@outerlayer/cli 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @outerlayer/cli
 
+## 0.5.0
+
+### Minor Changes
+
+- 0101c5c: MicroVM builds are available. The CLI pins the guest kernel and guest helper published as the `guest-1` release of the public `outerlayerai/guest-assets` repository, so a Linux x86_64 host whose runner user can open `/dev/kvm` now runs each build in a Firecracker microVM. On such a host, `outerlayer runner init` names `builtin:vm`, and `outerlayer doctor` passes a `builtin:vm` hook. To move an existing host, set both hooks to `builtin:vm` and restart the runner while no build is running.
+
+### Patch Changes
+
+- cfe700a: A recorded criterion without its declared proof now flags its pull request's verdict, and an item with no recorded criteria flags it unless the policy sets `criteria.missing` to `info` or `off`. The `acceptance-criteria` check is retired from the recommended registry. Its report, bound with `--for acceptance-criteria`, is linked at the top of the item's Criteria tab instead.
+
+## 0.4.1
+
+### Patch Changes
+
+- a5cda3d: `import capture` and `context emit` help list all four maintained skills, and `mcp serve` no longer suggests the hidden `--api-key` flag when it finds no API key.
+- b150a61: `emit artifact` reads a JUnit XML file bound with `--for` as test results, and a repeatable `--test "<name>[=path:line]"` selects the tests that prove the criterion and gives a location the file lacks.
+- 32850dd: When a build's command exits 0, `outerlayer runner` reads the work item's evidence verdict before it releases the claim. A build whose item still has a failing check, or a required check with no result, is released `incomplete`, with a reason naming each check, instead of `ok`. A verdict that is not passing is read again every 30 seconds for up to 5 minutes; a passing one is believed at once. The report hook's `OUTERLAYER_OUTCOME` is the outcome the release carries. Runner protocol 12.
+
 ## 0.4.0
 
 ### Minor Changes

package/README.md

@@ -90,6 +90,8 @@ content:
   the end of every poll: the host, the CLI version, the poll interval, the
   slots in use and total, and the result of that poll's own request for
   work — success, or the error code and message the platform returned.
+  When a build's command exits 0, it reads that work item once more, for its
+  evidence verdict, before releasing it: it sends nothing but the request.
   Before a build's command starts, the runner also runs `git ls-remote` and
   `git fetch` in the job's workdir, with the host's own git credentials, to
   put it on the branch the claim named. Nothing about the job leaves the host
@@ -315,13 +317,13 @@ before it gives up.
 | `outerlayer context emit [--check]` | Compile `.outerlayer/` into each configured target tool's native files (targets come from `.outerlayer/config.json`). `--check` computes outputs and diffs against disk without writing (CI mode). Bare `outerlayer emit` with no name still compiles, with a deprecation warning. |
 | `outerlayer import ruler` | Port a `.ruler/` tree ([Ruler](https://github.com/intellectronica/ruler)) into the equivalent `.outerlayer/` tree — mostly a rename; never overwrites an existing `.outerlayer/`. |
 | `outerlayer hooks wrap` / `outerlayer hooks unwrap` | Auto-wrap (or undo wrapping) `PreToolUse`/`PostToolUse` hooks for execution evidence — one spawn per firing. |
-| `outerlayer emit artifact <file> --caption <text> [--for <criterion-id>] [--pr <n>]` | Upload a proof artifact — screenshot, recording, report, or log — with its caption. Inside a recorded session it spools locally and ships on the next `sync`; otherwise it uploads immediately, anchored to a pull request or the current checkout. `--replaces` retires artifacts an earlier run uploaded. |
+| `outerlayer emit artifact <file> --caption <text> [--for <criterion-id>] [--pr <n>]` | Upload a proof artifact — screenshot, recording, report, or log — with its caption. Inside a recorded session it spools locally and ships on the next `sync`; otherwise it uploads immediately, anchored to a pull request or the current checkout. `--replaces` retires artifacts an earlier run uploaded. A JUnit XML file bound with `--for` proves a criterion that declares `test` proof; `--test <name[=path:line]>` binds only the named tests. |
 | `outerlayer emit <name> --result <pass\|fail> [--link <url>] [--body <text>\|--body-file <path>] --item <number>` | Record one named check's outcome on a work item. A check that ran carries the run URL as its proof (`--link`); a judgment you are making yourself carries one sentence (`--body`, or `--body-file` to read it from a file — `-` reads standard input). A `fail` needs at least one of the two; a `pass` needs neither. `--item` names the work item by the number printed when the item was created — always required, in or out of a recorded session; a session records checks on its own item like any other, stored as the session's, but cannot clear a person's fail. Prints the recorded check's id. Who recorded it comes from your API key, never from what you send. |
 | `outerlayer work comment --item <n> [--criterion <id>] --body <text> [--artifact <id>] [--pass\|--fail\|--attach\|--ready]` | Post one comment on a work item's general thread, or on one acceptance criterion's own thread with `--criterion`. `--pass`/`--fail` need a person's own credential and apply to the whole item, so they work on the general thread only and the gateway refuses them with `--criterion`; `--attach` makes the named artifact that criterion's current proof; `--ready` hands a thread back to a person. The detected session id rides along automatically, only ever narrowing what the comment may do. |
 | `outerlayer work threads --item <n>` | Read a work item's threads back — the general thread first, then one per criterion with proof or a comment, each with its `waitingOn`. |
 | `outerlayer emit finding --id <id> --category <context\|flaky-test\|tooling\|environment\|defect\|other> --title <text> --file <path> --where <label> [--line <n>] [--item <number>] …` | Record one problem you hit in the factory. `--category` is one of `context` (an instruction that is wrong, broken or missing), `flaky-test`, `tooling`, `environment`, `defect` (a bug outside your own change) or `other`. A `context` finding also needs `--rule-path` and `--rule-relation` (`wrong`, `broken` or `missing`), and `--rule-quote` unless the relation is `missing`. Findings are informational; nothing reads one to pass or fail the work. `--item` names the work item; without it, inside a recorded session, the item that session was launched for is used automatically. Re-emitting the same `--id` on the item replaces that finding. |
 | `outerlayer emit findings <file> [--item <number>]` | Record a whole batch at once, read from a JSON file (`-` for standard input) with `"schemaVersion": 2` — the same shape and validation as `emit finding`, one record per id, category, title, file, line, rule and where. Anchored the same way: `--item`, else a recorded session's own item. |
-| `outerlayer emit criteria <file> [--item <number>]` | Record a work item's acceptance criteria as one list, read from a JSON file (`-` for standard input): `{"criteria": [{"id": "AC-1", "text": "Given …", "proof": null}]}`. An `id` is 1 to 64 characters of `A-Z a-z 0-9 . _ : -`, the same id `emit artifact --for` binds evidence to. `proof` is `video`, `screenshot`, `report`, `log`, `file` or `null` (any bound artifact proves it). The list holds 1 to 200 criteria, each `text` at most 2,000 characters, with no id twice. It is validated before anything is sent. This list is the only source for the item's Criteria tab. Once an item has a list, only a person can replace it: run the command outside an agent session, with your own login. Anchored the same way as `emit findings`: `--item`, else a recorded session's own item. |
+| `outerlayer emit criteria <file> [--item <number>]` | Record a work item's acceptance criteria as one list, read from a JSON file (`-` for standard input): `{"criteria": [{"id": "AC-1", "text": "Given …", "proof": null}]}`. An `id` is 1 to 64 characters of `A-Z a-z 0-9 . _ : -`, the same id `emit artifact --for` binds evidence to. `proof` is `video`, `screenshot`, `report`, `log`, `test`, `file` or `null` (any bound artifact proves it). The list holds 1 to 200 criteria, each `text` at most 2,000 characters, with no id twice. It is validated before anything is sent. This list is the only source for the item's Criteria tab. Once an item has a list, only a person can replace it: run the command outside an agent session, with your own login. Anchored the same way as `emit findings`: `--item`, else a recorded session's own item. |
 | `outerlayer mcp install [--transport stdio\|http] [--url] [--name] [--command]` | Write (or update) an `mcpServers` entry in `.mcp.json` for the OuterLayer gateway. Default `stdio`: the client spawns `outerlayer mcp serve`, which reads the API key from `~/.outerlayer/config.json` (or `OUTERLAYER_API_KEY`) each time it connects, so a reconnect picks up a newly saved or rotated key. `--transport http` writes a direct `POST /v1/mcp` entry referencing `${OUTERLAYER_API_KEY}`, resolved by the client from the environment it was launched with. Never writes an API key. Pass `--url`/`--app-id` for self-host. |
 | `outerlayer mcp serve [--url] [--app-id]` | Stdio MCP server bridging stdin/stdout JSON-RPC to the gateway's `POST /v1/mcp`. What the stdio `.mcp.json` entry runs; exits 1 with a clear message when no API key is configured. |
 | `outerlayer work build --issue <n\|KEY>\|--item <n> [--tracker linear\|jira] [--local] [--repo] [--note] [--retry <count>]` | Starts work on an item and puts it on the Work page. `--issue` takes a GitHub issue number or a Linear or Jira key such as `ENG-123`; the gateway verifies a key against the factory's tracker connection before adding it. `--tracker` is needed only when both Linear and Jira are connected. A key gets a repository only from `--repo`, never from the checkout. Without `--local`, records a build request that a host takes when it has a free slot. With `--local` (issue only), no host takes it: it prints the item's number and the line that starts your own session on it, such as `OUTERLAYER_WORK=7 claude`. `--retry` resends after a 5xx or 429 answer, up to that many more times. |

package/dist/{build-TZUUTRGH.js → build-PAEKVYVK.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-ZNA27WEV.js';
+export { buildRepositoryImage } from './chunk-Z62HNKEJ.js';
 import './chunk-N5FOE5PS.js';
 export { RecipeError } from './chunk-QOZKPLVJ.js';
 import './chunk-ZM2IMMYN.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-02T18:11:11.100Z+54c322e","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-03T18:15:54.958Z+defeb9b","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-WQP2CZDW.js → check-AXCXDYO2.js}

@@ -1,28 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-FS2VYGZT.js';
-import './chunk-FAJSS2WN.js';
-import './chunk-FV2CCGXK.js';
+import { probeCredentials } from './chunk-L24G4PLP.js';
+import './chunk-RWOTHXYE.js';
+import './chunk-QDQEUVUF.js';
 import './chunk-ABIWDUMS.js';
 import './chunk-YYYXRJUW.js';
 import './chunk-CBPPJSAR.js';
-import { placeholderQueues, placeholderProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-7YIOOFVJ.js';
-import './chunk-HE2D4EY5.js';
+import { placeholderQueues, placeholderProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-OHFDWLJP.js';
+import './chunk-ZOC7JSYC.js';
 import './chunk-TBT347UY.js';
-import './chunk-CBZB6XY6.js';
-import './chunk-L2DBRKRA.js';
-import './chunk-7A6RVXPZ.js';
-import './chunk-ZNA27WEV.js';
+import './chunk-FC7TMRNA.js';
+import './chunk-RJ467PDQ.js';
+import './chunk-4NMBDRBS.js';
+import './chunk-Z62HNKEJ.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-774HEQL6.js';
 import './chunk-QOZKPLVJ.js';
 import './chunk-W4SQCOZU.js';
 import './chunk-B2G7JHHB.js';
-import './chunk-5DLBAXY5.js';
+import './chunk-RMAZ2NWA.js';
 import './chunk-BFESLKPP.js';
-import './chunk-6Y63SXFO.js';
-import './chunk-G7FSV7JX.js';
+import './chunk-WOBNRVQT.js';
+import './chunk-EX6M5JPR.js';
 import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-5Y3QQRUH.js';
 import './chunk-F6GFZXZ3.js';
 import './chunk-AUFG23AA.js';

package/dist/{chunk-7A6RVXPZ.js → chunk-4NMBDRBS.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-ZNA27WEV.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-Z62HNKEJ.js';
 import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
 import { createDockerHost, childEnvironment, spawnRun } from './chunk-774HEQL6.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
 import { execCapture } from './chunk-W4SQCOZU.js';
 import { GUEST_CID } from './chunk-B2G7JHHB.js';
-import { WorkCommandError, postJson } from './chunk-5DLBAXY5.js';
+import { WorkCommandError, postJson } from './chunk-RMAZ2NWA.js';
 import { parseDuKilobytes, hostAllowed } from './chunk-F6GFZXZ3.js';
 import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, AGENT_CREDENTIAL_MISSING, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT } from './chunk-AUFG23AA.js';
 import { defaultGitRunner, materializeContext } from './chunk-XDDW4FRS.js';

package/dist/{chunk-3TT7RQYB.js → chunk-D2KWEAN6.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-6Y63SXFO.js';
+import { sanitizeTerminal } from './chunk-WOBNRVQT.js';
 import { DEFAULT_DASHBOARD } from './chunk-USO2DKBD.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 

package/dist/{chunk-3YPKXE5L.js → chunk-EGABNHZG.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { applyContextProvenance, installScrubContext, prepareSessionForUpload, wholeSessionCounts, sliceTurnIo } from './chunk-HE2D4EY5.js';
+import { applyContextProvenance, installScrubContext, prepareSessionForUpload, wholeSessionCounts, sliceTurnIo } from './chunk-ZOC7JSYC.js';
 import { LaunchFilter } from './chunk-BCJNHMZT.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { hookExecSpoolPath } from './chunk-F7CU5ABH.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
-import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-6Y63SXFO.js';
-import { tailTranscript, enrichSessionRepo, CAPTURE_TIERS, scanAll, setRepoRoot, resolveRepoIdentity, inferArtifactKind, bannedPathsForTier, sessionIdFromPath, SOURCE_ADAPTERS, EVENT_TYPES } from './chunk-G7FSV7JX.js';
+import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-WOBNRVQT.js';
+import { tailTranscript, enrichSessionRepo, CAPTURE_TIERS, scanAll, setRepoRoot, resolveRepoIdentity, inferArtifactKind, bannedPathsForTier, sessionIdFromPath, SOURCE_ADAPTERS, EVENT_TYPES } from './chunk-EX6M5JPR.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-DVDEBNQJ.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
@@ -786,14 +786,16 @@ var KNOWN_PERMANENT_ARTIFACT_ERROR_CODES = /* @__PURE__ */ new Set([
   "unknown_replaces_target",
   "nothing_to_attach",
   "artifact_content_conflict",
-  "payload_too_large"
+  "payload_too_large",
+  "unreadable_test_results"
 ]);
 var NEVER_REACHED_SERVER_ERROR_CODES = /* @__PURE__ */ new Set([
   "invalid_request_body",
   "invalid_field_value",
   "session_not_found",
   "nothing_to_attach",
-  "payload_too_large"
+  "payload_too_large",
+  "unreadable_test_results"
 ]);
 function splitPayload(payload) {
   const mid = Math.ceil(payload.sessions.length / 2);
@@ -1493,6 +1495,7 @@ ${C.yellow}!${C.reset} batch ${shippedBatches + 1}/${batches.length} accounting
             ...record.commitSha !== void 0 ? { commitSha: record.commitSha } : {},
             ...replaces !== void 0 ? { replaces } : {},
             ...record.replacesTargets !== void 0 ? { replacesTargets: record.replacesTargets } : {},
+            ...record.tests !== void 0 ? { tests: record.tests } : {},
             session: { sessionId: record.sessionId, ...turnIndex !== void 0 ? { turnIndex } : {} }
           },
           blob: { data: blobData.toString("base64") }