@ship.zone/ci-spec 2.0.0 → 2.1.1

package/conformance/runner-jobs/invalid/read-write-cache-read-permission.json

@@ -0,0 +1,91 @@
+{
+  "spec": "2.0.0",
+  "sourceObjectId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "workflowDigest": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "compiledPlanDigest": "3b72e3a27598c1e5a769f3c469f5d5816a6b44ab45d97bf96ca67fa67a7a2730",
+  "requirements": {
+    "executionProfile": "oci",
+    "isolation": "container",
+    "labels": ["linux"],
+    "features": ["source.tar-gz", "artifacts", "caches"],
+    "limits": {
+      "maximumSourceArchiveBytes": 1048576,
+      "maximumSourceExtractedBytes": 4194304,
+      "maximumSourceEntries": 1000,
+      "maximumArtifactArchiveBytes": 104857600,
+      "maximumArtifactExtractedBytes": 524288000,
+      "maximumArtifactEntries": 10000,
+      "maximumArtifacts": 1,
+      "maximumCacheArchiveBytes": 1073741824,
+      "maximumCacheExtractedBytes": 4294967296,
+      "maximumCacheEntries": 100000,
+      "maximumCaches": 1,
+      "maximumLogChunkBytes": 65536,
+      "maximumTotalLogBytes": 10485760,
+      "maximumWorkspaceBytes": 8589934592,
+      "maximumWorkspaceEntries": 100000
+    }
+  },
+  "permissions": {
+    "source": "read",
+    "artifacts": "write",
+    "caches": "read",
+    "images": "none"
+  },
+  "network": {
+    "mode": "none"
+  },
+  "execution": {
+    "profile": "oci",
+    "image": "registry.example/ci@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+    "workingDirectory": "/workspace"
+  },
+  "steps": [
+    {
+      "name": "Test",
+      "command": ["pnpm", "test"],
+      "environment": {
+        "CI": "true",
+        "SHIPZONE_CI_INPUTS_JSON": "{}",
+        "SHIPZONE_CI_MATRIX_JSON": "{}"
+      }
+    }
+  ],
+  "source": {
+    "format": "tar.gz",
+    "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+    "sizeBytes": 1024,
+    "extractedSizeBytes": 4096,
+    "entryCount": 4
+  },
+  "secrets": {},
+  "timeoutMs": 3600000,
+  "resources": {
+    "memoryBytes": 268435456,
+    "cpus": 1,
+    "pids": 256
+  },
+  "artifacts": [
+    {
+      "name": "test-results",
+      "path": ".nogit/testlogs",
+      "format": "tar.gz",
+      "when": "failure",
+      "required": false,
+      "maximumBytes": 104857600,
+      "maximumExtractedBytes": 524288000,
+      "maximumEntries": 10000
+    }
+  ],
+  "caches": [
+    {
+      "name": "pnpm",
+      "key": "pnpm-store",
+      "paths": [".pnpm-store"],
+      "access": "read-write",
+      "maximumBytes": 1073741824,
+      "maximumExtractedBytes": 4294967296,
+      "maximumEntries": 100000
+    }
+  ]
+}

package/conformance/runner-jobs/invalid/source-feature-missing.json

@@ -0,0 +1,70 @@
+{
+  "spec": "2.0.0",
+  "sourceObjectId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "workflowDigest": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "compiledPlanDigest": "3c079a6e04737b072228d016367af53b7a3abcfecd5891c46be34bc6668fcfcc",
+  "requirements": {
+    "executionProfile": "oci",
+    "isolation": "container",
+    "labels": ["linux"],
+    "features": [],
+    "limits": {
+      "maximumSourceArchiveBytes": 1048576,
+      "maximumSourceExtractedBytes": 4194304,
+      "maximumSourceEntries": 1000,
+      "maximumArtifactArchiveBytes": 0,
+      "maximumArtifactExtractedBytes": 0,
+      "maximumArtifactEntries": 0,
+      "maximumArtifacts": 0,
+      "maximumCacheArchiveBytes": 0,
+      "maximumCacheExtractedBytes": 0,
+      "maximumCacheEntries": 0,
+      "maximumCaches": 0,
+      "maximumLogChunkBytes": 65536,
+      "maximumTotalLogBytes": 10485760,
+      "maximumWorkspaceBytes": 268435456,
+      "maximumWorkspaceEntries": 100000
+    }
+  },
+  "permissions": {
+    "source": "read",
+    "artifacts": "none",
+    "caches": "none",
+    "images": "none"
+  },
+  "network": {
+    "mode": "none"
+  },
+  "execution": {
+    "profile": "oci",
+    "image": "registry.example/ci@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+    "workingDirectory": "/workspace"
+  },
+  "steps": [
+    {
+      "name": "Test",
+      "command": ["pnpm", "test"],
+      "environment": {
+        "CI": "true",
+        "SHIPZONE_CI_INPUTS_JSON": "{}",
+        "SHIPZONE_CI_MATRIX_JSON": "{}"
+      }
+    }
+  ],
+  "source": {
+    "format": "tar.gz",
+    "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+    "sizeBytes": 1024,
+    "extractedSizeBytes": 4096,
+    "entryCount": 4
+  },
+  "secrets": {},
+  "timeoutMs": 60000,
+  "resources": {
+    "memoryBytes": 268435456,
+    "cpus": 1,
+    "pids": 256
+  },
+  "artifacts": [],
+  "caches": []
+}

package/conformance/runner-jobs/invalid/vm-without-platform.json

@@ -0,0 +1,81 @@
+{
+  "spec": "2.0.0",
+  "sourceObjectId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "workflowDigest": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "compiledPlanDigest": "9f86752c391371c3f59bd8820001b9f12a4097f264f7c7aed5f348271860ad19",
+  "requirements": {
+    "executionProfile": "vm",
+    "isolation": "microvm",
+    "labels": ["linux"],
+    "features": ["source.tar-gz"],
+    "limits": {
+      "maximumSourceArchiveBytes": 1048576,
+      "maximumSourceExtractedBytes": 4194304,
+      "maximumSourceEntries": 1000,
+      "maximumArtifactArchiveBytes": 0,
+      "maximumArtifactExtractedBytes": 0,
+      "maximumArtifactEntries": 0,
+      "maximumArtifacts": 0,
+      "maximumCacheArchiveBytes": 0,
+      "maximumCacheExtractedBytes": 0,
+      "maximumCacheEntries": 0,
+      "maximumCaches": 0,
+      "maximumLogChunkBytes": 65536,
+      "maximumTotalLogBytes": 10485760,
+      "maximumWorkspaceBytes": 21474836480,
+      "maximumWorkspaceEntries": 100000
+    }
+  },
+  "permissions": {
+    "source": "read",
+    "artifacts": "none",
+    "caches": "none",
+    "images": "none"
+  },
+  "network": {
+    "mode": "egress",
+    "allow": [
+      {
+        "host": "registry-1.docker.io",
+        "ports": [443]
+      },
+      {
+        "host": "auth.docker.io",
+        "ports": [443]
+      }
+    ]
+  },
+  "execution": {
+    "profile": "vm",
+    "image": "registry.example/ci@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+    "workingDirectory": "/workspace"
+  },
+  "steps": [
+    {
+      "name": "Test with a container engine",
+      "command": ["/usr/local/bin/with-dockerd", "pnpm", "test"],
+      "environment": {
+        "CI": "true",
+        "SHIPZONE_CI_INPUTS_JSON": "{}",
+        "SHIPZONE_CI_MATRIX_JSON": "{}"
+      }
+    }
+  ],
+  "source": {
+    "format": "tar.gz",
+    "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+    "sizeBytes": 1024,
+    "extractedSizeBytes": 4096,
+    "entryCount": 4
+  },
+  "secrets": {},
+  "timeoutMs": 60000,
+  "resources": {
+    "memoryBytes": 268435456,
+    "cpus": 1,
+    "pids": 256,
+    "sharedMemoryBytes": 134217728
+  },
+  "artifacts": [],
+  "caches": []
+}

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@ship.zone/ci-spec',
-    version: '2.0.0',
+    version: '2.1.1',
     description: 'The ship.zone CI standard: language-neutral CI workflow and runner protocol specifications.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxvQkFBb0I7SUFDMUIsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLDZGQUE2RjtDQUMzRyxDQUFBIn0=

package/dist_ts/constants.d.ts

@@ -181,6 +181,46 @@ export declare const compilationFailureCodes: readonly [{
     readonly code: "secret_too_short";
     readonly layer: "run";
 }];
+/**
+ * The prefix of every environment name the specification reserves (spec/ci-actions.md, Jobs and
+ * Steps; spec/runner-protocol.md, OCI Container Profile): workflow authors cannot define a name
+ * with it, and a compiled job carries only the reserved step variables with it.
+ */
+export declare const reservedEnvironmentPrefix: "SHIPZONE_CI_";
+/** The matrix values of a compiled step, as RFC 8785 JSON object text (spec/ci-actions.md, Matrix). */
+export declare const matrixEnvironmentName: "SHIPZONE_CI_MATRIX_JSON";
+/** The manual inputs of a run, as RFC 8785 JSON object text (spec/ci-actions.md, Matrix). */
+export declare const inputsEnvironmentName: "SHIPZONE_CI_INPUTS_JSON";
+/**
+ * The reserved variables every compiled `oci` and `vm` step carries (spec/runner-protocol.md, OCI
+ * Container Profile).
+ */
+export declare const reservedStepEnvironmentNames: readonly ["SHIPZONE_CI_MATRIX_JSON", "SHIPZONE_CI_INPUTS_JSON"];
+/**
+ * The environment name through which a runner delivers npm read grants to `oci` and `vm` steps,
+ * reserved in a job with `npmRead` (spec/runner-protocol.md, npm Read Grants).
+ */
+export declare const npmUserConfigEnvironmentName: "NPM_CONFIG_USERCONFIG";
+/**
+ * The BuildKit secret id through which a runner delivers npm read grants to an `oci-image` build,
+ * reserved in a job with `npmRead` (spec/runner-protocol.md, npm Read Grants).
+ */
+export declare const npmBuildSecretId: "npmrc";
+/** The prefix of the image label keys reserved for the coordinator (spec/ci-actions.md, Image Builds). */
+export declare const reservedImageLabelPrefix: "zone.ship.ci.";
+/**
+ * The image label keys reserved for the coordinator besides the reserved prefix (spec/ci-actions.md,
+ * Image Builds). The coordinator compiles `revision` and `source` into every build job and `version`
+ * on a run with a tag version (spec/ci-actions.md, Compiled Jobs).
+ */
+export declare const reservedImageLabelKeys: readonly ["org.opencontainers.image.revision", "org.opencontainers.image.source", "org.opencontainers.image.version"];
+/**
+ * Every runner job failure code in precedence order, mirrored from
+ * `conformance/runner-job-cases.json` `failureCodes`: the code a coordinator or runner reports for a
+ * compiled job that is not coherent (spec/runner-protocol.md, Job Coherence). The conformance tests
+ * assert both sources and the prose table agree.
+ */
+export declare const runnerJobFailureCodes: readonly ["spec_incompatible", "job_schema_invalid", "job_secret_incoherent", "job_limit_incoherent", "job_resources_incoherent", "job_environment_incoherent", "job_command_limit_exceeded", "job_secret_inadmissible", "job_digest_mismatch"];
 export declare const ciSpecAssetPaths: {
     readonly runnerOpenApi: "spec/runner.openapi.json";
     readonly runnerProtocol: "spec/runner-protocol.md";
@@ -194,6 +234,8 @@ export declare const ciSpecAssetPaths: {
     readonly versionCases: "conformance/version-cases.json";
     readonly compileCases: "conformance/compile-cases.json";
     readonly compileCasesSchema: "conformance/compile-cases.schema.json";
+    readonly runnerJobCases: "conformance/runner-job-cases.json";
+    readonly runnerJobCasesSchema: "conformance/runner-job-cases.schema.json";
     readonly ciActionsConformanceDirectory: "conformance/ci-actions";
     readonly runnerJobConformanceDirectory: "conformance/runner-jobs";
 };

package/dist_ts/constants.js

@@ -87,6 +87,60 @@ export const compilationFailureCodes = [
     { code: 'protected_secret_denied', layer: 'run' },
     { code: 'secret_too_short', layer: 'run' },
 ];
+/**
+ * The prefix of every environment name the specification reserves (spec/ci-actions.md, Jobs and
+ * Steps; spec/runner-protocol.md, OCI Container Profile): workflow authors cannot define a name
+ * with it, and a compiled job carries only the reserved step variables with it.
+ */
+export const reservedEnvironmentPrefix = 'SHIPZONE_CI_';
+/** The matrix values of a compiled step, as RFC 8785 JSON object text (spec/ci-actions.md, Matrix). */
+export const matrixEnvironmentName = 'SHIPZONE_CI_MATRIX_JSON';
+/** The manual inputs of a run, as RFC 8785 JSON object text (spec/ci-actions.md, Matrix). */
+export const inputsEnvironmentName = 'SHIPZONE_CI_INPUTS_JSON';
+/**
+ * The reserved variables every compiled `oci` and `vm` step carries (spec/runner-protocol.md, OCI
+ * Container Profile).
+ */
+export const reservedStepEnvironmentNames = [matrixEnvironmentName, inputsEnvironmentName];
+/**
+ * The environment name through which a runner delivers npm read grants to `oci` and `vm` steps,
+ * reserved in a job with `npmRead` (spec/runner-protocol.md, npm Read Grants).
+ */
+export const npmUserConfigEnvironmentName = 'NPM_CONFIG_USERCONFIG';
+/**
+ * The BuildKit secret id through which a runner delivers npm read grants to an `oci-image` build,
+ * reserved in a job with `npmRead` (spec/runner-protocol.md, npm Read Grants).
+ */
+export const npmBuildSecretId = 'npmrc';
+/** The prefix of the image label keys reserved for the coordinator (spec/ci-actions.md, Image Builds). */
+export const reservedImageLabelPrefix = 'zone.ship.ci.';
+/**
+ * The image label keys reserved for the coordinator besides the reserved prefix (spec/ci-actions.md,
+ * Image Builds). The coordinator compiles `revision` and `source` into every build job and `version`
+ * on a run with a tag version (spec/ci-actions.md, Compiled Jobs).
+ */
+export const reservedImageLabelKeys = [
+    'org.opencontainers.image.revision',
+    'org.opencontainers.image.source',
+    'org.opencontainers.image.version',
+];
+/**
+ * Every runner job failure code in precedence order, mirrored from
+ * `conformance/runner-job-cases.json` `failureCodes`: the code a coordinator or runner reports for a
+ * compiled job that is not coherent (spec/runner-protocol.md, Job Coherence). The conformance tests
+ * assert both sources and the prose table agree.
+ */
+export const runnerJobFailureCodes = [
+    'spec_incompatible',
+    'job_schema_invalid',
+    'job_secret_incoherent',
+    'job_limit_incoherent',
+    'job_resources_incoherent',
+    'job_environment_incoherent',
+    'job_command_limit_exceeded',
+    'job_secret_inadmissible',
+    'job_digest_mismatch',
+];
 export const ciSpecAssetPaths = {
     runnerOpenApi: 'spec/runner.openapi.json',
     runnerProtocol: 'spec/runner-protocol.md',
@@ -100,7 +154,9 @@ export const ciSpecAssetPaths = {
     versionCases: 'conformance/version-cases.json',
     compileCases: 'conformance/compile-cases.json',
     compileCasesSchema: 'conformance/compile-cases.schema.json',
+    runnerJobCases: 'conformance/runner-job-cases.json',
+    runnerJobCasesSchema: 'conformance/runner-job-cases.schema.json',
     ciActionsConformanceDirectory: 'conformance/ci-actions',
     runnerJobConformanceDirectory: 'conformance/runner-jobs',
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uc3RhbnRzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvY29uc3RhbnRzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUVyRDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sYUFBYSxHQUFXLFVBQVUsQ0FBQyxPQUFPLENBQUM7QUFDeEQsTUFBTSxDQUFDLE1BQU0sWUFBWSxHQUFHLE9BQWdCLENBQUM7QUFDN0MsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsYUFBc0IsQ0FBQztBQUM3RCxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxXQUFvQixDQUFDO0FBRXBFOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRztJQUN6QyxTQUFTLEVBQUUsS0FBSztJQUNoQixVQUFVLEVBQUUsV0FBVztJQUN2QixjQUFjLEVBQUUsSUFBSTtDQUNaLENBQUM7QUFFWDs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQUMsZUFBZSxFQUFFLFdBQVcsRUFBRSxRQUFRLENBQVUsQ0FBQztBQUUxRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxDQUFDLG1CQUFtQixFQUFFLG9CQUFvQixFQUFFLGlCQUFpQixDQUFVLENBQUM7QUFFL0c7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxLQUFLLENBQVUsQ0FBQztBQUV0SDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUc7SUFDckMsRUFBRSxJQUFJLEVBQUUsb0JBQW9CLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtJQUMvQyxFQUFFLElBQUksRUFBRSwyQkFBMkIsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFO0lBQ3RELEVBQUUsSUFBSSxFQUFFLHNCQUFzQixFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUU7SUFDL0MsRUFBRSxJQUFJLEVBQUUsOEJBQThCLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRTtJQUN2RCxFQUFFLElBQUksRUFBRSx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFO0lBQ2xELEVBQUUsSUFBSSxFQUFFLDZCQUE2QixFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUU7SUFDdEQsRUFBRSxJQUFJLEVBQUUsd0JBQXdCLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRTtJQUNqRCxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFO0lBQy9DLEVBQUUsSUFBSSxFQUFFLHlCQUF5QixFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUU7SUFDbEQsRUFBRSxJQUFJLEVBQUUsbUJBQW1CLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRTtJQUM1QyxFQUFFLElBQUksRUFBRSx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFO0lBQ2xELEVBQUUsSUFBSSxFQUFFLG1CQUFtQixFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUU7SUFDL0MsRUFBRSxJQUFJLEVBQUUseUJBQXlCLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtJQUNwRCxFQUFFLElBQUksRUFBRSx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ3RELEVBQUUsSUFBSSxFQUFFLGVBQWUsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQzVDLEVBQUUsSUFBSSxFQUFFLGFBQWEsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQzFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDdkQsRUFBRSxJQUFJLEVBQUUscUJBQXFCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUNsRCxFQUFFLElBQUksRUFBRSxxQkFBcUIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ2xELEVBQUUsSUFBSSxFQUFFLHVCQUF1QixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDcEQsRUFBRSxJQUFJLEVBQUUseUJBQXlCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUN0RCxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ25ELEVBQUUsSUFBSSxFQUFFLDRCQUE0QixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDekQsRUFBRSxJQUFJLEVBQUUsd0JBQXdCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUNyRCxFQUFFLElBQUksRUFBRSx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ3RELEVBQUUsSUFBSSxFQUFFLG9CQUFvQixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDakQsRUFBRSxJQUFJLEVBQUUsbUJBQW1CLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUNoRCxFQUFFLElBQUksRUFBRSx3QkFBd0IsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ3JELEVBQUUsSUFBSSxFQUFFLGtCQUFrQixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDL0MsRUFBRSxJQUFJLEVBQUUsc0JBQXNCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUNuRCxFQUFFLElBQUksRUFBRSw2QkFBNkIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQzFELEVBQUUsSUFBSSxFQUFFLDRCQUE0QixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDekQsRUFBRSxJQUFJLEVBQUUsMkJBQTJCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUN4RCxFQUFFLElBQUksRUFBRSx1QkFBdUIsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFO0lBQ2xELEVBQUUsSUFBSSxFQUFFLHlCQUF5QixFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUU7SUFDcEQsRUFBRSxJQUFJLEVBQUUsMkJBQTJCLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtJQUN0RCxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFO0lBQ2pELEVBQUUsSUFBSSxFQUFFLDRCQUE0QixFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUU7SUFDdkQsRUFBRSxJQUFJLEVBQUUsZUFBZSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUU7SUFDMUMsRUFBRSxJQUFJLEVBQUUsc0JBQXNCLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRTtJQUM5QyxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFO0lBQzlDLEVBQUUsSUFBSSxFQUFFLGVBQWUsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFO0lBQ3ZDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUU7SUFDekMsRUFBRSxJQUFJLEVBQUUsa0JBQWtCLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRTtJQUMxQyxFQUFFLElBQUksRUFBRSxvQkFBb0IsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFO0lBQzVDLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUU7SUFDeEMsRUFBRSxJQUFJLEVBQUUseUJBQXlCLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRTtJQUNqRCxFQUFFLElBQUksRUFBRSxrQkFBa0IsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFO0NBQ2xDLENBQUM7QUFFWCxNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRztJQUM5QixhQUFhLEVBQUUsMEJBQTBCO0lBQ3pDLGNBQWMsRUFBRSx5QkFBeUI7SUFDekMsaUJBQWlCLEVBQUUsb0JBQW9CO0lBQ3ZDLGVBQWUsRUFBRSxnQ0FBZ0M7SUFDakQsZUFBZSxFQUFFLGdDQUFnQztJQUNqRCxzQkFBc0IsRUFBRSwrQkFBK0I7SUFDdkQsa0JBQWtCLEVBQUUsa0NBQWtDO0lBQ3RELFdBQVcsRUFBRSwrQkFBK0I7SUFDNUMsWUFBWSxFQUFFLGdDQUFnQztJQUM5QyxZQUFZLEVBQUUsZ0NBQWdDO0lBQzlDLFlBQVksRUFBRSxnQ0FBZ0M7SUFDOUMsa0JBQWtCLEVBQUUsdUNBQXVDO0lBQzNELDZCQUE2QixFQUFFLHdCQUF3QjtJQUN2RCw2QkFBNkIsRUFBRSx5QkFBeUI7Q0FDaEQsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uc3RhbnRzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvY29uc3RhbnRzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUVyRDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sYUFBYSxHQUFXLFVBQVUsQ0FBQyxPQUFPLENBQUM7QUFDeEQsTUFBTSxDQUFDLE1BQU0sWUFBWSxHQUFHLE9BQWdCLENBQUM7QUFDN0MsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsYUFBc0IsQ0FBQztBQUM3RCxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxXQUFvQixDQUFDO0FBRXBFOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRztJQUN6QyxTQUFTLEVBQUUsS0FBSztJQUNoQixVQUFVLEVBQUUsV0FBVztJQUN2QixjQUFjLEVBQUUsSUFBSTtDQUNaLENBQUM7QUFFWDs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQUMsZUFBZSxFQUFFLFdBQVcsRUFBRSxRQUFRLENBQVUsQ0FBQztBQUUxRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxDQUFDLG1CQUFtQixFQUFFLG9CQUFvQixFQUFFLGlCQUFpQixDQUFVLENBQUM7QUFFL0c7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxLQUFLLENBQVUsQ0FBQztBQUV0SDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUc7SUFDckMsRUFBRSxJQUFJLEVBQUUsb0JBQW9CLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtJQUMvQyxFQUFFLElBQUksRUFBRSwyQkFBMkIsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFO0lBQ3RELEVBQUUsSUFBSSxFQUFFLHNCQUFzQixFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUU7SUFDL0MsRUFBRSxJQUFJLEVBQUUsOEJBQThCLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRTtJQUN2RCxFQUFFLElBQUksRUFBRSx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFO0lBQ2xELEVBQUUsSUFBSSxFQUFFLDZCQUE2QixFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUU7SUFDdEQsRUFBRSxJQUFJLEVBQUUsd0JBQXdCLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRTtJQUNqRCxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFO0lBQy9DLEVBQUUsSUFBSSxFQUFFLHlCQUF5QixFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUU7SUFDbEQsRUFBRSxJQUFJLEVBQUUsbUJBQW1CLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRTtJQUM1QyxFQUFFLElBQUksRUFBRSx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFO0lBQ2xELEVBQUUsSUFBSSxFQUFFLG1CQUFtQixFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUU7SUFDL0MsRUFBRSxJQUFJLEVBQUUseUJBQXlCLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtJQUNwRCxFQUFFLElBQUksRUFBRSx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ3RELEVBQUUsSUFBSSxFQUFFLGVBQWUsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQzVDLEVBQUUsSUFBSSxFQUFFLGFBQWEsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQzFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDdkQsRUFBRSxJQUFJLEVBQUUscUJBQXFCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUNsRCxFQUFFLElBQUksRUFBRSxxQkFBcUIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ2xELEVBQUUsSUFBSSxFQUFFLHVCQUF1QixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDcEQsRUFBRSxJQUFJLEVBQUUseUJBQXlCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUN0RCxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ25ELEVBQUUsSUFBSSxFQUFFLDRCQUE0QixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDekQsRUFBRSxJQUFJLEVBQUUsd0JBQXdCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUNyRCxFQUFFLElBQUksRUFBRSx5QkFBeUIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ3RELEVBQUUsSUFBSSxFQUFFLG9CQUFvQixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDakQsRUFBRSxJQUFJLEVBQUUsbUJBQW1CLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUNoRCxFQUFFLElBQUksRUFBRSx3QkFBd0IsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQ3JELEVBQUUsSUFBSSxFQUFFLGtCQUFrQixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDL0MsRUFBRSxJQUFJLEVBQUUsc0JBQXNCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUNuRCxFQUFFLElBQUksRUFBRSw2QkFBNkIsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFO0lBQzFELEVBQUUsSUFBSSxFQUFFLDRCQUE0QixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUU7SUFDekQsRUFBRSxJQUFJLEVBQUUsMkJBQTJCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRTtJQUN4RCxFQUFFLElBQUksRUFBRSx1QkFBdUIsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFO0lBQ2xELEVBQUUsSUFBSSxFQUFFLHlCQUF5QixFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUU7SUFDcEQsRUFBRSxJQUFJLEVBQUUsMkJBQTJCLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtJQUN0RCxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFO0lBQ2pELEVBQUUsSUFBSSxFQUFFLDRCQUE0QixFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUU7SUFDdkQsRUFBRSxJQUFJLEVBQUUsZUFBZSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUU7SUFDMUMsRUFBRSxJQUFJLEVBQUUsc0JBQXNCLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRTtJQUM5QyxFQUFFLElBQUksRUFBRSxzQkFBc0IsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFO0lBQzlDLEVBQUUsSUFBSSxFQUFFLGVBQWUsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFO0lBQ3ZDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUU7SUFDekMsRUFBRSxJQUFJLEVBQUUsa0JBQWtCLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRTtJQUMxQyxFQUFFLElBQUksRUFBRSxvQkFBb0IsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFO0lBQzVDLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUU7SUFDeEMsRUFBRSxJQUFJLEVBQUUseUJBQXlCLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRTtJQUNqRCxFQUFFLElBQUksRUFBRSxrQkFBa0IsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFO0NBQ2xDLENBQUM7QUFFWDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUcsY0FBdUIsQ0FBQztBQUVqRSx1R0FBdUc7QUFDdkcsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcseUJBQWtDLENBQUM7QUFFeEUsNkZBQTZGO0FBQzdGLE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLHlCQUFrQyxDQUFDO0FBRXhFOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLENBQUMscUJBQXFCLEVBQUUscUJBQXFCLENBQVUsQ0FBQztBQUVwRzs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyx1QkFBZ0MsQ0FBQztBQUU3RTs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRyxPQUFnQixDQUFDO0FBRWpELDBHQUEwRztBQUMxRyxNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxlQUF3QixDQUFDO0FBRWpFOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRztJQUNwQyxtQ0FBbUM7SUFDbkMsaUNBQWlDO0lBQ2pDLGtDQUFrQztDQUMxQixDQUFDO0FBRVg7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSxxQkFBcUIsR0FBRztJQUNuQyxtQkFBbUI7SUFDbkIsb0JBQW9CO0lBQ3BCLHVCQUF1QjtJQUN2QixzQkFBc0I7SUFDdEIsMEJBQTBCO0lBQzFCLDRCQUE0QjtJQUM1Qiw0QkFBNEI7SUFDNUIseUJBQXlCO0lBQ3pCLHFCQUFxQjtDQUNiLENBQUM7QUFFWCxNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRztJQUM5QixhQUFhLEVBQUUsMEJBQTBCO0lBQ3pDLGNBQWMsRUFBRSx5QkFBeUI7SUFDekMsaUJBQWlCLEVBQUUsb0JBQW9CO0lBQ3ZDLGVBQWUsRUFBRSxnQ0FBZ0M7SUFDakQsZUFBZSxFQUFFLGdDQUFnQztJQUNqRCxzQkFBc0IsRUFBRSwrQkFBK0I7SUFDdkQsa0JBQWtCLEVBQUUsa0NBQWtDO0lBQ3RELFdBQVcsRUFBRSwrQkFBK0I7SUFDNUMsWUFBWSxFQUFFLGdDQUFnQztJQUM5QyxZQUFZLEVBQUUsZ0NBQWdDO0lBQzlDLFlBQVksRUFBRSxnQ0FBZ0M7SUFDOUMsa0JBQWtCLEVBQUUsdUNBQXVDO0lBQzNELGNBQWMsRUFBRSxtQ0FBbUM7SUFDbkQsb0JBQW9CLEVBQUUsMENBQTBDO0lBQ2hFLDZCQUE2QixFQUFFLHdCQUF3QjtJQUN2RCw2QkFBNkIsRUFBRSx5QkFBeUI7Q0FDaEQsQ0FBQyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ship.zone/ci-spec",
-  "version": "2.0.0",
+  "version": "2.1.1",
   "private": false,
   "description": "The ship.zone CI standard: language-neutral CI workflow and runner protocol specifications.",
   "main": "dist_ts/index.js",
@@ -22,6 +22,8 @@
     "./version-cases.json": "./conformance/version-cases.json",
     "./compile-cases.json": "./conformance/compile-cases.json",
     "./compile-cases.schema.json": "./conformance/compile-cases.schema.json",
+    "./runner-job-cases.json": "./conformance/runner-job-cases.json",
+    "./runner-job-cases.schema.json": "./conformance/runner-job-cases.schema.json",
     "./conformance/ci-actions/*": "./conformance/ci-actions/*",
     "./conformance/runner-jobs/*": "./conformance/runner-jobs/*"
   },
@@ -65,7 +67,7 @@
   ],
   "scripts": {
     "test": "tstest test/ --verbose",
-    "test:types": "tsbuild check test/**/*",
+    "test:types": "tsbuild check 'test/**/*'",
     "lint:openapi": "redocly lint spec/runner.openapi.json --extends=spec",
     "build": "tsbuild tsfolders"
   }

package/readme.md

@@ -1,6 +1,6 @@
 # @ship.zone/ci-spec
 
-`@ship.zone/ci-spec` defines the ship.zone CI standard: the language-neutral workflow and runner contracts between a coordinator and its runners. The normative artifacts are OpenAPI, JSON Schema, protocol prose, and conformance cases. TypeScript exports provide only the specification version, draft metadata, identifier lists, and asset locations.
+`@ship.zone/ci-spec` defines the ship.zone CI standard: the language-neutral workflow and runner contracts between a coordinator and its runners. The normative artifacts are OpenAPI, JSON Schema, protocol prose, and conformance cases. TypeScript exports provide only the specification version, draft metadata, identifier lists, failure codes, reserved names, and asset locations.
 
 The current specification is a draft. It is intentionally incompatible with the legacy internal runner protocol it replaces and must not be treated as stable until independent implementations pass the conformance suite.
 
@@ -12,7 +12,7 @@ The package version is the specification version, and it is the only version in
 spec: 2.0.0
 ```
 
-Compiled jobs and runner protocol messages carry the same `spec` field. An implementation built against version `I` accepts a declared version `D` when both have the same major version and `D` is not newer than `I`; the rule is defined in `spec/runner-protocol.md` and fixed by `conformance/version-cases.json`. Every incompatible change is a new major version, and additions arrive as new minor versions: a workflow that uses a construct introduced in a later minor version declares that version or a later one. Version 2.0.0 renames the package and its normative identifiers (see Migrating from @foss.global/ci-spec), removes the 1.x cross-version rules, and completes the compilation rules: one stable failure code per compilation failure with a fixed precedence, a stricter YAML subset, the derivation of every compiled job member, and the identities of expanded nodes. The history of the 1.x rules is in the changelog.
+Compiled jobs and runner protocol messages carry the same `spec` field. An implementation built against version `I` accepts a declared version `D` when both have the same major version and `D` is not newer than `I`; the rule is defined in `spec/runner-protocol.md` and fixed by `conformance/version-cases.json`. Every incompatible change is a new major version, and additions arrive as new minor versions: a workflow that uses a construct introduced in a later minor version declares that version or a later one. Version 2.0.0 renames the package and its normative identifiers (see Migrating from @foss.global/ci-spec), removes the 1.x cross-version rules, and completes the compilation rules: one stable failure code per compilation failure with a fixed precedence, a stricter YAML subset, the derivation of every compiled job member, and the identities of expanded nodes. Version 2.1.0 adds job failure codes: every coherence rule of a compiled job has exactly one code, and a job that is not coherent carries the code of the first rule it violates (see Job Coherence in `spec/runner-protocol.md`); it also exports the reserved names as constants. Version 2.1.1 clarifies compilation: it states the YAML 1.2 character, byte order mark, escape, and document counting rules, bounds collection nesting to 64, and counts the 16 KiB command argument limit in UTF-8 bytes. Documents written against 2.0.0 stay valid. The history of the 1.x rules is in the changelog.
 
 ## Issue Reporting and Security
 
@@ -68,7 +68,8 @@ ajv.addSchema({
 - `conformance/archive-cases.json`: byte-identical gzip/tar acceptance and rejection vectors.
 - `conformance/version-cases.json`: specification version compatibility outcomes.
 - `conformance/compile-cases.json` and its schema `conformance/compile-cases.schema.json`: the compilation failure codes in precedence order, trigger pattern and tag version vectors, the expected code of every invalid workflow fixture, and compile vectors that bind a workflow, run context, and deployment policy to a failure code, to not-triggered, or to the compiled nodes and plan digests. The package runs no compiler; its tests check that every vector is schema-valid and internally coherent, and compilers run the vectors.
-- `conformance/ci-actions/` and `conformance/runner-jobs/`: valid and invalid data fixtures. `conformance/ci-actions/compile-invalid/` holds schema-valid workflows that a compiler must reject; each is bound to a case in `runner-cases.json`.
+- `conformance/runner-job-cases.json` and its schema `conformance/runner-job-cases.schema.json`: the job failure codes in precedence order and the expected outcome of every runner job fixture and of inline version cases.
+- `conformance/ci-actions/` and `conformance/runner-jobs/`: valid and invalid data fixtures. `conformance/ci-actions/compile-invalid/` holds schema-valid workflows that a compiler must reject; each is bound to a case in `runner-cases.json`. `conformance/runner-jobs/incoherent/` holds schema-valid compiled jobs that fail a later rule of Job Coherence; each is bound to a case in `runner-job-cases.json`.
 
 The package exports these raw asset subpaths:
 
@@ -84,10 +85,12 @@ The package exports these raw asset subpaths:
 - `@ship.zone/ci-spec/version-cases.json`
 - `@ship.zone/ci-spec/compile-cases.json`
 - `@ship.zone/ci-spec/compile-cases.schema.json`
+- `@ship.zone/ci-spec/runner-job-cases.json`
+- `@ship.zone/ci-spec/runner-job-cases.schema.json`
 - `@ship.zone/ci-spec/conformance/ci-actions/*`
 - `@ship.zone/ci-spec/conformance/runner-jobs/*`
 
-TypeScript metadata exposes package-root-relative asset locations separately:
+TypeScript metadata exposes package-root-relative asset locations, failure codes, and reserved names separately:
 
 ```ts
 import {
@@ -96,6 +99,9 @@ import {
   compilationFailureCodes,
   executionProfileIdentifiers,
   maximumArchivePathMetadataBytes,
+  reservedEnvironmentPrefix,
+  reservedImageLabelPrefix,
+  runnerJobFailureCodes,
   runnerProtocolBasePath,
 } from '@ship.zone/ci-spec';
 
@@ -105,6 +111,9 @@ console.log(executionProfileIdentifiers.imageBuild); // oci-image
 console.log(maximumArchivePathMetadataBytes); // 134217728
 console.log(ciSpecAssetPaths.runnerOpenApi);
 console.log(compilationFailureCodes[0]); // { code: 'workflow_too_large', layer: 'source' }
+console.log(runnerJobFailureCodes[1]); // job_schema_invalid
+console.log(reservedEnvironmentPrefix); // SHIPZONE_CI_
+console.log(reservedImageLabelPrefix); // zone.ship.ci.
 ```
 
 Generated language bindings are deliberately not normative. Implementations must follow the published OpenAPI, JSON Schemas, prose rules, and conformance cases.

package/spec/ci-actions.md

@@ -12,7 +12,7 @@ The coordinator reads the workflow as bytes from the exact source commit being e
 
 Parsing uses YAML 1.2 with the core schema and requires:
 
-- exactly one document: an empty file, a file of only comments, and a file with a second document fail with `workflow_yaml_document_count`;
+- exactly one document. As in YAML 1.2, a `---` directives end marker begins a document, and so does content that no marker precedes; a document end marker `...`, a comment, a blank line, and a byte order mark begin none. An empty file, a file of only comments or only `...` markers, and a file with a second document fail with `workflow_yaml_document_count`. A document followed by several `...` markers is one document, and a file of only `--- # comment` is one empty document, whose null value fails schema validation;
 - no YAML or TAG directive (`workflow_yaml_directive`);
 - unique keys in every mapping (`workflow_yaml_duplicate_key`);
 - string mapping keys: every key is a scalar whose core-schema resolution is a string, so a plain key such as `1`, `true`, `null`, or `~`, and every collection used as a key, fails with `workflow_yaml_key_type`; such a key is written quoted, for example `"1"`;
@@ -20,6 +20,13 @@ Parsing uses YAML 1.2 with the core schema and requires:
 - no merge key: a `<<` key, plain or quoted, fails with `workflow_yaml_merge_key`;
 - no explicit tag, including the standard `!!` tags and the non-specific tag `!` (`workflow_yaml_tag`).
 
+The following YAML 1.2 rules fail with `workflow_yaml_syntax`:
+
+- Characters. A C0 control character other than tab, line feed, and carriage return is allowed nowhere, not even in a quoted scalar. DEL (U+007F), a C1 control character other than NEL (U+0080 to U+009F except U+0085), U+FFFE, U+FFFF, and U+FEFF are allowed inside a single- or double-quoted scalar, where they are content, and nowhere else, except where U+FEFF is a byte order mark. Unpaired surrogates cannot occur, because the file is well-formed UTF-8.
+- Byte order marks. One or more U+FEFF at the start of a line are byte order marks, which are not content, when the line comes before the one on which the document begins, is that line, or comes after a document end marker `...`. They are also byte order marks when the line comes after the document's content and it and every later line up to the end of the file, or up to the next `---` or `...` marker, are blank or comment lines: YAML 1.2 lets a document prefix follow a document without a `...` marker, and a `---` after it begins a second document. The file's own leading byte order mark is the first of them. Any other U+FEFF outside a quoted scalar, for example in a plain or block scalar, in a comment, or at the start of a line within the document or followed by content, fails.
+- Escapes. Every escape in a double-quoted scalar denotes a Unicode scalar value, so every string can be serialized with RFC 8785. A `\u` escape of a high surrogate (`\uD800` to `\uDBFF`) directly followed by a `\u` escape of a low surrogate (`\uDC00` to `\uDFFF`) denotes the one character the pair encodes, as in JSON: `"\uD83D\uDE00"` is U+1F600. Every other escape of a surrogate code point fails, such as a lone `\uD800` or `\uDC00` or the escape `\U0000D800`. Escapes of other characters, including control characters such as `\0` and `\x7F`, are content.
+- Nesting depth. Collections nest at most 64 deep: the root collection has depth 1, and a collection that is an entry of a sequence, or a key or value of a mapping, of depth *d* has depth *d* + 1. A collection of depth 65 fails, so a parser can stop there instead of exhausting its stack. The deepest collection of a schema-valid workflow, an alias of `publish.images[].destinations[].aliases`, has depth 8.
+
 Every other parser error or warning fails with `workflow_yaml_syntax`. The version check (see Specification Version) and JSON Schema validation against `schemas/ci_actions.schema.json`, which fails with `workflow_schema_invalid`, run only after these YAML-level rules pass.
 
 Every plain scalar that the core schema resolves to an integer or a float is converted from its original token before schema validation; quoted scalars are strings and never numbers:
@@ -166,7 +173,7 @@ Jobs form an acyclic graph through `needs`. A dependency on a job the workflow d
 
 Steps use argument arrays. Shell strings, arbitrary expression languages, GitHub action compatibility, and unpinned third-party actions are not supported. The coordinator preserves declaration order and emits an ordered compiled `steps` array. Each compiled step contains its command and the complete merged non-secret environment; runners do not perform workflow-level environment merging.
 
-Environment maps are merged in workflow, job, then step order: a name defined at more than one of these levels takes the value of the innermost one. The workflow environment applies only to the steps of `oci` and `vm` jobs. Secret references are job-wide and are injected into every step only after trust evaluation. A secret target equal to a name of the merged environment of any step of the job, two secret references with one target, and any `SHIPZONE_CI_*` name in an environment map or as a secret target fail with `environment_conflict`. A step whose merged environment names, secret targets, and reserved names (see the runner protocol's OCI Container Profile) number more than 128 fails with `environment_limit_exceeded`. A step whose command arguments total more than 131,072 UTF-8 bytes fails with `command_limit_exceeded`.
+Environment maps are merged in workflow, job, then step order: a name defined at more than one of these levels takes the value of the innermost one. The workflow environment applies only to the steps of `oci` and `vm` jobs. Secret references are job-wide and are injected into every step only after trust evaluation. A secret target equal to a name of the merged environment of any step of the job, two secret references with one target, and any `SHIPZONE_CI_*` name in an environment map or as a secret target fail with `environment_conflict`. A step whose merged environment names, secret targets, and reserved names (see the runner protocol's OCI Container Profile) number more than 128 fails with `environment_limit_exceeded`. A step with a command argument of more than 16,384 UTF-8 bytes, or whose command arguments total more than 131,072 UTF-8 bytes, fails with `command_limit_exceeded`; the schema bounds an argument to 16,384 characters, which can exceed 16,384 bytes.
 
 Artifact and cache names must be unique within a job; a repeated name fails with `transfer_name_duplicate`. Cache paths must not overlap each other: two paths overlap when, split at `/` with empty and `.` segments removed, the segments of one are a prefix of the segments of the other. Overlapping paths fail with `cache_path_overlap`. Artifacts and caches are `tar.gz` archives with explicit compressed-byte, extracted-byte, and entry ceilings. Produced digest and size metadata is measured at transfer time and is not part of the compiled declaration.
 
@@ -351,7 +358,7 @@ Every job node compiles to one compiled job, a function of the workflow, the run
 - Secret references: 128 per job.
 - Artifacts: 64 per job.
 - Caches: 32 per job.
-- Command: 128 arguments, 16 KiB each, 128 KiB total.
+- Command: 128 arguments, 16 KiB each, 128 KiB total after UTF-8 encoding.
 - Artifact archive: 16 GiB compressed, 128 GiB extracted, 1,000,000 entries per item.
 - Cache archive: 16 GiB compressed, 128 GiB extracted, 1,000,000 entries per item.
 - Workspace: 1 TiB and 2,000,000 entries.
@@ -368,7 +375,7 @@ A compilation failure fails the run before any job is enqueued and carries exact
 | --- | --- | --- |
 | source | `workflow_too_large` | the file has more than 262,144 bytes (Parsing) |
 | source | `workflow_encoding_invalid` | the file is not well-formed UTF-8 (Parsing) |
-| yaml | `workflow_yaml_syntax` | any other YAML parser error or warning (Parsing) |
+| yaml | `workflow_yaml_syntax` | a character, byte order mark, escape, or nesting depth that YAML 1.2 or Parsing rejects, or any other YAML parser error or warning (Parsing) |
 | yaml | `workflow_yaml_document_count` | no document, or more than one (Parsing) |
 | yaml | `workflow_yaml_directive` | a YAML or TAG directive (Parsing) |
 | yaml | `workflow_yaml_duplicate_key` | a mapping repeats a key (Parsing) |
@@ -389,7 +396,7 @@ A compilation failure fails the run before any job is enqueued and carries exact
 | workflow | `permission_insufficient` | a declaration or build job beyond its resolved permissions (Permissions) |
 | workflow | `environment_conflict` | a secret target or reserved-name conflict (Jobs and Steps) |
 | workflow | `environment_limit_exceeded` | more than 128 names in a step (Jobs and Steps) |
-| workflow | `command_limit_exceeded` | a command above 131,072 bytes (Jobs and Steps) |
+| workflow | `command_limit_exceeded` | a command argument above 16,384 bytes or a command above 131,072 bytes (Jobs and Steps) |
 | workflow | `transfer_name_duplicate` | a repeated artifact or cache name (Jobs and Steps) |
 | workflow | `cache_path_overlap` | overlapping cache paths (Jobs and Steps) |
 | workflow | `resources_invalid` | `sharedMemoryBytes` above `memoryBytes` (Resources) |

package/spec/runner-protocol.md

@@ -97,12 +97,43 @@ A `vm` job always carries `requirements.platform`, and it is leased only to a ru
 
 Image builds run on dedicated builder runners. A runner that advertises `oci-image` advertises no other execution profile and includes `microvm` isolation; the capability schema rejects any other combination. A runner that advertises `vm` includes `microvm` isolation and may also advertise `oci`, but never `oci-image`; the capability schema rejects a `vm` runner without `microvm`.
 
-Every compiled job is internally coherent before enqueueing and again before acceptance: the job has exactly the shape of its execution profile; `source.tar-gz` is required; non-empty artifact or cache declarations require their matching feature and permission; `none` permission requires an empty declaration list; a read-write cache requires `caches: read-write`; `images: push` is present exactly for `oci-image`; a `vm` job carries `microvm` isolation and `requirements.platform`; the `requirements.platform` of an `oci` or `oci-image` job is a `linux` platform; in a job with `npmRead`, no compiled step environment defines `NPM_CONFIG_USERCONFIG` and no build secret has id `npmrc`; every build secret names a key of `secrets` and every key of `secrets` is named by a build secret in an `oci-image` job; source metadata and every declared artifact/cache maximum fit `requirements.limits`; `resources.sharedMemoryBytes` is at most `resources.memoryBytes` when both are present; declaration counts fit their required maxima; and every job requirement fits the accepted runner capability snapshot.
+Every compiled job is coherent, as Job Coherence defines, before enqueueing and again before acceptance, and every job requirement fits the accepted runner capability snapshot.
 
 A lease is coherent with its job when every candidate reference in the job has exactly one binding with that candidate name and no binding is unreferenced; at most one grant exists per registry, repository, and access; every bound image and every private base image has a pull grant for its repository; an `oci-image` lease has exactly one push grant and an `oci` or `vm` lease has none; `npmGrants` is present exactly when the job declares `npmRead`, with exactly one grant per `npmRead` entry that carries the entry's registry and scopes.
 
 A violation is rejected before enqueueing or abandoned as `runner_error` before acceptance.
 
+## Job Coherence
+
+A compiled job is *coherent* when it violates no rule of the following table. The coordinator checks a job before enqueueing it and the runner checks the job of a lease before acceptance, both with the job's secret values inserted, as a lease carries it. A job that is not coherent has exactly one *job failure code*: the code of the first row, in table order, whose rule it violates. The rows after the `job_schema_invalid` rows are checked only for a job that satisfies `schemas/runner-job.schema.json`, and the `job_schema_invalid` rows list the rules of this protocol that the schema enforces. A coordinator that rejects a job reports its code with the rejection. A runner abandons the lease as `runner_error` and reports the code only in its own diagnostics, because `AbandonJobRequest` carries no code.
+
+| Code | Rule |
+| --- | --- |
+| `spec_incompatible` | the job's `spec` is canonical and its outcome for the checking implementation is `newer` or `major-mismatch` (Specification Version) |
+| `job_schema_invalid` | the job fails `schemas/runner-job.schema.json`, including a missing, non-string, or malformed `spec` |
+| `job_schema_invalid` | the job does not have exactly the shape of its execution profile |
+| `job_schema_invalid` | `requirements.features` does not contain `source.tar-gz` |
+| `job_schema_invalid` | a non-empty artifact or cache declaration list whose matching feature is missing from `requirements.features` or whose matching permission is `none` |
+| `job_schema_invalid` | a read-write cache without `caches: read-write` |
+| `job_schema_invalid` | `images: push` in a job that is not `oci-image`, or its absence in an `oci-image` job |
+| `job_schema_invalid` | a `vm` job without `microvm` isolation or without `requirements.platform` |
+| `job_schema_invalid` | an `oci` or `oci-image` job whose `requirements.platform` is not a `linux` platform |
+| `job_schema_invalid` | in a job with `npmRead`, a step environment that defines `NPM_CONFIG_USERCONFIG`, or a build secret with id `npmrc` (npm Read Grants) |
+| `job_secret_incoherent` | in an `oci-image` job, a build secret whose `environment` is not a key of `secrets`, or a key of `secrets` that no build secret names |
+| `job_limit_incoherent` | a source `sizeBytes`, `extractedSizeBytes`, or `entryCount` above `maximumSourceArchiveBytes`, `maximumSourceExtractedBytes`, or `maximumSourceEntries` of `requirements.limits` |
+| `job_limit_incoherent` | an artifact or cache `maximumBytes`, `maximumExtractedBytes`, or `maximumEntries` above the matching artifact or cache maximum of `requirements.limits` |
+| `job_limit_incoherent` | more artifacts than `maximumArtifacts`, or more caches than `maximumCaches` |
+| `job_resources_incoherent` | `resources.sharedMemoryBytes` above `resources.memoryBytes` |
+| `job_environment_incoherent` | a secret target that starts with `SHIPZONE_CI_`, or a step environment name that starts with it and is not `SHIPZONE_CI_MATRIX_JSON` or `SHIPZONE_CI_INPUTS_JSON` (OCI Container Profile) |
+| `job_environment_incoherent` | an `oci` or `vm` step whose environment lacks `SHIPZONE_CI_MATRIX_JSON` or `SHIPZONE_CI_INPUTS_JSON`, or whose value of one of them is not the RFC 8785 serialization of a JSON object (OCI Container Profile) |
+| `job_environment_incoherent` | an `oci` or `vm` step whose environment names, the job's secret targets, and, in a job with `npmRead`, `NPM_CONFIG_USERCONFIG` are not unique or number more than 128 (OCI Container Profile, Protocol Limits) |
+| `job_command_limit_exceeded` | a step command argument of more than 16,384 UTF-8 bytes; `schemas/runner-job.schema.json` bounds an argument only to 16,384 characters (Protocol Limits) |
+| `job_command_limit_exceeded` | a step command whose arguments total more than 131,072 UTF-8 bytes (Protocol Limits) |
+| `job_secret_inadmissible` | a value of `secrets` shorter than 8 UTF-8 bytes (Secret Redaction) |
+| `job_digest_mismatch` | a `compiledPlanDigest` other than the digest Canonical Digests defines for the job |
+
+Whether a job requirement fits a runner capability snapshot and whether a lease is coherent with its job depend on more than the job, so they are not rules of this table and have no job failure code. `conformance/runner-job-cases.json` lists the codes in table order as `failureCodes` and fixes the code of every runner job fixture.
+
 ## Sessions and Leases
 
 Each runner process starts a new session. Session identity is included in every claim and job mutation. Session creation is idempotent by `(runnerId, sessionRequestId, canonicalRequestDigest)`. The coordinator durably stores the exact response before atomically making older sessions stale. An exact retry returns the same session and response; a changed body returns HTTP 409. The key remains tombstoned for the resulting session lifetime plus ten minutes. A different request ID intentionally starts a new session and immediately fences older sessions when the new response is committed.

package/spec/runner.openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "ship.zone CI Runner Protocol",
-    "version": "2.0.0",
+    "version": "2.1.1",
     "description": "Language-neutral, outbound runner protocol of @ship.zone/ci-spec. info.version is the specification version this description is written against. This draft is incompatible with the legacy internal runner protocol it replaces.",
     "license": {
       "name": "MIT",

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@ship.zone/ci-spec',
-  version: '2.0.0',
+  version: '2.1.1',
   description: 'The ship.zone CI standard: language-neutral CI workflow and runner protocol specifications.'
 }