chunk-AJZWVXXA.js}

@@ -1,33 +1,33 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { itemsSentence, criteriaOf, hostItemsOf, loadCitationFinder, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, testFileMatcher, criterionInputs, planCriteria, parseJudgeAnswer, inCriteriaOrder, oneLineReason, judgedItems } from './chunk-BEGMZKMG.js';
+import { itemsSentence, criteriaOf, hostItemsOf, loadCitationFinder, MAX_TEST_FILE_BYTES, MAX_TEST_FILES, testFileMatcher, criterionInputs, planCriteria, parseJudgeAnswer, inCriteriaOrder, oneLineReason, judgedItems } from './chunk-UE2C4STC.js';
 import { readsJobState, READ_JOB_STATE_FORMATS, jobStateFormatOf } from './chunk-ZVB57WI6.js';
 import { HELPER_PATH, DOCKERD_LOG, HELPER_RECORD } from './chunk-XDCD4GD5.js';
 import { zodProblem } from './chunk-I3LTIAOR.js';
-import { senderPidfile } from './chunk-AKQX462F.js';
-import { installScrubContext } from './chunk-C2E4PWEN.js';
+import { senderPidfile } from './chunk-6MLX26T4.js';
+import { installScrubContext } from './chunk-FG564H3C.js';
 import { writeDockerClientConfig } from './chunk-BUVDDPOM.js';
-import { upgradedStarterText } from './chunk-TZMDRHWB.js';
-import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, firstLine, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, runtimeStepInput, keepRuntimeStep, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, ranRuntimeStep, provisionRuntimes, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, said, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-7JBG43BX.js';
-import { fetchCommit, readBranchHead, diffBetween } from './chunk-AGNFPJSP.js';
+import { upgradedStarterText } from './chunk-IAVT7R6O.js';
+import { ADDED_USER, shellQuote, GH_CONFIG_YML, ghHostsYml, firstLine, hasClaudeCredential, AssetError, obtainImage, ensureRootfs, makeBuildsDirPrivate, gitRemoteFor, startServicesFor, createLeaseChannel, createBuildDisk, machineConfig, startJailedInto, resolveAgentUser, AgentUserError, runBuildSteps, runtimeStepInput, keepRuntimeStep, createContainerRuntime, containerSenderCommand, hostCommandEnvironment, execArgv, signalInContainer, startHostServices, LEASE_SECONDS, managedBuildSettingsFor, stopContainer, cleanupContainer, recordProofsInContainer, PROOFS_LOG, outOfMemoryReason, closeHostBuild, dropManagedClaudeKey, dropManagedBuildSettings, startCheckContainer, ranRuntimeStep, provisionRuntimes, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, syncInContainer, copyTranscriptsFromContainer, MANAGED_UNJAILED_REASON, senderAliveScript, managedMachineLimits, withFactoryHosts, helperFirecrackerNote, said, managedClaudeKeyValues, managedBuildSettingValues, stopJailed, deleteBuildDisk, RECORD_PROOFS_ARGV, managedClaudeKeyFor, ROOT_DISK_ID_PREFIX, copyTranscripts, containerJudgeEnvironment, senderSignalScript, copyJudgeTree } from './chunk-I4V2YBMA.js';
+import { fetchCommit, readBranchHead, diffBetween } from './chunk-KY6H5L5O.js';
 import { waitForAgent, vmExecArgs } from './chunk-NPTEYMBW.js';
 import { socketPathProblem, vsockLinks, LEASE_LINK, linkVsockSockets } from './chunk-DKIZDYUX.js';
-import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, removeKeptContext, formatDuration, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-SODV2YMW.js';
-import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, egressSummary, DEFAULT_CHECK_TIME_LIMIT_MINUTES, optionalEgress } from './chunk-QXAPVAPR.js';
-import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-7LKOOGSN.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, identityScript, identityArgs, parseIdentity, mountableHome, homeCopyScript, homeCopyArgs, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-2LCNMAWP.js';
+import { describeCallFailure, resolveGoverningSource, prefetchGovernedContext, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, removeKeptContext, retrySend, formatClock, keptContextTree, WORKFLOW_PERMISSION_REASON } from './chunk-ZXQEBRCB.js';
+import { imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, egressSummary, DEFAULT_CHECK_TIME_LIMIT_MINUTES, optionalEgress } from './chunk-JDYBPAPP.js';
+import { formatBytes, DEFAULT_CACHE_DISK, allocatedBytes } from './chunk-47SFTQA5.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, parseSize, identityScript, identityArgs, parseIdentity, mountableHome, homeCopyScript, homeCopyArgs, childEnvironment, withAnswerProtocol, judgeCommand, MAX_REPORT_BYTES, JUDGE_MAX_TURNS, JUDGE_DIR, COMMAND_DIR, MAX_ITEMS_BYTES } from './chunk-HA46L5FG.js';
 import { CLAUDE_CODE_VERSION, FIRECRACKER_VERSION } from './chunk-D3CT6XQ4.js';
 import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-72N7GOLM.js';
-import { planArtifactUpload } from './chunk-IXPH4EXK.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-T664NDNT.js';
+import { planArtifactUpload } from './chunk-VEVNGDTP.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { signerFor } from './chunk-VJQQVTCS.js';
-import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE, resolvePackRoot } from './chunk-OVNF4LLC.js';
-import { scrubText } from './chunk-A2KLVZBU.js';
+import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE, resolvePackRoot } from './chunk-HH3BQG65.js';
+import { scrubText } from './chunk-GH2HEEOH.js';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { parsePolicy } from './chunk-XFJ7YOPD.js';
-import { CheckItemsSchema } from './chunk-DINRXUQA.js';
+import { parsePolicy } from './chunk-2EEW6FJN.js';
+import { CheckItemsSchema } from './chunk-IXRUVR25.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { RUNNER_FILE_MODE, runnerDir, buildDir, vsockPath, jobConsolePath } from './chunk-2CW2QMSG.js';
 import { JOB_MOUNT, repositoriesOf, primaryOf, buildEnvironment, CHECKOUT_DIR, claudeCredential, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, authorEnvironment, withTunnelRecord, commitIdentityRecord, RELAY_PORT, repositoryPath, lifecycleWorkdir, CHECK_ITEMS_FILE, withMiseVariables, fdName, BUILD_HOME, CLAUDE_CREDENTIAL_VARIABLES, currentClaudeCredential, removedClaudeCredentialValues, managedClaudeCredential, checkEnvironment, EVAL_INPUT_DIR } from './chunk-4N7BQBO4.js';
@@ -668,7 +668,7 @@ async function provisionMicroVm(input) {
     removeStagedContext: () => removeStagedContext(buildDir2),
     keepIn: jobDir,
     ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {},
-    // A repository with no devcontainer file builds on the universal image, whose runtimes the build chooses and installs.
+    // A build on the universal image, or on an image built from it, chooses and installs its runtimes.
     ...runtimeStepInput(report, services)
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
@@ -780,9 +780,15 @@ function isRunning(runtime, state) {
   return vmAlive(runtime, state);
 }
 async function syncInMicroVm(input) {
+  return runCliInMicroVm(input, ["outerlayer", "sync"], "sync.log", "the microVM is gone, so its sessions cannot be read");
+}
+async function recordProofsInMicroVm(input) {
+  return runCliInMicroVm(input, [...RECORD_PROOFS_ARGV], PROOFS_LOG, "the microVM is gone, so its proofs cannot be recorded");
+}
+async function runCliInMicroVm(input, argv, logName, goneReason) {
   const { runtime, job } = input;
   const state = job.microvm;
-  if (!isRunning(runtime, state)) return { ok: false, reason: "the microVM is gone, so its sessions cannot be read" };
+  if (!isRunning(runtime, state)) return { ok: false, reason: goneReason };
   try {
     const env = buildEnvironment({
       config: input.config,
@@ -800,12 +806,12 @@ async function syncInMicroVm(input) {
       factoryVariables: factoryVariablesOf(input.config, input.jobDir)
     });
     const result = await runtime.vm.exec(state.vsockPath, {
-      argv: ["outerlayer", "sync"],
+      argv,
       user: state.agentUser ?? ADDED_USER,
       cwd: job.workdir ?? CHECKOUT_DIR,
       env: execEnvironment(state.imageEnv, env)
     });
-    appendFileSync(join(input.jobDir, "sync.log"), result.stdout + result.stderr);
+    appendFileSync(join(input.jobDir, logName), result.stdout + result.stderr);
     return result.status === 0 ? { ok: true } : { ok: false, reason: `exit ${result.status}` };
   } catch (err) {
     return { ok: false, reason: describeCallFailure(err) };
@@ -2544,6 +2550,52 @@ async function runSyncViaExec(config, job, jobDirPath, spawnFn = spawn) {
     return { ok: false, reason: describeCallFailure(err) };
   }
 }
+function runRecordProofs(config, job, jobDirPath, spawnFn = spawn) {
+  return new Promise((resolve) => {
+    const env = jobEnv(config, job.item, job.itemKey, jobDirPath, process.env, job.branch, job.commitIdentity?.author);
+    let fd;
+    let child;
+    try {
+      fd = openSync(join(jobDirPath, PROOFS_LOG), "a", RUNNER_FILE_MODE);
+    } catch (err) {
+      resolve({ ok: false, reason: describeCallFailure(err) });
+      return;
+    }
+    try {
+      child = spawnFn(process.execPath, [process.argv[1] ?? "outerlayer", ...RECORD_PROOFS_ARGV.slice(1)], { cwd: job.workdir, env, stdio: ["ignore", fd, fd] });
+    } catch (err) {
+      closeSync(fd);
+      resolve({ ok: false, reason: describeCallFailure(err) });
+      return;
+    }
+    child.on("exit", (code) => {
+      closeSync(fd);
+      resolve(code === 0 ? { ok: true } : { ok: false, reason: `exit ${code ?? "by signal"}` });
+    });
+    child.on("error", (err) => {
+      closeSync(fd);
+      resolve({ ok: false, reason: describeCallFailure(err) });
+    });
+  });
+}
+async function runRecordProofsViaExec(config, job, jobDirPath, spawnFn = spawn) {
+  const build = job.build;
+  const env = hostCommandEnvironment(jobEnv(config, job.item, job.itemKey, jobDirPath, process.env, job.branch, job.commitIdentity?.author), build, config, job.commitIdentity?.hooksPath);
+  try {
+    const result = await runHook(build.exec, env, jobDirPath, join(jobDirPath, PROOFS_LOG), spawnFn, void 0, execArgv(job.workdir, [...RECORD_PROOFS_ARGV]));
+    return result.code === 0 ? { ok: true } : { ok: false, reason: `exit ${result.code}` };
+  } catch (err) {
+    return { ok: false, reason: describeCallFailure(err) };
+  }
+}
+var RECORDED_PROOFS = /* @__PURE__ */ new Set(["screenshot", "video", "report", "log", "file"]);
+async function declaresRecordedProof(config, item, fetchImpl) {
+  try {
+    return (criteriaOf(await readWorkItem(config, item, fetchImpl)) ?? []).some((criterion) => criterion.proof !== null && RECORDED_PROOFS.has(criterion.proof));
+  } catch {
+    return true;
+  }
+}
 var MAX_NAMED_SPOOLED = 20;
 function spooledArtifactIds(home) {
   try {
@@ -2556,7 +2608,7 @@ function leaseExpiry(job, fallback) {
   const base = Date.parse(job.lastRenewAt ?? job.startedAt);
   return new Date((Number.isFinite(base) ? base : fallback.getTime()) + LEASE_SECONDS * 1e3);
 }
-var TEARDOWN_STAGES = ["judge", "checks", "sync", "cleanup", "report"];
+var TEARDOWN_STAGES = ["proofs", "judge", "checks", "sync", "cleanup", "report"];
 function inTeardown(job) {
   return job.stage !== void 0 && TEARDOWN_STAGES.includes(job.stage);
 }
@@ -2694,6 +2746,21 @@ async function finishJob(job, jobDirPath, outcome, config, deps, ending) {
       log.error(`${tag} removing an earlier attempt's check environment failed: ${describeCallFailure(err)} \xB7 continuing`);
     }
   }
+  if (outcome === "ok" && !job.cleanupRan && job.proofsRan !== true && !valuesNotHeld && job.workdir !== void 0 && job.itemKey !== void 0 && await declaresRecordedProof(config, job.item, deps.fetchImpl)) {
+    setStage(job, jobDirPath, "proofs");
+    job.proofsRan = true;
+    writeJobFile(jobFilePath, job);
+    log.line(`${tag} proofs started`);
+    const startedMs = now().getTime();
+    try {
+      const recorded = build !== void 0 ? await recordProofsInContainer({ config, runtime: build.runtime, job, jobDir: jobDirPath, log: (line) => log.line(`${tag} ${line}`) }) : vmBuild !== void 0 ? await recordProofsInMicroVm({ config, runtime: vmBuild.runtime, job, jobDir: jobDirPath }) : job.build?.exec !== void 0 ? await runRecordProofsViaExec(config, job, jobDirPath, spawnFn) : await runRecordProofs(config, job, jobDirPath, spawnFn);
+      const took = formatDuration(now().getTime() - startedMs);
+      if (recorded.ok) log.line(`${tag} proofs ok (${took}) \xB7 see ${PROOFS_LOG}`);
+      else log.error(`${tag} proofs not all current (${took}): ${recorded.reason ?? "no reason given"} \xB7 see ${PROOFS_LOG} \xB7 continuing`);
+    } catch (err) {
+      log.error(`${tag} the host's proof recording stopped: ${describeCallFailure(err)} \xB7 continuing`);
+    }
+  }
   if (valuesNotHeld && outcome === "ok" && !job.cleanupRan) log.error(`${tag} the host's judge and checks skipped: ${VALUES_NOT_HELD}`);
   if (outcome === "ok" && !job.cleanupRan && job.judgeRan !== true && !valuesNotHeld) {
     setStage(job, jobDirPath, "judge");

package/dist/{chunk-LYCJQOO2.js → chunk-ARL6X6Y4.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-OVNF4LLC.js';
-import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-XFJ7YOPD.js';
+import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-HH3BQG65.js';
+import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-2EEW6FJN.js';
 import { existsSync, readdirSync, readFileSync, mkdirSync, writeFileSync, lstatSync, readlinkSync, symlinkSync, rmdirSync } from 'fs';
 import { relative, sep, join } from 'path';
 

package/dist/{chunk-AXKSVN4U.js → chunk-BEILLR5Q.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-C2E4PWEN.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-FG564H3C.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-GJHOU5V3.js';
+import { autoConnect } from './chunk-BRBZKIZG.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-IXPH4EXK.js';
+import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-VEVNGDTP.js';
 import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-IZKUPAXF.js';
-import { resolveRepoIdentity } from './chunk-A2KLVZBU.js';
+import { resolveRepoIdentity } from './chunk-GH2HEEOH.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_BYTES, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-DINRXUQA.js';
+import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_BYTES, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-IXRUVR25.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { createHash, randomUUID } from 'crypto';
 import { statSync, readFileSync, mkdirSync, existsSync, writeFileSync, renameSync, unlinkSync } from 'fs';

package/dist/{chunk-GJHOU5V3.js → chunk-BRBZKIZG.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-N6V4ZHI7.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-26WUFKYZ.js';
 import { resolveGatewayCredentials } from './chunk-IZKUPAXF.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-A2KLVZBU.js';
+import { resolveRepoIdentity } from './chunk-GH2HEEOH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 

package/dist/{chunk-5VKSPEST.js → chunk-BTA5QOKD.js}

@@ -2,13 +2,13 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-GJHOU5V3.js';
+import { autoConnect } from './chunk-BRBZKIZG.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-IZKUPAXF.js';
-import { resolveRepoIdentity } from './chunk-A2KLVZBU.js';
+import { resolveRepoIdentity } from './chunk-GH2HEEOH.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { CriteriaListSchema } from './chunk-DINRXUQA.js';
+import { CriteriaListSchema } from './chunk-IXRUVR25.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync } from 'fs';
 

package/dist/{chunk-NWHU5G6R.js → chunk-CKDSPW35.js}

@@ -5,7 +5,7 @@ import { C } from './chunk-ANPNT6PM.js';
 import { readCloudConfigStrict, CloudConfigError, readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { CLI_LOGIN_MACHINE_NAME_MAX, CliLoginPollResponseSchema, CLI_LOGIN_KIND, CliLoginRefusalSchema, CliLoginStartedSchema } from './chunk-DINRXUQA.js';
+import { CLI_LOGIN_MACHINE_NAME_MAX, CliLoginPollResponseSchema, CLI_LOGIN_KIND, CliLoginRefusalSchema, CliLoginStartedSchema } from './chunk-IXRUVR25.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { generateKeyPairSync, privateDecrypt, constants, createPrivateKey } from 'crypto';
 import { spawn } from 'child_process';

package/dist/{chunk-C2E4PWEN.js → chunk-FG564H3C.js}

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-ZIXLG6EQ.js';
+import { uploadSpooledSteps } from './chunk-7XDF7PNF.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-IXPH4EXK.js';
+import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-VEVNGDTP.js';
 import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-IZKUPAXF.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
 import { signerFor, signRunnerRequest } from './chunk-VJQQVTCS.js';
-import { writeSyncStatus, spoolDir } from './chunk-D7MWJM2G.js';
+import { writeSyncStatus, spoolDir } from './chunk-WHONZ53R.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-A2KLVZBU.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-GH2HEEOH.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-T2Q7ISPE.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { removeJournalHooks } from './chunk-TUSYOL2O.js';
-import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-DINRXUQA.js';
+import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-IXRUVR25.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { SCRUB_ENV_VARIABLE } from './chunk-4N7BQBO4.js';
 import { dirname, basename, join, sep } from 'path';

package/dist/{chunk-A2KLVZBU.js → chunk-GH2HEEOH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EVENT_TYPES, isHumanUserTurn, INPUT_BAND_BOUNDARIES, parseAgentSession, SCHEMA_VERSION, SPEED_MAX_LENGTH, inputBandOf, BUCKET_MODEL_MAX_LENGTH } from './chunk-DINRXUQA.js';
+import { EVENT_TYPES, isHumanUserTurn, INPUT_BAND_BOUNDARIES, parseAgentSession, SCHEMA_VERSION, SPEED_MAX_LENGTH, inputBandOf, BUCKET_MODEL_MAX_LENGTH } from './chunk-IXRUVR25.js';
 import { createHash } from 'crypto';
 import { readFileSync, readdirSync, statSync, mkdirSync, copyFileSync, renameSync, unlinkSync, writeFileSync, stat as stat$1, unwatchFile, watchFile, watch as watch$1 } from 'fs';
 import { type, homedir } from 'os';

package/dist/{chunk-AVI3MGQO.js → chunk-GHQW2BBX.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { escapeUnitPath, UNIT_MARKER, DEFAULT_UNIT_NAME } from './chunk-N4KQMGEZ.js';
+import { escapeUnitPath, UNIT_MARKER, DEFAULT_UNIT_NAME } from './chunk-NYMDS542.js';
 import { inspectService, realInspectProbes } from './chunk-4N7BQBO4.js';
 import { realpathSync, readFileSync, readdirSync } from 'fs';
 import { resolve, dirname, join } from 'path';

package/dist/{chunk-2LCNMAWP.js → chunk-HA46L5FG.js}

@@ -3,7 +3,7 @@ import { createRequire } from 'node:module';
 import { resolveDevcontainerCli, devcontainerBuildInvocation, universalImagePending, RecipeError } from './chunk-CM4J53WZ.js';
 import { universalImagePinned, UNIVERSAL_IMAGE, BUILDKIT_IMAGE } from './chunk-D3CT6XQ4.js';
 import { ensureHostKey } from './chunk-VJQQVTCS.js';
-import { compareVersions } from './chunk-A2KLVZBU.js';
+import { compareVersions } from './chunk-GH2HEEOH.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-2CW2QMSG.js';
 import { CLAUDE_PORT, BUILD_HOME, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-4N7BQBO4.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';

package/dist/{chunk-OVNF4LLC.js → chunk-HH3BQG65.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
-import { splitRawFile } from './chunk-XFJ7YOPD.js';
+import { splitRawFile } from './chunk-2EEW6FJN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';

package/dist/{chunk-SX3LYSWR.js → chunk-HUS6X5BJ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { stripTerminalControls } from './chunk-YGU43DH4.js';
+import { stripTerminalControls } from './chunk-AJZWVXXA.js';
 import { tagToPull, imageTag, pullInstruction, readUpdateStatus, runnerImageVersion } from './chunk-ORENXMHA.js';
 import { readFileSync } from 'fs';
 
@@ -55,7 +55,7 @@ function envNamesOf(row, imageEnv) {
   return [...new Set(names)].sort();
 }
 async function readOwnContainer(deps = {}) {
-  const run = deps.run ?? (await import('./docker-OQP6NU7P.js')).spawnRun;
+  const run = deps.run ?? (await import('./docker-UP7EFFLL.js')).spawnRun;
   const ids = candidateIds(deps.env ?? process.env, deps.readFile ?? ((path) => readFileSync(path, "utf8")));
   if (ids.length === 0) return { ok: false, reason: "the runner cannot tell which container it runs in: HOSTNAME is empty and /proc/self/mountinfo names none" };
   let problem = "";

package/dist/{chunk-7JBG43BX.js → chunk-I4V2YBMA.js}

@@ -1,28 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { sha256OfFile, downloadPinned, VoiceDownloadError } from './chunk-2PGI6RDE.js';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, TAG_HOST, SHARED_OWNER, SHARED_NAME, metadataFromLabels, writeRecord } from './chunk-AGNFPJSP.js';
-import { FETCHED_DIR, toolsDockerfile, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_HEADLESS_SHELL, FETCHED_PLAYWRIGHT_FFMPEG, FETCHED_VOICE_DIR } from './chunk-7XZQTJOD.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, prepareImageBuild, KEY_PREFIX, TAG_HOST, SHARED_OWNER, SHARED_NAME, universalBase, metadataFromLabels, writeRecord } from './chunk-KY6H5L5O.js';
+import { FETCHED_DIR, toolsDockerfile, FETCHED_FFMPEG, FETCHED_GH, FETCHED_TINI, FETCHED_HEADLESS_SHELL, FETCHED_PLAYWRIGHT_FFMPEG, FETCHED_VOICE_DIR } from './chunk-V64BEF6E.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
 import { runExec, execCapture, waitForAgent } from './chunk-NPTEYMBW.js';
 import { GUEST_CID, linkVsockSockets } from './chunk-DKIZDYUX.js';
-import { retrySend, describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-SODV2YMW.js';
+import { retrySend, describeCallFailure, keepStagedContext, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, prefetchGovernedContext, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript, WORKFLOW_PERMISSION_REASON } from './chunk-ZXQEBRCB.js';
 import { runnerImageVersion } from './chunk-ORENXMHA.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-S37IAT3A.js';
-import { optionalEgress, runnerCredentialProblem, builtinKind, allowHostProblem, systemClock, emptyEgressCounts, hostAllowed } from './chunk-QXAPVAPR.js';
-import { formatBytes, allocatedBytes } from './chunk-7LKOOGSN.js';
-import { NETWORK_HELPER_MEMORY, createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, networkHelperName, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, mountableHome, homeCopyRunArgs, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, NETWORK_READY_FILE, spawnRun, identityRunArgs, parseIdentity, networkHelperRunArgs } from './chunk-2LCNMAWP.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-UAINHP2C.js';
+import { optionalEgress, runnerCredentialProblem, builtinKind, allowHostProblem, systemClock, emptyEgressCounts, hostAllowed } from './chunk-JDYBPAPP.js';
+import { formatBytes, allocatedBytes } from './chunk-47SFTQA5.js';
+import { NETWORK_HELPER_MEMORY, createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, networkHelperName, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, mountableHome, homeCopyRunArgs, containerExecArgs, childEnvironment, readDu, JUDGE_DIR, MAX_ITEMS_BYTES, JUDGE_ITEMS, MAX_REPORT_BYTES, JUDGE_REPORT, NETWORK_READY_FILE, spawnRun, identityRunArgs, parseIdentity, networkHelperRunArgs } from './chunk-HA46L5FG.js';
 import { RecipeError, DOCKER_FEATURE, universalImagePending, writeSanitizedRecipe, classifyProperties } from './chunk-CM4J53WZ.js';
-import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, builderDiskPinned, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, networkHelperPinned, NETWORK_HELPER_SHA256, universalImagePinned, UNIVERSAL_IMAGE, UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-D3CT6XQ4.js';
+import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, hostHelperPinned, CLAUDE_CODE_VERSION, builderDiskPinned, guestAssetsPinned, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, GUEST_ASSETS_VERSION, BUILDER_DISK_VERSION, networkHelperPinned, NETWORK_HELPER_SHA256, universalImagePinned, UNIVERSAL_IMAGE, FFMPEG_STATIC, FFMPEG_BUILD_TAG, GH_SHA256, GH_VERSION, TINI_SHA256, TINI_VERSION, HEADLESS_SHELL, HEADLESS_SHELL_BASE_URL, PLAYWRIGHT_FFMPEG, PLAYWRIGHT_FFMPEG_BASE_URL, VOICE_PACK_FILES, BUILDER_DISK_SHA256, BUILDER_DISK_BASE_URL, DEFAULT_BASE_IMAGE } from './chunk-D3CT6XQ4.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { postJson, WorkCommandError, getJson } from './chunk-72N7GOLM.js';
-import { sanitizeTerminal } from './chunk-IXPH4EXK.js';
+import { postJson, WorkCommandError, getJson } from './chunk-T664NDNT.js';
+import { sanitizeTerminal } from './chunk-VEVNGDTP.js';
 import { signerFor } from './chunk-VJQQVTCS.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-FGF52V4V.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
-import { MIN_SCRUBBED_LITERAL, setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-A2KLVZBU.js';
-import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-XFJ7YOPD.js';
-import { downconvertSession } from './chunk-DINRXUQA.js';
+import { MIN_SCRUBBED_LITERAL, setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-GH2HEEOH.js';
+import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-2EEW6FJN.js';
+import { downconvertSession } from './chunk-IXRUVR25.js';
 import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, buildsDir, buildDir, runnerDir, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, SHIM_DIR, vsockPath, builderCacheDiskPath, builderConsolePath } from './chunk-2CW2QMSG.js';
 import { claudeCredential, parseIsolation, proxyEnvironment, withProxyWarningHidden, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, withHooksPath, startBuildServices, BUILT_IN_NAMES, checkoutPath, repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, buildEnvironment, checkEnvironment, withMiseVariables, AGENT_CREDENTIAL_MISSING, isMiseVariableAllowed, JOB_MOUNT, realFdStorePort } from './chunk-4N7BQBO4.js';
 import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, JOIN_WAIT_MS, MAX_OPEN_STREAMS, STREAM_RESET_RATE, STREAM_RESET_BURST, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-MESOOLF4.js';
@@ -2392,8 +2392,7 @@ async function buildInBuilder(opts, deps, prepared) {
         claudeCodeVersion: prepared.claudeCodeVersion,
         buildId: opts.cli.buildId,
         guestHelper: true,
-        fetched: true,
-        ...location.kind === "default" ? { universal: true } : {}
+        fetched: true
       })
     );
     inputs = builderInput({ checkoutDir: checkout.dir, toolsDir, toolFilesDir, recipeDir }, archive);
@@ -2415,6 +2414,7 @@ async function buildInBuilder(opts, deps, prepared) {
     const described = JSON.parse(result);
     const imageConfig = parseImageConfig(JSON.stringify(described.config));
     const labels = described.config.Labels ?? {};
+    const base = universalBase(location, labels);
     mkdirSync(recordDir, { recursive: true, mode: RUNNER_DIR_MODE });
     const fd = openSync(partial, "w", 384);
     let received = 0;
@@ -2444,7 +2444,7 @@ async function buildInBuilder(opts, deps, prepared) {
       sourceCommit: checkout.commit,
       defaultBranch: checkout.defaultBranch,
       recipe: location.kind === "default" ? "default" : location.path,
-      ...location.kind === "default" ? { base: { reference: `${UNIVERSAL_IMAGE_REPOSITORY}:${UNIVERSAL_IMAGE_SOURCE}`, digest: UNIVERSAL_IMAGE_DIGEST } } : {},
+      ...base === void 0 ? {} : { base },
       recipeKey: prepared.recipeKey,
       toolsKey: prepared.toolsKey,
       imageId: `${ROOT_DISK_ID_PREFIX}${rKey}-${tKey}`,
@@ -3527,6 +3527,10 @@ function copyJudgeTree(from, to, limits2 = { files: MAX_TREE_FILES, bytes: MAX_T
   walk(from, to, true);
 }
 
+// src/runner/record-proofs.ts
+var RECORD_PROOFS_ARGV = ["outerlayer", "work", "proofs", "--record", "--comment"];
+var PROOFS_LOG = "proofs.log";
+
 // src/runner/container/agent-user.ts
 var ADDED_USER = "ol-agent";
 var RELAY_REFUSAL = `the agent's user cannot be \`${RELAY_USER}\``;
@@ -4988,7 +4992,7 @@ async function provisionContainer(input) {
     removeStagedContext: () => removeStagedContext(buildDir2),
     keepIn: jobDir,
     ...input.requireBuildSkill === true ? { requireBuildSkill: true } : {},
-    // A repository with no devcontainer file builds on the universal image, whose runtimes the build chooses and installs.
+    // A build on the universal image, or on an image built from it, chooses and installs its runtimes.
     ...runtimeStepInput(report, services)
   });
   if (!steps.ok) return bail(steps.reason, steps.aborted === true);
@@ -5186,6 +5190,12 @@ async function deliverContainerHooks(runtime, state, jobDir) {
   return deliverJobFiles(runtime, state, ["git-hooks"], secretsOf(runtime, jobDir));
 }
 async function syncInContainer(input) {
+  return runCliInContainer(input, ["outerlayer", "sync"], "sync.log");
+}
+async function recordProofsInContainer(input) {
+  return runCliInContainer(input, [...RECORD_PROOFS_ARGV], PROOFS_LOG);
+}
+async function runCliInContainer(input, argv, logName) {
   const { runtime, job } = input;
   const state = job.container;
   try {
@@ -5215,8 +5225,8 @@ async function syncInContainer(input) {
       identity: job.commitIdentity
     });
     const result = await runtime.host.exec(
-      { container: state.container, user: state.agentUser ?? ADDED_USER, workdir: job.workdir ?? CHECKOUT_DIR, env, argv: ["outerlayer", "sync"] },
-      { logPath: join(input.jobDir, "sync.log") }
+      { container: state.container, user: state.agentUser ?? ADDED_USER, workdir: job.workdir ?? CHECKOUT_DIR, env, argv },
+      { logPath: join(input.jobDir, logName) }
     );
     return result.status === 0 ? { ok: true } : { ok: false, reason: `exit ${result.status}` };
   } catch (err) {
@@ -5595,4 +5605,4 @@ function describeMachineDocker(machine) {
   return `Docker Engine ${version ?? "of no known version"}, older than the ${MIN_ENGINE_MAJOR} that container builds need`;
 }
 
-export { ADDED_USER, ADOPTED_FETCH_RETRY_WINDOW_MS, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HELPER_ENV, LEASE_SECONDS, MANAGED_UNJAILED_REASON, MIN_ENGINE_MAJOR, PLACEHOLDER_MARKER, ROOT_DISK_ID_PREFIX, RunnerInitError, attemptNote, claimPermissionProblem, claudeCredentialCheck, cleanupContainer, closeHostBuild, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, currentSkillCommand, decideHostBuildSkill, deleteBuildDisk, deliverContainerHooks, deliverExecMaven, describeMachineDocker, detectMachine, dropManagedBuildSettings, dropManagedClaudeKey, ensureFirecrackerAndJailer, ensureNetworkReady, ensureRootfs, ensureTunnel, execArgv, execCommandLine, fetchManagedBuildSettings, fetchManagedClaudeKey, filesAreCopied, firstLine4 as firstLine, formerSkillProblem, formerSkillQueues, ghHostsYml, gitRemoteFor, hasClaudeCredential, helperFirecrackerNote, helperSocketPath, holdManagedBuildSettings, holdManagedClaudeKey, hostCommandEnvironment, hostEnvironment, isPlaceholderCommand, keepGhConfigCurrent, keepRuntimeStep, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, listenOnBroker, machineConfig, makeBuildsDirPrivate, managedBuildSettingValues, managedBuildSettingsFor, managedClaudeKeyFor, managedClaudeKeyValues, managedMachineLimits, measureDisk, microVmArchSupported, microVmAssetsPinned, missingPermissionFix, missingPermissionOf, needsBuildSkill, needsClaudeCredential, obtainImage, outOfMemoryReason, parseCpuList, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues, prepareBranch, prepareRunnerInit, probeHelper, provisionContainer, provisionEnvironment, provisionRuntimes, ranRuntimeStep, reachDockerStep, readConfigObject, resolveAgentUser, resolveHostBuild, runBuildSteps, runRunnerInit, runWithSpawn, runtimeStepInput, said, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startHostServices, startJailedInto, startServicesFor, stopContainer, stopJailed, stoppedHelperReason, supportsContainerBuilds, supportsMicroVmBuilds, sweepImageBuilders, syncInContainer, withFactoryHosts, withTunnelLog, writeEvalInput, writeRunnerInit };
+export { ADDED_USER, ADOPTED_FETCH_RETRY_WINDOW_MS, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HELPER_ENV, LEASE_SECONDS, MANAGED_UNJAILED_REASON, MIN_ENGINE_MAJOR, PLACEHOLDER_MARKER, PROOFS_LOG, RECORD_PROOFS_ARGV, ROOT_DISK_ID_PREFIX, RunnerInitError, attemptNote, claimPermissionProblem, claudeCredentialCheck, cleanupContainer, closeHostBuild, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, createLeaseChannel, currentSkillCommand, decideHostBuildSkill, deleteBuildDisk, deliverContainerHooks, deliverExecMaven, describeMachineDocker, detectMachine, dropManagedBuildSettings, dropManagedClaudeKey, ensureFirecrackerAndJailer, ensureNetworkReady, ensureRootfs, ensureTunnel, execArgv, execCommandLine, fetchManagedBuildSettings, fetchManagedClaudeKey, filesAreCopied, firstLine4 as firstLine, formerSkillProblem, formerSkillQueues, ghHostsYml, gitRemoteFor, hasClaudeCredential, helperFirecrackerNote, helperSocketPath, holdManagedBuildSettings, holdManagedClaudeKey, hostCommandEnvironment, hostEnvironment, isPlaceholderCommand, keepGhConfigCurrent, keepRuntimeStep, leaseExpiresAtMs, leaseTimeLeftMs, lifecycleFailureReason, lifecycleSteps, listenOnBroker, machineConfig, makeBuildsDirPrivate, managedBuildSettingValues, managedBuildSettingsFor, managedClaudeKeyFor, managedClaudeKeyValues, managedMachineLimits, measureDisk, microVmArchSupported, microVmAssetsPinned, missingPermissionFix, missingPermissionOf, needsBuildSkill, needsClaudeCredential, obtainImage, outOfMemoryReason, parseCpuList, permissionModeProblem, permissionModeProblems, placeholderProblem, placeholderQueues, prepareBranch, prepareRunnerInit, probeHelper, provisionContainer, provisionEnvironment, provisionRuntimes, ranRuntimeStep, reachDockerStep, readConfigObject, recordProofsInContainer, resolveAgentUser, resolveHostBuild, runBuildSteps, runRunnerInit, runWithSpawn, runtimeStepInput, said, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startHostServices, startJailedInto, startServicesFor, stopContainer, stopJailed, stoppedHelperReason, supportsContainerBuilds, supportsMicroVmBuilds, sweepImageBuilders, syncInContainer, withFactoryHosts, withTunnelLog, writeEvalInput, writeRunnerInit };

package/dist/{chunk-TZMDRHWB.js → chunk-IAVT7R6O.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
-import { VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH, POLICY_CONTENT } from './chunk-J7EJMIDR.js';
-import { skillsBaseFor } from './chunk-LYCJQOO2.js';
+import { VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH, POLICY_CONTENT } from './chunk-54LIUIZL.js';
+import { skillsBaseFor } from './chunk-ARL6X6Y4.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { resolvePackRoot, AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE, restoreSkillPaths, rewriteSkillPaths, skillDir, loadTemplateFiles, TEMPLATE_SKILLS } from './chunk-OVNF4LLC.js';
+import { resolvePackRoot, AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE, restoreSkillPaths, rewriteSkillPaths, skillDir, loadTemplateFiles, TEMPLATE_SKILLS } from './chunk-HH3BQG65.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { hasSymlinkComponent } from './chunk-UPA5KOOX.js';
+import { hasSymlinkComponent } from './chunk-RQ3GCCHH.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
 import { createHash } from 'crypto';
 import { existsSync, readFileSync } from 'fs';

package/dist/{chunk-QXAPVAPR.js → chunk-JDYBPAPP.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-7LKOOGSN.js';
-import { parseSize } from './chunk-2LCNMAWP.js';
+import { DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-47SFTQA5.js';
+import { parseSize } from './chunk-HA46L5FG.js';
 import { builderDiskPinned } from './chunk-D3CT6XQ4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-4N7BQBO4.js';

package/dist/{chunk-AGNFPJSP.js → chunk-KY6H5L5O.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { toolsDockerfile } from './chunk-7XZQTJOD.js';
-import { runnerLabelValue } from './chunk-2LCNMAWP.js';
+import { toolsDockerfile } from './chunk-V64BEF6E.js';
+import { runnerLabelValue } from './chunk-HA46L5FG.js';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-CM4J53WZ.js';
-import { CLAUDE_CODE_VERSION, NODE_IMAGE, UNIVERSAL_IMAGE, MEDIA_PINS, TINI_VERSION, GH_VERSION, UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE } from './chunk-D3CT6XQ4.js';
+import { UNIVERSAL_IMAGE_DIGEST, UNIVERSAL_IMAGE_REPOSITORY, UNIVERSAL_IMAGE_SOURCE, CLAUDE_CODE_VERSION, NODE_IMAGE, UNIVERSAL_IMAGE, MEDIA_PINS, TINI_VERSION, GH_VERSION } from './chunk-D3CT6XQ4.js';
 import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-64LLUVJR.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, repoCacheDir, imagesDir, imageBuildLogsDir, attemptStamp, runnerDir, rootfsPathFor } from './chunk-2CW2QMSG.js';
@@ -207,9 +207,17 @@ function selectPrunable(opts) {
 
 // src/runner/image/build.ts
 function baseLines(report) {
-  return report.base === void 0 ? [] : [`  base:    ${report.base.reference}@${report.base.digest}
+  if (report.base === void 0) return [];
+  return [`  base:    ${report.base.reference}${report.base.digest === void 0 ? "" : `@${report.base.digest}`}
 `];
 }
+var UNIVERSAL_SOURCE_LABEL = "ai.outerlayer.universal-source";
+var SOURCE_TAG = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
+function universalBase(location, labels) {
+  if (location.kind === "default") return { reference: `${UNIVERSAL_IMAGE_REPOSITORY}:${UNIVERSAL_IMAGE_SOURCE}`, digest: UNIVERSAL_IMAGE_DIGEST };
+  const source = labels[UNIVERSAL_SOURCE_LABEL];
+  return source !== void 0 && SOURCE_TAG.test(source) ? { reference: `${UNIVERSAL_IMAGE_REPOSITORY}:${source}` } : void 0;
+}
 var KIND2 = "ai.outerlayer.kind";
 var RUNNER2 = "ai.outerlayer.runner";
 var REPOSITORY = "ai.outerlayer.repository";
@@ -422,8 +430,7 @@ async function buildRepositoryImage(opts, ports) {
           nodeImage,
           claudeCodeVersion,
           buildId: opts.cli.buildId,
-          guestHelper: opts.guestHelper !== void 0,
-          ...universal ? { universal: true } : {}
+          guestHelper: opts.guestHelper !== void 0
         });
         const labels = { [REPOSITORY]: imageRepository, [KIND2]: "build", [RUNNER2]: runnerLabel, [RECIPE_KEY2]: rKey, [TOOLS_KEY]: tKey };
         const status = await host.buildDockerfile({ dockerfile, context, tag: buildTag, labels, logPath, ...universal ? {} : { base: { ref: recipeTag, layout: keptLayout } } });
@@ -435,6 +442,7 @@ async function buildRepositoryImage(opts, ports) {
       if (buildImage === void 0) throw failed("finding the image after the tools build", 0);
     }
     const toolsBuilt = buildImage !== buildImageBefore;
+    const base = universalBase(location, buildImage.labels);
     let report = readReport(recordDir);
     if (report === null || report.imageId !== buildImage.id || report.docker === void 0) {
       report = {
@@ -442,7 +450,7 @@ async function buildRepositoryImage(opts, ports) {
         sourceCommit: checkout.commit,
         defaultBranch: checkout.defaultBranch,
         recipe: location.kind === "default" ? "default" : location.path,
-        ...universal ? { base: { reference: `${UNIVERSAL_IMAGE_REPOSITORY}:${UNIVERSAL_IMAGE_SOURCE}`, digest: UNIVERSAL_IMAGE_DIGEST } } : {},
+        ...base === void 0 ? {} : { base },
         recipeKey: rKey,
         toolsKey: tKey,
         imageId: buildImage.id,
@@ -453,6 +461,8 @@ async function buildRepositoryImage(opts, ports) {
       writeRecord(recordDir, report, now().toISOString());
     } else if (universal) {
       report = { ...report, repository, sourceCommit: checkout.commit, defaultBranch: checkout.defaultBranch };
+    } else if (base !== void 0) {
+      report = { ...report, base };
     }
     const removed = [];
     if (toolsBuilt) removed.push(...await prune(host, imageRepository, repoRecords, opts.keep ?? KEEP_BUILD_IMAGES, runnerDir(opts.configPath), runnerLabel));
@@ -493,4 +503,4 @@ async function prune(host, repository, repoRecords, keep, runnerDirPath, runnerL
   return removed;
 }
 
-export { KEY_PREFIX, SHARED_NAME, SHARED_OWNER, SHARED_REPOSITORY, TAG_HOST, baseLines, buildRepositoryImage, cloneRepository, diffBetween, fetchCommit, metadataFromLabels, prepareImageBuild, readBranchHead, readDefaultBranchHead, writeRecord };
+export { KEY_PREFIX, SHARED_NAME, SHARED_OWNER, SHARED_REPOSITORY, TAG_HOST, UNIVERSAL_SOURCE_LABEL, baseLines, buildRepositoryImage, cloneRepository, diffBetween, fetchCommit, metadataFromLabels, prepareImageBuild, readBranchHead, readDefaultBranchHead, universalBase, writeRecord };

package/dist/{chunk-LEJWPGO7.js → chunk-LBEYOL5K.js}

@@ -2,15 +2,15 @@
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
 import { detectActiveSession, transcriptPathForSession } from './chunk-IP7BIBXJ.js';
-import { autoConnect } from './chunk-GJHOU5V3.js';
+import { autoConnect } from './chunk-BRBZKIZG.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-IZKUPAXF.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
-import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-A2KLVZBU.js';
+import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-GH2HEEOH.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { FindingBatchSchema, FindingsResponseSchema, SAME_PROBLEM_RULES } from './chunk-DINRXUQA.js';
+import { FindingBatchSchema, FindingsResponseSchema, SAME_PROBLEM_RULES } from './chunk-IXRUVR25.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync, existsSync } from 'fs';
 import { join, dirname, basename } from 'path';