@ship.zone/ci-spec 2.0.0

package/.smartconfig.json

@@ -0,0 +1,46 @@
+{
+  "@git.zone/cli": {
+    "schemaVersion": 2,
+    "projectType": "npm",
+    "module": {
+      "githost": "code.foss.global",
+      "gitscope": "ship.zone",
+      "gitrepo": "ci-spec",
+      "description": "The ship.zone CI standard: language-neutral CI workflow and runner protocol specifications.",
+      "npmPackagename": "@ship.zone/ci-spec",
+      "license": "MIT",
+      "projectDomain": "ship.zone",
+      "keywords": [
+        "ci",
+        "continuous-integration",
+        "ship.zone",
+        "openapi",
+        "runner",
+        "workflow"
+      ]
+    },
+    "release": {
+      "targets": {
+        "git": {
+          "enabled": true,
+          "remote": "origin",
+          "pushBranch": true,
+          "pushTags": true
+        },
+        "npm": {
+          "enabled": true,
+          "registries": [
+            "https://verdaccio.lossless.digital",
+            "https://registry.npmjs.org"
+          ],
+          "accessLevel": "public"
+        },
+        "docker": {
+          "enabled": false,
+          "engine": "tsdocker",
+          "patterns": []
+        }
+      }
+    }
+  }
+}

package/changelog.md

@@ -0,0 +1,190 @@
+# Changelog
+
+## 2026-09-27 - 2.0.0
+
+### Breaking Changes
+
+- move the CI standard to the ship.zone brand (package, ci-actions, runner-protocol)
+  - The package is published as `@ship.zone/ci-spec`; install it with `pnpm add @ship.zone/ci-spec` and change every import and asset subpath from `@foss.global/ci-spec`. Exported names and subpaths are unchanged. The repository moves to `https://code.foss.global/ship.zone/ci-spec`.
+  - Normative identifiers are renamed:
+
+    | 1.x | 2.0.0 |
+    | --- | --- |
+    | `FOSS_CI_MATRIX_JSON` | `SHIPZONE_CI_MATRIX_JSON` |
+    | `FOSS_CI_INPUTS_JSON` | `SHIPZONE_CI_INPUTS_JSON` |
+    | reserved environment names `FOSS_CI_*` | `SHIPZONE_CI_*` |
+    | reserved image label prefix `global.foss.ci.` | `zone.ship.ci.` |
+    | `https://foss.global/spec/ci/ci_actions.schema.json` | `https://ship.zone/spec/ci/schemas/ci_actions.schema.json` |
+    | `https://foss.global/spec/ci/runner-job.schema.json` | `https://ship.zone/spec/ci/schemas/runner-job.schema.json` |
+
+  - The runner protocol, OpenAPI description, and schemas carry ship.zone titles, and the prose names the coordinator and runner roles instead of a product: the atomic alias write applies to a registry the coordinator operates.
+  - 1.x cross-version rules removed. `resources`, `leaseFeatures`, and `maximumTimeoutMs` are plain optional capability fields of 2.0.0, without the per-field rules that a runner sends them only to a coordinator of 1.1.0 or 1.2.0 and later; the general rule stays that a message uses only constructs defined at the lower of the coordinator and runner versions, so later 2.x minor versions add fields the same way. Every coordinator stores and delivers only secret values of at least 8 bytes, so the clauses for coordinators before 1.2.0 are gone. The behavior case `capability-fields-negotiated`, which described a 1.2.0 and 1.1.x session, is removed.
+  - Schema identifiers follow the package layout, and the OpenAPI description is `https://ship.zone/spec/ci/spec/runner.openapi.json`, so its `../schemas/runner-job.schema.json` reference resolves to the schema's `$id`. Validators register each schema under its `$id` and need no other key.
+  - Under the same-major rule, 1.x implementations do not accept 2.0.0 documents and 2.0.0 implementations do not accept 1.x documents; workflows declare `spec: 2.0.0`, and every conformance fixture, the example, and OpenAPI `info.version` move to 2.0.0, which changes the compiled plan digests of the fixtures.
+- complete the compilation rules (ci-actions, runner-protocol)
+  - The YAML subset is exact: a key must resolve to a string under the core schema, so a plain `1`, `true`, `null`, or `~` key is rejected; every explicit tag is rejected, including `!!str` and `!`; a leading byte order mark is allowed and counted by the size limit and the workflow digest; an integral float above the safe-integer range is rejected like an unsafe integer.
+  - A job that declares an artifact or cache beyond its resolved permissions fails compilation with `permission_insufficient`; it is never compiled with the declaration dropped.
+  - A container or VM job whose candidate image lacks its `runner.platform` fails compilation with `candidate_platform_missing`, like a base-image candidate that lacks a platform of the consuming build.
+  - Ref names are UTF-8: a forge rejects other ref names at push, so the rule for non-UTF-8 names is gone.
+  - Environment names defined at several levels take the innermost value; a secret target equal to an environment name, two references with one target, and any `SHIPZONE_CI_*` name are conflicts.
+
+### Features
+
+- define compilation failure codes, compiled jobs, and expanded nodes (ci-actions, runner-protocol)
+  - Every compilation failure carries one of 48 stable codes, grouped in the layers `source`, `yaml`, `version`, `schema`, `workflow`, `policy`, and `run` and evaluated in that order; within the `workflow`, `policy`, and `run` layers the first code in table order wins. The secret and grant codes are ordered `secret_untrusted`, `npm_read_untrusted`, `secret_unknown` (new: a reference to a secret the repository does not hold), `protected_secret_denied`, `secret_too_short`, so an untrusted run learns nothing about the repository's secrets.
+  - The version check runs before schema validation, so a workflow written against a later version fails with `spec_incompatible` instead of schema errors.
+  - Triggers are evaluated after the workflow layers: an event that does not match creates no run, and every event on a commit whose workflow fails an earlier layer creates a failed run.
+  - Compiled Jobs defines every member of a compiled job, including `requirements.limits` derived from the declarations and the deployment, `container` isolation for `oci` unless policy requires `microvm`, and the order of `features` and `labels`, so equal inputs compile to identical plan digests. The Compilation Boundary binds each job's `compiledPlanDigest`; no run-level digest is defined.
+  - Expanded DAG names nodes `job`, `job[n]` for matrix expansions in expansion order, `job[platform]` for per-platform build jobs, and `job` for the assembly node, and fixes plan order and `needs` edges. Expansion order varies the first-declared matrix dimension slowest.
+  - Tag versions strip one lowercase `v`; valid OCI tags match `[A-Za-z0-9_][A-Za-z0-9._-]{0,127}`; aliases are checked on every tag run.
+  - `conformance/compile-cases.json` with `conformance/compile-cases.schema.json` (exported as `compile-cases.json` and `compile-cases.schema.json`) lists the failure codes, 14 trigger pattern vectors, 10 tag version vectors, and 149 compile cases: the expected code of every invalid and compile-invalid workflow fixture, and vectors for the YAML subset, numbers, versions, every workflow and policy rule but the command size and generic policy refusal, trigger matching, matrix expansion and its JSON bytes, manual inputs, tag runs and aliases, job skipping, and the secret code precedence; 13 of them fix compiled nodes, 28 compiled jobs, and their plan digests. The YAML-level fixtures `alias.yml`, `custom-tag.txt`, `duplicate-key.txt`, and `multiple-documents.yml` now break only their YAML rule.
+  - The package exports `compilationFailureLayers` and `compilationFailureCodes`, and `ciSpecAssetPaths` gains `compileCases` and `compileCasesSchema`.
+  - Adds 11 behavior cases.
+
+## 2026-09-27 - 1.2.0
+
+### Features
+
+- refuse secret values shorter than the redaction minimum (ci-actions, runner-protocol)
+  - The coordinator refuses to store a secret value, new or as a replacement, that is shorter than 8 UTF-8 bytes, with code `secret_too_short`, and stores nothing. The rule concerns the whole value: a multi-line value is stored whatever the length of its lines. The rule covers every scope a job can reference a secret from.
+  - A held value that fails the rule is never delivered: compiling a run in which a non-skipped job references it fails with `secret_too_short`; `secret_untrusted` and `protected_secret_denied` take precedence.
+  - Secret Redaction defines the lines of a value (terminators CR LF, LF, and CR) and cross-references the rule. Every stored value is redacted as a whole; lines shorter than 8 bytes of a multi-line value stay unmasked by design. npm grant tokens contain no line terminator.
+- derive the trust class of a run (ci-actions, runner-protocol)
+  - Every pull request run is untrusted, whatever its author or head repository. Branch push, tag push, and manual runs are trusted when their actor may push to the repository when the run is created, and untrusted otherwise. The class is fixed at run creation, and neither workflow content nor deployment policy changes it.
+  - Trusted pull request runs no longer exist, so the `protected_secret_denied` rule and its behavior case name only branch push, manual, and unprotected tag runs.
+  - A job is leased only to a runner whose registration allows its run's trust class: trusted, untrusted, or both. Protected tag runs are trusted. The trust class stays off the wire.
+- let runners advertise the lease features they use and their longest job timeout (runner-protocol)
+  - `RunnerCapabilities` accepts the optional `leaseFeatures` (`LeaseFeature`: `image-pull-grants`, `candidate-bindings`, `npm-read-grants`) and `maximumTimeoutMs` (1,000 to 86,400,000). When advertised, a lease uses only listed features and a job's `timeoutMs` is at most the maximum; `candidate-bindings` requires `image-pull-grants`. Runners send both only when the lower of the coordinator and runner versions is 1.2.0 or later.
+  - A grant applies to an image reference whose registry (the text before the first `/`) and repository (the text up to `@`) equal the grant's exactly; a reference without a registry has no grant, and the runner presents a pull grant only for an image it applies to.
+  - The package exports `leaseFeatureIdentifiers`.
+  - Adds 15 behavior cases and 7 wire-message cases.
+
+## 2026-09-27 - 1.1.1
+
+### Fixes
+
+- define run concurrency (ci-actions, runner-protocol)
+  - A run whose workflow declares `concurrency` has a concurrency key: tenant, repository, trust class, whether it is a protected tag run, its ref (the branch or tag ref, the pull request, or the ref a manual run executes), and the literal `group`. Only runs with the same key affect each other, so untrusted runs never delay or cancel trusted runs and only protected tag runs affect protected tag runs.
+  - At most one run per key is active; runs with one key start in creation order, and the coordinator enqueues no job of a waiting run. With `cancelInProgress: true` a new run cancels older waiting runs and the older active run: unenqueued and queued jobs become `canceled` without a lease and running attempts receive a cancellation directive with reason `superseded`. A run that has begun qualification or publication is never canceled by concurrency.
+  - `concurrency` is not part of any compiled job or plan digest; a run without it, or whose compilation failed, never waits or cancels.
+- define the job timeout default and deadline (ci-actions, runner-protocol)
+  - A job without `timeoutMs` compiles to 3,600,000 (one hour); every compiled job, matrix expansion, and per-platform build job carries the value explicitly.
+  - The attempt timeout is the coordinator's acceptance commit time plus `timeoutMs`; the runner measures its deadline from receiving the acceptance response. The deadline covers source extraction, cache restoration, and the steps, or the build, push, and image record; artifact upload, cache publication, and completion follow it.
+  - At the deadline the runner terminates as for a cancellation, archives `always` and `failure` artifacts, publishes no cache, and completes `timed_out`. Grant expiry is bounded by the attempt timeout plus the cancellation grace.
+- define artifact and cache retention (ci-actions, runner-protocol)
+  - `retentionDays` defaults to 30 for artifacts and 7 for caches and compiles unchanged. An item expires `retentionDays` days after its `TransferRecord` `createdAt`; from then on it is never served, restored, qualified, or published, and its content is deleted within 7 days.
+  - Restoring a cache does not extend its expiry, and an expired current cache is restored as absent. Qualification fails on an expired referenced artifact, and a publication resume that needs one fails, so retention bounds how long publications can be resumed; release assets and npm packages already published are unaffected.
+  - A deployment maximum for timeout or retention applies to the declared or default value and fails compilation rather than shortening it.
+  - Adds 20 behavior cases, 1 valid and 6 schema-invalid workflow fixtures, and 1 valid and 1 invalid runner-job fixture; a test keeps the timeout and retention bounds of workflows and compiled jobs identical.
+
+
+### Maintenance
+
+- update the release tooling to `@git.zone/tstest` 6.3.2 and `@git.zone/tsrun` 3.0.1 (tooling)
+
+## 2026-09-26 - 1.1.0
+
+### Features
+
+- add per-job shared memory, runner resource maxima, and resource-aware lease matching (runner-protocol, ci-actions)
+  - Workflow and compiled job `resources` accept the optional `sharedMemoryBytes`, the size of `/dev/shm` inside the sandbox; a value above the job's `memoryBytes` fails compilation.
+  - `RunnerCapabilities` accepts the optional `resources` object (`ResourceLimits`: `maximumMemoryBytes`, `maximumCpus`, `maximumPids`, `maximumSharedMemoryBytes`); when advertised, a job is leased only when every declared resource fits.
+- extend CI publication with alias affixes, a declared publication order, and release notes (ci-actions)
+  - A `version` image alias accepts an optional `prefix` and `suffix`, so tags such as `v1.2.3` or `base_1.2.3-alpine` are expressible; an expansion that is not a valid OCI tag of at most 128 characters, or two aliases of one destination expanding to the same tag, fails compilation.
+  - The optional `publish.order` lists exactly the declared publication kinds; without it the order stays `images`, `npm`, `releaseAssets`.
+  - The optional `publish.releaseNotes` names an artifact holding one UTF-8 file of at most 1 MiB that becomes the release body; it requires `releaseAssets`.
+  - Adds 14 behavior cases, 2 wire-message cases, workflow fixtures (2 valid, 7 schema-invalid, 1 compile-invalid), and runner-job fixtures (1 valid, 1 invalid); a test enforces that every document using a construct added in 1.1.0 declares `spec: 1.1.0` or later.
+- add the `vm` execution profile for jobs that need root, a container engine, or kernel facilities (runner-protocol, ci-actions)
+  - A `vm` job has the container job shape with `execution.profile: vm`, declares `runner.platform` (a `linux` platform or `darwin/arm64`), and compiles to `microvm` isolation and `requirements.platform`.
+  - Each attempt boots one guest; steps run in order as guest root in that guest, and every process a step started is terminated before the next step. A `linux` guest runs the job image's root filesystem on a runner-provided kernel with namespaces, cgroups, loop devices, nftables, and tun; the job image brings its own container engine. No host device is visible and nested virtualization is not guaranteed.
+  - Nested namespaces and containers inside the guest are part of the sandbox; every connection leaving the guest passes network enforcement.
+  - A runner advertising `vm` includes `microvm` and may also advertise `oci`, never `oci-image`. A `vm` job is leased only to a runner advertising `vm`, `microvm`, and its platform; `darwin/arm64` runners run on Apple silicon and boot a digest-pinned bootable VM image, and `darwin/arm64` jobs declare no `sharedMemoryBytes`.
+- add job trigger filters and protected secrets for tag-only release jobs (ci-actions, runner-protocol)
+  - The optional job `triggers` lists the trigger kinds whose runs include the job; other runs skip it and its expansions during compilation. A job may admit only kinds that every job it needs admits, jobs referenced by `publish` admit `tag`, and every declared trigger kind is admitted by some job.
+  - A secret a repository marks protected reaches only jobs of protected tag runs, the runs that may publish; compiling any other trusted run in which a non-skipped job references it fails with `protected_secret_denied`, and the conditions are re-checked before every lease.
+  - Runners redact every secret value and npm grant token from job logs and reject artifacts and caches that contain one.
+- add attempt-scoped npm read grants for private scopes (ci-actions, runner-protocol)
+  - The optional job `npmRead` (`registry`, `scopes`) is part of the compiled job and the plan digest; `JobLease.npmGrants` (`NpmGrant`) carries one read-only token per entry outside the digest, revoked with the attempt.
+  - `oci` and `vm` steps receive a read-only npm configuration file outside the workspace through the reserved `NPM_CONFIG_USERCONFIG`, in `vm` on a read-only device or file system the host enforces because steps run as guest root; `oci-image` builds receive it as the reserved BuildKit secret `npmrc`.
+  - The runner places a token nowhere else; a copy that job or Dockerfile content makes is outside what a runner can prevent and is bounded by the grant's scopes and its revocation with the attempt.
+  - Untrusted runs, including every pull request, fail compilation with `npm_read_untrusted`; each registry must be allowlisted for egress.
+  - Exports `executionProfileIdentifiers.virtualMachine`, and adds 20 behavior cases, 8 wire-message cases, workflow fixtures (3 valid, 7 schema-invalid, 4 compile-invalid), and runner-job fixtures (3 valid, 2 invalid).
+
+### Fixes
+
+- make loopback traffic inside an attempt explicit and give every attempt its own network namespaces (runner-protocol)
+  - Every attempt has network namespaces shared with no other attempt and never with the host; loopback traffic inside them is always permitted, including under `none`, and is not governed by the network mode, so fixed test ports never collide across attempts. `none` now reads "no traffic leaves the sandbox", and the egress rules apply to connections leaving the sandbox.
+- state that the native-platform rule restricts only where a job executes; cross-compiling and running an emulator as an ordinary job process are job content (runner-protocol)
+- define release-asset publication (ci-actions)
+  - A release-asset artifact holds regular files at its root; each becomes one asset named by its file name, and nested paths, links, or duplicate asset names fail qualification.
+  - The coordinator creates the tag release when absent as a published release (an existing draft is a conflict), marks it as a prerelease exactly when the tag version has a prerelease component, treats an identical existing asset as published and a differing one as a conflict, and succeeds only after downloading every asset back and matching its size and SHA-256. Publications never delete releases or assets.
+- define how job `resources` compile and are enforced (ci-actions, runner-protocol)
+  - `workspaceBytes` and `workspaceEntries` compile into `requirements.limits.maximumWorkspaceBytes` and `maximumWorkspaceEntries`; the other values compile unchanged and are ceilings for the whole attempt.
+- state that a microVM guest is created without any state of another attempt rather than empty, which also covers a `vm` guest booted from its job image (runner-protocol)
+- define the protected tag run once and use it for publication and protected secrets; the publication conditions are unchanged (ci-actions)
+- state that cache keys are literal and not matrix-scoped: every job declaring a key, including every expansion of one matrix job, shares that cache in the run's cache namespace (ci-actions)
+- state that untrusted runs receive no secret value, whether or not the secret is marked protected (ci-actions)
+  - 1.0.0 said that untrusted pull requests receive no protected secrets before the protected mark existed. Compiling an untrusted run in which a non-skipped job references a secret now fails with the stable code `secret_untrusted`; trusted runs receive unmarked secrets. A 1.0.0 workflow with a `pullRequest` trigger whose jobs reference secrets restricts those jobs with `triggers` (which needs `spec: 1.1.0`) or drops the trigger. Adds 1 behavior case.
+- give protected tag runs a cache namespace of their own (ci-actions, runner-protocol)
+  - Jobs of protected tag runs restore only caches that protected tag runs of the same repository published, and their caches are visible to no other run; trust class stays part of every namespace. This keeps caches written by other trusted runs out of jobs that receive protected secrets, and closes the same exposure for publication, where a 1.0.0 tag run could restore a cache any trusted run of the repository had written. Adds 1 behavior case.
+- restrict `oci` and `oci-image` jobs to `linux` platforms (ci-actions, runner-protocol)
+  - Both profiles are defined by Linux sandbox and BuildKit facilities, and 1.0.0 defined no other execution for them; `darwin/arm64` is defined only for `vm`. The schemas now reject another platform in an `oci` job's `runner.platform`, in `build.platforms`, and in the `requirements.platform` of a compiled `oci` or `oci-image` job, through the new shared `linuxPlatform` definition, and an `oci` job without a platform is leased only to a runner that advertises a `linux` platform. Adds 1 behavior case, 2 schema-invalid workflows, and 2 invalid runner jobs.
+- state what the runner guarantees for build secrets: it never writes them into a layer, history, configuration, label, or exported cache, while a Dockerfile instruction that copies a mounted secret into the image filesystem is job content the runner cannot prevent (runner-protocol)
+
+### Maintenance
+
+- release tooling currency: `pnpm@12.5.1`, `@git.zone/tstest` `^6.3.0` and `@types/node` 26.6.2; tsbuild 5.0.0 and tsrun 3.0.0 are already current (tooling)
+
+## 2026-09-25 - 1.0.0
+
+### Breaking Changes
+
+- version the specification as the @foss.global/ci-spec package and add image builds, egress networking, and CI publication (runner-protocol, ci-actions)
+  - The package version is the only specification version. `ci_actions.yml` references it once as the required top-level `spec` (exact `MAJOR.MINOR.PATCH`); the `schemaVersion` field is removed.
+  - A coordinator or runner implementing version `I` accepts a declared `spec` when it has the same major version and is not newer than `I`; `conformance/version-cases.json` fixes the outcomes.
+  - The `2.0-draft.N` protocol identifier and the `foss-ci-runner/…` protocol string are removed: the compiled job `specVersion` becomes `spec` and carries the workflow's `spec`; discovery, registration, and session messages replace `protocol` with `spec`; a runner of a different major version is rejected with HTTP 409 `spec_incompatible`; OpenAPI `info.version` is the specification version.
+  - Version suffixes are removed from identifiers: execution profiles `oci.v1` and `oci-image.v1` become `oci` and `oci-image`, features `artifacts.v1` and `caches.v1` become `artifacts` and `caches`, the base path `/api/runner/v2` becomes `/api/runner`, and schema `$id`s drop `.v1`/`.v2`.
+  - The TypeScript exports `ciActionsSchemaVersion`, `runnerProtocolVersion`, and `runnerProtocolIdentifier` are removed; `ciSpecVersion` exposes the package version.
+  - The compiled runner job is a closed `oneOf` over execution profiles keyed by `requirements.executionProfile`: `oci` jobs carry `execution` and `steps`, `oci-image` jobs carry `build` and no steps.
+  - `requirements.isolation` (`container` or `microvm`) is required in every compiled job.
+  - The compiled job network moves from the `execution.network` string to a required top-level `network` object; the workflow job `network` becomes the same object shape with a `ports` default of `[443]`.
+  - The unrestricted `bridge` network mode is removed from workflows, compiled jobs, and runner capabilities; `egress` with a non-empty host allowlist replaces it and `none` remains the default.
+  - Compiled job `permissions.packages` is replaced by the required `permissions.images` (`none` or `push`).
+  - Workflow `permissions.packages` is replaced by the required `images` (`none`, `candidate`, `publish`), `npm`, and `releaseAssets` rights; job-level permissions are a separate object limited to `images: none|candidate`.
+  - Workflow and compiled `execution.image` accept either a digest-pinned string or a `{ candidate }` reference.
+  - `RunnerCapabilities` requires `isolation` and native `platforms`; a runner advertising `oci-image` must advertise only that profile and must include `microvm`.
+  - `JobLease` requires `grants` and `bindings` arrays.
+
+### Features
+
+- add the `oci-image` build profile, candidates, and coordinator publication (runner-protocol, ci-actions)
+  - Defines microVM isolation guarantees, native-only platform matching, and dedicated builder runners.
+  - Adds attempt-scoped pull and push image grants and candidate bindings outside the compiled plan digest, and the fenced idempotent `PUT .../attempts/{attemptId}/image` record endpoint.
+  - Defines build jobs expanded per platform, deterministic RFC 8785 candidate index assembly, trust-scoped candidate namespaces, and untrusted candidate retention.
+  - Defines egress enforcement: runner-owned DNS, address pinning, SNI and Host checks, and blocking of non-global addresses.
+  - Adds the workflow `publish` block for image promotion, npm, and release assets with protected-tag qualification, recorded alias predecessors, idempotent publication, and resume by authorized maintainers.
+  - Exports `ciSpecVersion`, `executionProfileIdentifiers`, and `runnerFeatureIdentifiers`, publishes `version-cases.json`, and adds workflow, compile-level, runner-job, wire-message, digest, version, and behavior conformance fixtures.
+
+### Maintenance
+
+- release tooling currency: `pnpm@12.5.0`, `@git.zone/tsbuild` 5.0.0, `@git.zone/tsrun` 3.0.0, `@git.zone/tstest` 6.2.1, `@types/node` 26.6.1; `test:types` type-checks the tests with library checks instead of `--skiplibcheck` (tooling)
+- keep `readme.hints.md` out of the published package (packaging)
+  - npm includes every root `readme.*` file regardless of `files`, so the hints now live in the untracked `.nogit/` folder.
+
+## 2026-07-31 - 0.2.0
+
+### Features
+
+- publish runner protocol 2.0-draft.2 archive conformance (runner-protocol)
+  - Updates runner protocol identifiers, OpenAPI metadata, runner job schema, and conformance fixtures to 2.0-draft.2.
+  - Adds exported tar.gz archive conformance cases covering valid archives, unsafe paths and links, and archive limit failures.
+  - Defines the 134,217,728-byte archive path metadata ceiling and exposes it in TypeScript metadata.
+
+## 2026-07-30 - 0.1.0
+
+### Features
+
+- add draft CI runner and workflow specifications (spec)
+  - Define draft runner v2 protocol, OpenAPI assets, and compiled runner job schema.
+  - Add ci_actions.yml schema, protocol documentation, examples, and TypeScript asset metadata exports.
+  - Add conformance fixtures and tests for schemas, runner messages, digest canonicalization, and workflow validation.