@ship.zone/ci-spec 2.0.0 → 2.1.0

package/dist_ts/constants.d.ts

@@ -181,6 +181,46 @@ export declare const compilationFailureCodes: readonly [{
     readonly code: "secret_too_short";
     readonly layer: "run";
 }];
+/**
+ * The prefix of every environment name the specification reserves (spec/ci-actions.md, Jobs and
+ * Steps; spec/runner-protocol.md, OCI Container Profile): workflow authors cannot define a name
+ * with it, and a compiled job carries only the reserved step variables with it.
+ */
+export declare const reservedEnvironmentPrefix: "SHIPZONE_CI_";
+/** The matrix values of a compiled step, as RFC 8785 JSON object text (spec/ci-actions.md, Matrix). */
+export declare const matrixEnvironmentName: "SHIPZONE_CI_MATRIX_JSON";
+/** The manual inputs of a run, as RFC 8785 JSON object text (spec/ci-actions.md, Matrix). */
+export declare const inputsEnvironmentName: "SHIPZONE_CI_INPUTS_JSON";
+/**
+ * The reserved variables every compiled `oci` and `vm` step carries (spec/runner-protocol.md, OCI
+ * Container Profile).
+ */
+export declare const reservedStepEnvironmentNames: readonly ["SHIPZONE_CI_MATRIX_JSON", "SHIPZONE_CI_INPUTS_JSON"];
+/**
+ * The environment name through which a runner delivers npm read grants to `oci` and `vm` steps,
+ * reserved in a job with `npmRead` (spec/runner-protocol.md, npm Read Grants).
+ */
+export declare const npmUserConfigEnvironmentName: "NPM_CONFIG_USERCONFIG";
+/**
+ * The BuildKit secret id through which a runner delivers npm read grants to an `oci-image` build,
+ * reserved in a job with `npmRead` (spec/runner-protocol.md, npm Read Grants).
+ */
+export declare const npmBuildSecretId: "npmrc";
+/** The prefix of the image label keys reserved for the coordinator (spec/ci-actions.md, Image Builds). */
+export declare const reservedImageLabelPrefix: "zone.ship.ci.";
+/**
+ * The image label keys reserved for the coordinator besides the reserved prefix (spec/ci-actions.md,
+ * Image Builds). The coordinator compiles `revision` and `source` into every build job and `version`
+ * on a run with a tag version (spec/ci-actions.md, Compiled Jobs).
+ */
+export declare const reservedImageLabelKeys: readonly ["org.opencontainers.image.revision", "org.opencontainers.image.source", "org.opencontainers.image.version"];
+/**
+ * Every runner job failure code in precedence order, mirrored from
+ * `conformance/runner-job-cases.json` `failureCodes`: the code a coordinator or runner reports for a
+ * compiled job that is not coherent (spec/runner-protocol.md, Job Coherence). The conformance tests
+ * assert both sources and the prose table agree.
+ */
+export declare const runnerJobFailureCodes: readonly ["spec_incompatible", "job_schema_invalid", "job_secret_incoherent", "job_limit_incoherent", "job_resources_incoherent", "job_environment_incoherent", "job_command_limit_exceeded", "job_secret_inadmissible", "job_digest_mismatch"];
 export declare const ciSpecAssetPaths: {
     readonly runnerOpenApi: "spec/runner.openapi.json";
     readonly runnerProtocol: "spec/runner-protocol.md";
@@ -194,6 +234,8 @@ export declare const ciSpecAssetPaths: {
     readonly versionCases: "conformance/version-cases.json";
     readonly compileCases: "conformance/compile-cases.json";
     readonly compileCasesSchema: "conformance/compile-cases.schema.json";
+    readonly runnerJobCases: "conformance/runner-job-cases.json";
+    readonly runnerJobCasesSchema: "conformance/runner-job-cases.schema.json";
     readonly ciActionsConformanceDirectory: "conformance/ci-actions";
     readonly runnerJobConformanceDirectory: "conformance/runner-jobs";
 };

package/dist_ts/constants.js

@@ -87,6 +87,60 @@ export const compilationFailureCodes = [
     { code: 'protected_secret_denied', layer: 'run' },
     { code: 'secret_too_short', layer: 'run' },
 ];
+/**
+ * The prefix of every environment name the specification reserves (spec/ci-actions.md, Jobs and
+ * Steps; spec/runner-protocol.md, OCI Container Profile): workflow authors cannot define a name
+ * with it, and a compiled job carries only the reserved step variables with it.
+ */
+export const reservedEnvironmentPrefix = 'SHIPZONE_CI_';
+/** The matrix values of a compiled step, as RFC 8785 JSON object text (spec/ci-actions.md, Matrix). */
+export const matrixEnvironmentName = 'SHIPZONE_CI_MATRIX_JSON';
+/** The manual inputs of a run, as RFC 8785 JSON object text (spec/ci-actions.md, Matrix). */
+export const inputsEnvironmentName = 'SHIPZONE_CI_INPUTS_JSON';
+/**
+ * The reserved variables every compiled `oci` and `vm` step carries (spec/runner-protocol.md, OCI
+ * Container Profile).
+ */
+export const reservedStepEnvironmentNames = [matrixEnvironmentName, inputsEnvironmentName];
+/**
+ * The environment name through which a runner delivers npm read grants to `oci` and `vm` steps,
+ * reserved in a job with `npmRead` (spec/runner-protocol.md, npm Read Grants).
+ */
+export const npmUserConfigEnvironmentName = 'NPM_CONFIG_USERCONFIG';
+/**
+ * The BuildKit secret id through which a runner delivers npm read grants to an `oci-image` build,
+ * reserved in a job with `npmRead` (spec/runner-protocol.md, npm Read Grants).
+ */
+export const npmBuildSecretId = 'npmrc';
+/** The prefix of the image label keys reserved for the coordinator (spec/ci-actions.md, Image Builds). */
+export const reservedImageLabelPrefix = 'zone.ship.ci.';
+/**
+ * The image label keys reserved for the coordinator besides the reserved prefix (spec/ci-actions.md,
+ * Image Builds). The coordinator compiles `revision` and `source` into every build job and `version`
+ * on a run with a tag version (spec/ci-actions.md, Compiled Jobs).
+ */
+export const reservedImageLabelKeys = [
+    'org.opencontainers.image.revision',
+    'org.opencontainers.image.source',
+    'org.opencontainers.image.version',
+];
+/**
+ * Every runner job failure code in precedence order, mirrored from
+ * `conformance/runner-job-cases.json` `failureCodes`: the code a coordinator or runner reports for a
+ * compiled job that is not coherent (spec/runner-protocol.md, Job Coherence). The conformance tests
+ * assert both sources and the prose table agree.
+ */
+export const runnerJobFailureCodes = [
+    'spec_incompatible',
+    'job_schema_invalid',
+    'job_secret_incoherent',
+    'job_limit_incoherent',
+    'job_resources_incoherent',
+    'job_environment_incoherent',
+    'job_command_limit_exceeded',
+    'job_secret_inadmissible',
+    'job_digest_mismatch',
+];
 export const ciSpecAssetPaths = {
     runnerOpenApi: 'spec/runner.openapi.json',
     runnerProtocol: 'spec/runner-protocol.md',
@@ -100,7 +154,9 @@ export const ciSpecAssetPaths = {
     versionCases: 'conformance/version-cases.json',
     compileCases: 'conformance/compile-cases.json',
     compileCasesSchema: 'conformance/compile-cases.schema.json',
+    runnerJobCases: 'conformance/runner-job-cases.json',
+    runnerJobCasesSchema: 'conformance/runner-job-cases.schema.json',
     ciActionsConformanceDirectory: 'conformance/ci-actions',
     runnerJobConformanceDirectory: 'conformance/runner-jobs',
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uc3RhbnRzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvY29uc3RhbnRzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUVyRDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sYUFBYSxHQUFXLFVBQVUsQ0FBQyxPQUFPLENBQUM7QUFDeEQsTUFBTSxDQUFDLE1BQU0sWUFBWSxHQUFHLE9BQWdCLENBQUM7QUFDN0MsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsYUFBc0IsQ0FBQztBQUM3RCxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxXQUFvQixDQUFDO0FBRXBFOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRztJQUN6QyxTQUFTLEVBQUUsS0FBSztJQUNoQixVQUFVLEVBQUUsV0FBVztJQUN2QixjQUFjLEVBQUUsSUFBSTtDQUNaLENBQUM7QUFFWDs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQUMsZUFBZSxFQUFFLFdBQVcsRUFBRSxRQUFRLENBQVUsQ0FBQztBQUUxRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxDQUFDLG1CQUFtQixFQUFFLG9CQUFvQixFQUFFLGlCQUFpQixDQUFVLENBQUM7QUFFL0c7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxLQUFLLENBQVUsQ0FBQztBQUV0SDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUc7SUFDckMsRUFBRSxJQUFJLEVBQUUsb0JBQW9CLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtJQUMvQyxFQUFFLElBQUksRUFBRSwyQkFBMkIsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFO0lBQ3RELEVBQUUsSUFBSSxFQUFFLHNCQUFzQixFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUU7SUFDL0MsRUFBRSxJQUFJLEVBQUUsOEJBQThCLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRTtJQUN2RCxFQUFFLElBQUksRUFBRSx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFO0lBQ2xELEVBQUUsSUFBSSxFQUFFLDZCQUE2QixFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUU7SUFDdEQsRUFBRSxJQUFJLEVBQUUsd0JBQXdCLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRTtJQUNqRCxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFO0lBQy9DLEVBQUUsSUFBSSxFQUFFLHlCQUF5QixFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUU7SUFDbEQsRUFBRSxJQUFJLEVBQUUsbUJBQW1CLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRTtJQUM1QyxFQUFFLElBQUksRUFBRSx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFO0lBQ2xELEVBQUUsSUFBSSxFQUFFLG1CQUFtQixFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUU7SUFDL0MsRUFBRSxJQUFJLEVBQUUseUJBQXlCLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtJQUNwRCxFQUFFLElBQUksRUFBRSx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ3RELEVBQUUsSUFBSSxFQUFFLGVBQWUsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQzVDLEVBQUUsSUFBSSxFQUFFLGFBQWEsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQzFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDdkQsRUFBRSxJQUFJLEVBQUUscUJBQXFCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUNsRCxFQUFFLElBQUksRUFBRSxxQkFBcUIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ2xELEVBQUUsSUFBSSxFQUFFLHVCQUF1QixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDcEQsRUFBRSxJQUFJLEVBQUUseUJBQXlCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUN0RCxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ25ELEVBQUUsSUFBSSxFQUFFLDRCQUE0QixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDekQsRUFBRSxJQUFJLEVBQUUsd0JBQXdCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUNyRCxFQUFFLElBQUksRUFBRSx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ3RELEVBQUUsSUFBSSxFQUFFLG9CQUFvQixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDakQsRUFBRSxJQUFJLEVBQUUsbUJBQW1CLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUNoRCxFQUFFLElBQUksRUFBRSx3QkFBd0IsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ3JELEVBQUUsSUFBSSxFQUFFLGtCQUFrQixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDL0MsRUFBRSxJQUFJLEVBQUUsc0JBQXNCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUNuRCxFQUFFLElBQUksRUFBRSw2QkFBNkIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQzFELEVBQUUsSUFBSSxFQUFFLDRCQUE0QixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDekQsRUFBRSxJQUFJLEVBQUUsMkJBQTJCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUN4RCxFQUFFLElBQUksRUFBRSx1QkFBdUIsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFO0lBQ2xELEVBQUUsSUFBSSxFQUFFLHlCQUF5QixFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUU7SUFDcEQsRUFBRSxJQUFJLEVBQUUsMkJBQTJCLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtJQUN0RCxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFO0lBQ2pELEVBQUUsSUFBSSxFQUFFLDRCQUE0QixFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUU7SUFDdkQsRUFBRSxJQUFJLEVBQUUsZUFBZSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUU7SUFDMUMsRUFBRSxJQUFJLEVBQUUsc0JBQXNCLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRTtJQUM5QyxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFO0lBQzlDLEVBQUUsSUFBSSxFQUFFLGVBQWUsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFO0lBQ3ZDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUU7SUFDekMsRUFBRSxJQUFJLEVBQUUsa0JBQWtCLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRTtJQUMxQyxFQUFFLElBQUksRUFBRSxvQkFBb0IsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFO0lBQzVDLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUU7SUFDeEMsRUFBRSxJQUFJLEVBQUUseUJBQXlCLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRTtJQUNqRCxFQUFFLElBQUksRUFBRSxrQkFBa0IsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFO0NBQ2xDLENBQUM7QUFFWCxNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRztJQUM5QixhQUFhLEVBQUUsMEJBQTBCO0lBQ3pDLGNBQWMsRUFBRSx5QkFBeUI7SUFDekMsaUJBQWlCLEVBQUUsb0JBQW9CO0lBQ3ZDLGVBQWUsRUFBRSxnQ0FBZ0M7SUFDakQsZUFBZSxFQUFFLGdDQUFnQztJQUNqRCxzQkFBc0IsRUFBRSwrQkFBK0I7SUFDdkQsa0JBQWtCLEVBQUUsa0NBQWtDO0lBQ3RELFdBQVcsRUFBRSwrQkFBK0I7SUFDNUMsWUFBWSxFQUFFLGdDQUFnQztJQUM5QyxZQUFZLEVBQUUsZ0NBQWdDO0lBQzlDLFlBQVksRUFBRSxnQ0FBZ0M7SUFDOUMsa0JBQWtCLEVBQUUsdUNBQXVDO0lBQzNELDZCQUE2QixFQUFFLHdCQUF3QjtJQUN2RCw2QkFBNkIsRUFBRSx5QkFBeUI7Q0FDaEQsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uc3RhbnRzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvY29uc3RhbnRzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUVyRDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sYUFBYSxHQUFXLFVBQVUsQ0FBQyxPQUFPLENBQUM7QUFDeEQsTUFBTSxDQUFDLE1BQU0sWUFBWSxHQUFHLE9BQWdCLENBQUM7QUFDN0MsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsYUFBc0IsQ0FBQztBQUM3RCxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxXQUFvQixDQUFDO0FBRXBFOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRztJQUN6QyxTQUFTLEVBQUUsS0FBSztJQUNoQixVQUFVLEVBQUUsV0FBVztJQUN2QixjQUFjLEVBQUUsSUFBSTtDQUNaLENBQUM7QUFFWDs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQUMsZUFBZSxFQUFFLFdBQVcsRUFBRSxRQUFRLENBQVUsQ0FBQztBQUUxRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxDQUFDLG1CQUFtQixFQUFFLG9CQUFvQixFQUFFLGlCQUFpQixDQUFVLENBQUM7QUFFL0c7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxLQUFLLENBQVUsQ0FBQztBQUV0SDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUc7SUFDckMsRUFBRSxJQUFJLEVBQUUsb0JBQW9CLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtJQUMvQyxFQUFFLElBQUksRUFBRSwyQkFBMkIsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFO0lBQ3RELEVBQUUsSUFBSSxFQUFFLHNCQUFzQixFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUU7SUFDL0MsRUFBRSxJQUFJLEVBQUUsOEJBQThCLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRTtJQUN2RCxFQUFFLElBQUksRUFBRSx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFO0lBQ2xELEVBQUUsSUFBSSxFQUFFLDZCQUE2QixFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUU7SUFDdEQsRUFBRSxJQUFJLEVBQUUsd0JBQXdCLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRTtJQUNqRCxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFO0lBQy9DLEVBQUUsSUFBSSxFQUFFLHlCQUF5QixFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUU7SUFDbEQsRUFBRSxJQUFJLEVBQUUsbUJBQW1CLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRTtJQUM1QyxFQUFFLElBQUksRUFBRSx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFO0lBQ2xELEVBQUUsSUFBSSxFQUFFLG1CQUFtQixFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUU7SUFDL0MsRUFBRSxJQUFJLEVBQUUseUJBQXlCLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtJQUNwRCxFQUFFLElBQUksRUFBRSx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ3RELEVBQUUsSUFBSSxFQUFFLGVBQWUsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQzVDLEVBQUUsSUFBSSxFQUFFLGFBQWEsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQzFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDdkQsRUFBRSxJQUFJLEVBQUUscUJBQXFCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUNsRCxFQUFFLElBQUksRUFBRSxxQkFBcUIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ2xELEVBQUUsSUFBSSxFQUFFLHVCQUF1QixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDcEQsRUFBRSxJQUFJLEVBQUUseUJBQXlCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUN0RCxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ25ELEVBQUUsSUFBSSxFQUFFLDRCQUE0QixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDekQsRUFBRSxJQUFJLEVBQUUsd0JBQXdCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUNyRCxFQUFFLElBQUksRUFBRSx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ3RELEVBQUUsSUFBSSxFQUFFLG9CQUFvQixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDakQsRUFBRSxJQUFJLEVBQUUsbUJBQW1CLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUNoRCxFQUFFLElBQUksRUFBRSx3QkFBd0IsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ3JELEVBQUUsSUFBSSxFQUFFLGtCQUFrQixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDL0MsRUFBRSxJQUFJLEVBQUUsc0JBQXNCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUNuRCxFQUFFLElBQUksRUFBRSw2QkFBNkIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQzFELEVBQUUsSUFBSSxFQUFFLDRCQUE0QixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDekQsRUFBRSxJQUFJLEVBQUUsMkJBQTJCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUN4RCxFQUFFLElBQUksRUFBRSx1QkFBdUIsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFO0lBQ2xELEVBQUUsSUFBSSxFQUFFLHlCQUF5QixFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUU7SUFDcEQsRUFBRSxJQUFJLEVBQUUsMkJBQTJCLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtJQUN0RCxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFO0lBQ2pELEVBQUUsSUFBSSxFQUFFLDRCQUE0QixFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUU7SUFDdkQsRUFBRSxJQUFJLEVBQUUsZUFBZSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUU7SUFDMUMsRUFBRSxJQUFJLEVBQUUsc0JBQXNCLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRTtJQUM5QyxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFO0lBQzlDLEVBQUUsSUFBSSxFQUFFLGVBQWUsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFO0lBQ3ZDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUU7SUFDekMsRUFBRSxJQUFJLEVBQUUsa0JBQWtCLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRTtJQUMxQyxFQUFFLElBQUksRUFBRSxvQkFBb0IsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFO0lBQzVDLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUU7SUFDeEMsRUFBRSxJQUFJLEVBQUUseUJBQXlCLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRTtJQUNqRCxFQUFFLElBQUksRUFBRSxrQkFBa0IsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFO0NBQ2xDLENBQUM7QUFFWDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUcsY0FBdUIsQ0FBQztBQUVqRSx1R0FBdUc7QUFDdkcsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcseUJBQWtDLENBQUM7QUFFeEUsNkZBQTZGO0FBQzdGLE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLHlCQUFrQyxDQUFDO0FBRXhFOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLENBQUMscUJBQXFCLEVBQUUscUJBQXFCLENBQVUsQ0FBQztBQUVwRzs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyx1QkFBZ0MsQ0FBQztBQUU3RTs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRyxPQUFnQixDQUFDO0FBRWpELDBHQUEwRztBQUMxRyxNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxlQUF3QixDQUFDO0FBRWpFOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRztJQUNwQyxtQ0FBbUM7SUFDbkMsaUNBQWlDO0lBQ2pDLGtDQUFrQztDQUMxQixDQUFDO0FBRVg7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSxxQkFBcUIsR0FBRztJQUNuQyxtQkFBbUI7SUFDbkIsb0JBQW9CO0lBQ3BCLHVCQUF1QjtJQUN2QixzQkFBc0I7SUFDdEIsMEJBQTBCO0lBQzFCLDRCQUE0QjtJQUM1Qiw0QkFBNEI7SUFDNUIseUJBQXlCO0lBQ3pCLHFCQUFxQjtDQUNiLENBQUM7QUFFWCxNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRztJQUM5QixhQUFhLEVBQUUsMEJBQTBCO0lBQ3pDLGNBQWMsRUFBRSx5QkFBeUI7SUFDekMsaUJBQWlCLEVBQUUsb0JBQW9CO0lBQ3ZDLGVBQWUsRUFBRSxnQ0FBZ0M7SUFDakQsZUFBZSxFQUFFLGdDQUFnQztJQUNqRCxzQkFBc0IsRUFBRSwrQkFBK0I7SUFDdkQsa0JBQWtCLEVBQUUsa0NBQWtDO0lBQ3RELFdBQVcsRUFBRSwrQkFBK0I7SUFDNUMsWUFBWSxFQUFFLGdDQUFnQztJQUM5QyxZQUFZLEVBQUUsZ0NBQWdDO0lBQzlDLFlBQVksRUFBRSxnQ0FBZ0M7SUFDOUMsa0JBQWtCLEVBQUUsdUNBQXVDO0lBQzNELGNBQWMsRUFBRSxtQ0FBbUM7SUFDbkQsb0JBQW9CLEVBQUUsMENBQTBDO0lBQ2hFLDZCQUE2QixFQUFFLHdCQUF3QjtJQUN2RCw2QkFBNkIsRUFBRSx5QkFBeUI7Q0FDaEQsQ0FBQyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ship.zone/ci-spec",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "private": false,
   "description": "The ship.zone CI standard: language-neutral CI workflow and runner protocol specifications.",
   "main": "dist_ts/index.js",
@@ -22,6 +22,8 @@
     "./version-cases.json": "./conformance/version-cases.json",
     "./compile-cases.json": "./conformance/compile-cases.json",
     "./compile-cases.schema.json": "./conformance/compile-cases.schema.json",
+    "./runner-job-cases.json": "./conformance/runner-job-cases.json",
+    "./runner-job-cases.schema.json": "./conformance/runner-job-cases.schema.json",
     "./conformance/ci-actions/*": "./conformance/ci-actions/*",
     "./conformance/runner-jobs/*": "./conformance/runner-jobs/*"
   },
@@ -65,7 +67,7 @@
   ],
   "scripts": {
     "test": "tstest test/ --verbose",
-    "test:types": "tsbuild check test/**/*",
+    "test:types": "tsbuild check 'test/**/*'",
     "lint:openapi": "redocly lint spec/runner.openapi.json --extends=spec",
     "build": "tsbuild tsfolders"
   }

package/readme.md

@@ -1,6 +1,6 @@
 # @ship.zone/ci-spec
 
-`@ship.zone/ci-spec` defines the ship.zone CI standard: the language-neutral workflow and runner contracts between a coordinator and its runners. The normative artifacts are OpenAPI, JSON Schema, protocol prose, and conformance cases. TypeScript exports provide only the specification version, draft metadata, identifier lists, and asset locations.
+`@ship.zone/ci-spec` defines the ship.zone CI standard: the language-neutral workflow and runner contracts between a coordinator and its runners. The normative artifacts are OpenAPI, JSON Schema, protocol prose, and conformance cases. TypeScript exports provide only the specification version, draft metadata, identifier lists, failure codes, reserved names, and asset locations.
 
 The current specification is a draft. It is intentionally incompatible with the legacy internal runner protocol it replaces and must not be treated as stable until independent implementations pass the conformance suite.
 
@@ -12,7 +12,7 @@ The package version is the specification version, and it is the only version in
 spec: 2.0.0
 ```
 
-Compiled jobs and runner protocol messages carry the same `spec` field. An implementation built against version `I` accepts a declared version `D` when both have the same major version and `D` is not newer than `I`; the rule is defined in `spec/runner-protocol.md` and fixed by `conformance/version-cases.json`. Every incompatible change is a new major version, and additions arrive as new minor versions: a workflow that uses a construct introduced in a later minor version declares that version or a later one. Version 2.0.0 renames the package and its normative identifiers (see Migrating from @foss.global/ci-spec), removes the 1.x cross-version rules, and completes the compilation rules: one stable failure code per compilation failure with a fixed precedence, a stricter YAML subset, the derivation of every compiled job member, and the identities of expanded nodes. The history of the 1.x rules is in the changelog.
+Compiled jobs and runner protocol messages carry the same `spec` field. An implementation built against version `I` accepts a declared version `D` when both have the same major version and `D` is not newer than `I`; the rule is defined in `spec/runner-protocol.md` and fixed by `conformance/version-cases.json`. Every incompatible change is a new major version, and additions arrive as new minor versions: a workflow that uses a construct introduced in a later minor version declares that version or a later one. Version 2.0.0 renames the package and its normative identifiers (see Migrating from @foss.global/ci-spec), removes the 1.x cross-version rules, and completes the compilation rules: one stable failure code per compilation failure with a fixed precedence, a stricter YAML subset, the derivation of every compiled job member, and the identities of expanded nodes. Version 2.1.0 adds job failure codes: every coherence rule of a compiled job has exactly one code, and a job that is not coherent carries the code of the first rule it violates (see Job Coherence in `spec/runner-protocol.md`); it also exports the reserved names as constants. Documents written against 2.0.0 stay valid. The history of the 1.x rules is in the changelog.
 
 ## Issue Reporting and Security
 
@@ -68,7 +68,8 @@ ajv.addSchema({
 - `conformance/archive-cases.json`: byte-identical gzip/tar acceptance and rejection vectors.
 - `conformance/version-cases.json`: specification version compatibility outcomes.
 - `conformance/compile-cases.json` and its schema `conformance/compile-cases.schema.json`: the compilation failure codes in precedence order, trigger pattern and tag version vectors, the expected code of every invalid workflow fixture, and compile vectors that bind a workflow, run context, and deployment policy to a failure code, to not-triggered, or to the compiled nodes and plan digests. The package runs no compiler; its tests check that every vector is schema-valid and internally coherent, and compilers run the vectors.
-- `conformance/ci-actions/` and `conformance/runner-jobs/`: valid and invalid data fixtures. `conformance/ci-actions/compile-invalid/` holds schema-valid workflows that a compiler must reject; each is bound to a case in `runner-cases.json`.
+- `conformance/runner-job-cases.json` and its schema `conformance/runner-job-cases.schema.json`: the job failure codes in precedence order and the expected outcome of every runner job fixture and of inline version cases.
+- `conformance/ci-actions/` and `conformance/runner-jobs/`: valid and invalid data fixtures. `conformance/ci-actions/compile-invalid/` holds schema-valid workflows that a compiler must reject; each is bound to a case in `runner-cases.json`. `conformance/runner-jobs/incoherent/` holds schema-valid compiled jobs that fail a later rule of Job Coherence; each is bound to a case in `runner-job-cases.json`.
 
 The package exports these raw asset subpaths:
 
@@ -84,10 +85,12 @@ The package exports these raw asset subpaths:
 - `@ship.zone/ci-spec/version-cases.json`
 - `@ship.zone/ci-spec/compile-cases.json`
 - `@ship.zone/ci-spec/compile-cases.schema.json`
+- `@ship.zone/ci-spec/runner-job-cases.json`
+- `@ship.zone/ci-spec/runner-job-cases.schema.json`
 - `@ship.zone/ci-spec/conformance/ci-actions/*`
 - `@ship.zone/ci-spec/conformance/runner-jobs/*`
 
-TypeScript metadata exposes package-root-relative asset locations separately:
+TypeScript metadata exposes package-root-relative asset locations, failure codes, and reserved names separately:
 
 ```ts
 import {
@@ -96,6 +99,9 @@ import {
   compilationFailureCodes,
   executionProfileIdentifiers,
   maximumArchivePathMetadataBytes,
+  reservedEnvironmentPrefix,
+  reservedImageLabelPrefix,
+  runnerJobFailureCodes,
   runnerProtocolBasePath,
 } from '@ship.zone/ci-spec';
 
@@ -105,6 +111,9 @@ console.log(executionProfileIdentifiers.imageBuild); // oci-image
 console.log(maximumArchivePathMetadataBytes); // 134217728
 console.log(ciSpecAssetPaths.runnerOpenApi);
 console.log(compilationFailureCodes[0]); // { code: 'workflow_too_large', layer: 'source' }
+console.log(runnerJobFailureCodes[1]); // job_schema_invalid
+console.log(reservedEnvironmentPrefix); // SHIPZONE_CI_
+console.log(reservedImageLabelPrefix); // zone.ship.ci.
 ```
 
 Generated language bindings are deliberately not normative. Implementations must follow the published OpenAPI, JSON Schemas, prose rules, and conformance cases.

package/spec/runner-protocol.md

@@ -97,12 +97,42 @@ A `vm` job always carries `requirements.platform`, and it is leased only to a ru
 
 Image builds run on dedicated builder runners. A runner that advertises `oci-image` advertises no other execution profile and includes `microvm` isolation; the capability schema rejects any other combination. A runner that advertises `vm` includes `microvm` isolation and may also advertise `oci`, but never `oci-image`; the capability schema rejects a `vm` runner without `microvm`.
 
-Every compiled job is internally coherent before enqueueing and again before acceptance: the job has exactly the shape of its execution profile; `source.tar-gz` is required; non-empty artifact or cache declarations require their matching feature and permission; `none` permission requires an empty declaration list; a read-write cache requires `caches: read-write`; `images: push` is present exactly for `oci-image`; a `vm` job carries `microvm` isolation and `requirements.platform`; the `requirements.platform` of an `oci` or `oci-image` job is a `linux` platform; in a job with `npmRead`, no compiled step environment defines `NPM_CONFIG_USERCONFIG` and no build secret has id `npmrc`; every build secret names a key of `secrets` and every key of `secrets` is named by a build secret in an `oci-image` job; source metadata and every declared artifact/cache maximum fit `requirements.limits`; `resources.sharedMemoryBytes` is at most `resources.memoryBytes` when both are present; declaration counts fit their required maxima; and every job requirement fits the accepted runner capability snapshot.
+Every compiled job is coherent, as Job Coherence defines, before enqueueing and again before acceptance, and every job requirement fits the accepted runner capability snapshot.
 
 A lease is coherent with its job when every candidate reference in the job has exactly one binding with that candidate name and no binding is unreferenced; at most one grant exists per registry, repository, and access; every bound image and every private base image has a pull grant for its repository; an `oci-image` lease has exactly one push grant and an `oci` or `vm` lease has none; `npmGrants` is present exactly when the job declares `npmRead`, with exactly one grant per `npmRead` entry that carries the entry's registry and scopes.
 
 A violation is rejected before enqueueing or abandoned as `runner_error` before acceptance.
 
+## Job Coherence
+
+A compiled job is *coherent* when it violates no rule of the following table. The coordinator checks a job before enqueueing it and the runner checks the job of a lease before acceptance, both with the job's secret values inserted, as a lease carries it. A job that is not coherent has exactly one *job failure code*: the code of the first row, in table order, whose rule it violates. The rows after the `job_schema_invalid` rows are checked only for a job that satisfies `schemas/runner-job.schema.json`, and the `job_schema_invalid` rows list the rules of this protocol that the schema enforces. A coordinator that rejects a job reports its code with the rejection. A runner abandons the lease as `runner_error` and reports the code only in its own diagnostics, because `AbandonJobRequest` carries no code.
+
+| Code | Rule |
+| --- | --- |
+| `spec_incompatible` | the job's `spec` is canonical and its outcome for the checking implementation is `newer` or `major-mismatch` (Specification Version) |
+| `job_schema_invalid` | the job fails `schemas/runner-job.schema.json`, including a missing, non-string, or malformed `spec` |
+| `job_schema_invalid` | the job does not have exactly the shape of its execution profile |
+| `job_schema_invalid` | `requirements.features` does not contain `source.tar-gz` |
+| `job_schema_invalid` | a non-empty artifact or cache declaration list whose matching feature is missing from `requirements.features` or whose matching permission is `none` |
+| `job_schema_invalid` | a read-write cache without `caches: read-write` |
+| `job_schema_invalid` | `images: push` in a job that is not `oci-image`, or its absence in an `oci-image` job |
+| `job_schema_invalid` | a `vm` job without `microvm` isolation or without `requirements.platform` |
+| `job_schema_invalid` | an `oci` or `oci-image` job whose `requirements.platform` is not a `linux` platform |
+| `job_schema_invalid` | in a job with `npmRead`, a step environment that defines `NPM_CONFIG_USERCONFIG`, or a build secret with id `npmrc` (npm Read Grants) |
+| `job_secret_incoherent` | in an `oci-image` job, a build secret whose `environment` is not a key of `secrets`, or a key of `secrets` that no build secret names |
+| `job_limit_incoherent` | a source `sizeBytes`, `extractedSizeBytes`, or `entryCount` above `maximumSourceArchiveBytes`, `maximumSourceExtractedBytes`, or `maximumSourceEntries` of `requirements.limits` |
+| `job_limit_incoherent` | an artifact or cache `maximumBytes`, `maximumExtractedBytes`, or `maximumEntries` above the matching artifact or cache maximum of `requirements.limits` |
+| `job_limit_incoherent` | more artifacts than `maximumArtifacts`, or more caches than `maximumCaches` |
+| `job_resources_incoherent` | `resources.sharedMemoryBytes` above `resources.memoryBytes` |
+| `job_environment_incoherent` | a secret target that starts with `SHIPZONE_CI_`, or a step environment name that starts with it and is not `SHIPZONE_CI_MATRIX_JSON` or `SHIPZONE_CI_INPUTS_JSON` (OCI Container Profile) |
+| `job_environment_incoherent` | an `oci` or `vm` step whose environment lacks `SHIPZONE_CI_MATRIX_JSON` or `SHIPZONE_CI_INPUTS_JSON`, or whose value of one of them is not the RFC 8785 serialization of a JSON object (OCI Container Profile) |
+| `job_environment_incoherent` | an `oci` or `vm` step whose environment names, the job's secret targets, and, in a job with `npmRead`, `NPM_CONFIG_USERCONFIG` are not unique or number more than 128 (OCI Container Profile, Protocol Limits) |
+| `job_command_limit_exceeded` | a step command whose arguments total more than 131,072 UTF-8 bytes (Protocol Limits) |
+| `job_secret_inadmissible` | a value of `secrets` shorter than 8 UTF-8 bytes (Secret Redaction) |
+| `job_digest_mismatch` | a `compiledPlanDigest` other than the digest Canonical Digests defines for the job |
+
+Whether a job requirement fits a runner capability snapshot and whether a lease is coherent with its job depend on more than the job, so they are not rules of this table and have no job failure code. `conformance/runner-job-cases.json` lists the codes in table order as `failureCodes` and fixes the code of every runner job fixture.
+
 ## Sessions and Leases
 
 Each runner process starts a new session. Session identity is included in every claim and job mutation. Session creation is idempotent by `(runnerId, sessionRequestId, canonicalRequestDigest)`. The coordinator durably stores the exact response before atomically making older sessions stale. An exact retry returns the same session and response; a changed body returns HTTP 409. The key remains tombstoned for the resulting session lifetime plus ten minutes. A different request ID intentionally starts a new session and immediately fences older sessions when the new response is committed.

package/spec/runner.openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "ship.zone CI Runner Protocol",
-    "version": "2.0.0",
+    "version": "2.1.0",
     "description": "Language-neutral, outbound runner protocol of @ship.zone/ci-spec. info.version is the specification version this description is written against. This draft is incompatible with the legacy internal runner protocol it replaces.",
     "license": {
       "name": "MIT",

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@ship.zone/ci-spec',
-  version: '2.0.0',
+  version: '2.1.0',
   description: 'The ship.zone CI standard: language-neutral CI workflow and runner protocol specifications.'
 }

package/ts/constants.ts

@@ -94,6 +94,69 @@ export const compilationFailureCodes = [
   { code: 'secret_too_short', layer: 'run' },
 ] as const;
 
+/**
+ * The prefix of every environment name the specification reserves (spec/ci-actions.md, Jobs and
+ * Steps; spec/runner-protocol.md, OCI Container Profile): workflow authors cannot define a name
+ * with it, and a compiled job carries only the reserved step variables with it.
+ */
+export const reservedEnvironmentPrefix = 'SHIPZONE_CI_' as const;
+
+/** The matrix values of a compiled step, as RFC 8785 JSON object text (spec/ci-actions.md, Matrix). */
+export const matrixEnvironmentName = 'SHIPZONE_CI_MATRIX_JSON' as const;
+
+/** The manual inputs of a run, as RFC 8785 JSON object text (spec/ci-actions.md, Matrix). */
+export const inputsEnvironmentName = 'SHIPZONE_CI_INPUTS_JSON' as const;
+
+/**
+ * The reserved variables every compiled `oci` and `vm` step carries (spec/runner-protocol.md, OCI
+ * Container Profile).
+ */
+export const reservedStepEnvironmentNames = [matrixEnvironmentName, inputsEnvironmentName] as const;
+
+/**
+ * The environment name through which a runner delivers npm read grants to `oci` and `vm` steps,
+ * reserved in a job with `npmRead` (spec/runner-protocol.md, npm Read Grants).
+ */
+export const npmUserConfigEnvironmentName = 'NPM_CONFIG_USERCONFIG' as const;
+
+/**
+ * The BuildKit secret id through which a runner delivers npm read grants to an `oci-image` build,
+ * reserved in a job with `npmRead` (spec/runner-protocol.md, npm Read Grants).
+ */
+export const npmBuildSecretId = 'npmrc' as const;
+
+/** The prefix of the image label keys reserved for the coordinator (spec/ci-actions.md, Image Builds). */
+export const reservedImageLabelPrefix = 'zone.ship.ci.' as const;
+
+/**
+ * The image label keys reserved for the coordinator besides the reserved prefix (spec/ci-actions.md,
+ * Image Builds). The coordinator compiles `revision` and `source` into every build job and `version`
+ * on a run with a tag version (spec/ci-actions.md, Compiled Jobs).
+ */
+export const reservedImageLabelKeys = [
+  'org.opencontainers.image.revision',
+  'org.opencontainers.image.source',
+  'org.opencontainers.image.version',
+] as const;
+
+/**
+ * Every runner job failure code in precedence order, mirrored from
+ * `conformance/runner-job-cases.json` `failureCodes`: the code a coordinator or runner reports for a
+ * compiled job that is not coherent (spec/runner-protocol.md, Job Coherence). The conformance tests
+ * assert both sources and the prose table agree.
+ */
+export const runnerJobFailureCodes = [
+  'spec_incompatible',
+  'job_schema_invalid',
+  'job_secret_incoherent',
+  'job_limit_incoherent',
+  'job_resources_incoherent',
+  'job_environment_incoherent',
+  'job_command_limit_exceeded',
+  'job_secret_inadmissible',
+  'job_digest_mismatch',
+] as const;
+
 export const ciSpecAssetPaths = {
   runnerOpenApi: 'spec/runner.openapi.json',
   runnerProtocol: 'spec/runner-protocol.md',
@@ -107,6 +170,8 @@ export const ciSpecAssetPaths = {
   versionCases: 'conformance/version-cases.json',
   compileCases: 'conformance/compile-cases.json',
   compileCasesSchema: 'conformance/compile-cases.schema.json',
+  runnerJobCases: 'conformance/runner-job-cases.json',
+  runnerJobCasesSchema: 'conformance/runner-job-cases.schema.json',
   ciActionsConformanceDirectory: 'conformance/ci-actions',
   runnerJobConformanceDirectory: 'conformance/runner-jobs',
 } as const;