@ship.zone/ci-spec 2.0.0

package/conformance/runner-cases.json

@@ -0,0 +1,1238 @@
+{
+  "spec": "2.0.0",
+  "status": "draft",
+  "cases": [
+    {
+      "id": "registration-response-replay",
+      "category": "registration",
+      "given": "A valid bootstrap credential and a registration request that succeeded but whose response was lost",
+      "when": "The exact request ID and canonical body are retried within ten minutes",
+      "then": "The coordinator returns the byte-equivalent credential response without creating another runner or credential"
+    },
+    {
+      "id": "registration-body-conflict",
+      "category": "registration",
+      "given": "A consumed bootstrap credential with a stored successful registration response",
+      "when": "The request ID or canonical body changes",
+      "then": "The coordinator returns a conflict and does not mutate registration state"
+    },
+    {
+      "id": "discovery-reports-spec",
+      "category": "versioning",
+      "given": "A coordinator built against specification version C",
+      "when": "A runner calls discovery",
+      "then": "The response spec equals C"
+    },
+    {
+      "id": "runner-spec-major-mismatch",
+      "category": "versioning",
+      "given": "A coordinator implementing C and a registration or session-start request whose spec R has a different major version than C",
+      "when": "The coordinator handles the request",
+      "then": "It returns HTTP 409 with error code spec_incompatible without consuming the bootstrap credential, creating a session, or fencing an older session"
+    },
+    {
+      "id": "workflow-spec-incompatible",
+      "category": "versioning",
+      "given": "A coordinator implementing I and a ci_actions.yml whose spec D has outcome newer or major-mismatch under the version-cases rule",
+      "when": "The coordinator compiles the workflow",
+      "then": "Compilation fails before any job is enqueued"
+    },
+    {
+      "id": "compiled-job-spec-from-workflow",
+      "category": "versioning",
+      "given": "A workflow whose spec D is accepted by the coordinator",
+      "when": "The coordinator compiles it",
+      "then": "Every compiled job carries spec D"
+    },
+    {
+      "id": "job-spec-lease-matching",
+      "category": "versioning",
+      "given": "A compiled job with spec D and a runner session with spec R whose version-cases outcome for (I = R, D) is not accepted",
+      "when": "The runner claims work",
+      "then": "The coordinator does not lease the job to that runner; a runner that nevertheless receives such a lease abandons it as runner_error before acceptance"
+    },
+    {
+      "id": "credential-rotation-replay",
+      "category": "credentials",
+      "given": "A replacement credential response was lost during overlap",
+      "when": "The old credential is used again before previousCredentialValidUntil",
+      "then": "The coordinator returns the same replacement credential rather than creating another one"
+    },
+    {
+      "id": "credential-rotation-acknowledgement",
+      "category": "credentials",
+      "given": "Old and replacement credentials overlap",
+      "when": "A request authenticates with the replacement credential",
+      "then": "The replacement is acknowledged and the old credential is revoked after one heartbeat grace interval"
+    },
+    {
+      "id": "credential-overlap-expiry",
+      "category": "credentials",
+      "given": "A replacement credential was never acknowledged",
+      "when": "The overlap deadline passes",
+      "then": "The old credential is rejected and no overlap is extended implicitly"
+    },
+    {
+      "id": "claim-exact-replay",
+      "category": "claim",
+      "given": "A claim request returned a live lease",
+      "when": "The same claimRequestId and canonical body are retried",
+      "then": "The same lease and fencing token are returned"
+    },
+    {
+      "id": "claim-transfer-limit-mismatch",
+      "category": "claim",
+      "given": "A queued job requires a source, artifact, cache, or log limit above the runner capability",
+      "when": "The runner claims work",
+      "then": "The incompatible job is not leased to that runner"
+    },
+    {
+      "id": "stale-fence-rejection",
+      "category": "fencing",
+      "given": "A lease has expired or been replaced",
+      "when": "The old identity attempts any new or conflicting heartbeat, log, transfer, completion, or abandon mutation",
+      "then": "The coordinator returns 409 and does not mutate the current attempt; a retained exact replay only returns its previously recorded response and grants no renewed authority"
+    },
+    {
+      "id": "log-duplicate-ack",
+      "category": "logs",
+      "given": "A log sequence was appended and its acknowledgement was lost",
+      "when": "The byte-identical sequence is retried",
+      "then": "The coordinator returns the current nextSequence without appending duplicate data"
+    },
+    {
+      "id": "log-sequence-conflict",
+      "category": "logs",
+      "given": "A different chunk reuses an accepted sequence or sends a future sequence",
+      "when": "The chunk is submitted",
+      "then": "The coordinator returns 409 without advancing the acknowledgement"
+    },
+    {
+      "id": "completion-exact-replay",
+      "category": "completion",
+      "given": "A terminal result was accepted and its response was lost",
+      "when": "The exact terminal payload is retried with the retained original identity",
+      "then": "The coordinator returns accepted without duplicating terminal effects"
+    },
+    {
+      "id": "completion-conflict",
+      "category": "completion",
+      "given": "A terminal result is already recorded",
+      "when": "A different terminal payload is submitted",
+      "then": "The coordinator returns 409 and preserves the original terminal result"
+    },
+    {
+      "id": "cancellation-redelivery",
+      "category": "cancellation",
+      "given": "A cancel directive exists for a running attempt",
+      "when": "Heartbeats continue before terminal completion",
+      "then": "Every accepted heartbeat response carries the same cancellation request ID"
+    },
+    {
+      "id": "cancellation-observation",
+      "category": "cancellation",
+      "given": "The runner received a cancellation directive",
+      "when": "The next heartbeat includes observedCancellationRequestId",
+      "then": "The coordinator records the idempotent observation and continues redelivery until terminal"
+    },
+    {
+      "id": "cancellation-force-stop",
+      "category": "cancellation",
+      "given": "Execution does not stop gracefully after cancellation",
+      "when": "terminateBy is reached",
+      "then": "The runner force-stops execution and completes canceled with the directive ID if the fence remains valid"
+    },
+    {
+      "id": "cancellation-after-fence-loss",
+      "category": "cancellation",
+      "given": "The runner is terminating a canceled attempt",
+      "when": "The lease or fence becomes stale before completion",
+      "then": "The runner suppresses terminal completion and further transfer or log mutations"
+    },
+    {
+      "id": "source-digest-mismatch",
+      "category": "integrity",
+      "given": "The source stream bytes or length differ from the lease descriptor",
+      "when": "The runner verifies the downloaded archive",
+      "then": "Execution does not start and the attempt ends as system_error while the fence remains valid"
+    },
+    {
+      "id": "artifact-digest-mismatch",
+      "category": "integrity",
+      "given": "An artifact upload body differs from its declared bytes or SHA-256",
+      "when": "The coordinator verifies the staged body",
+      "then": "Publication fails atomically and no artifact record becomes visible"
+    },
+    {
+      "id": "cache-trust-isolation",
+      "category": "authorization",
+      "given": "A cache was produced in a trusted repository context",
+      "when": "A pull request run, which is always untrusted (see Trust), requests the same logical cache key",
+      "then": "The coordinator returns no trusted cache because the trust namespaces differ"
+    },
+    {
+      "id": "claim-acceptance-required",
+      "category": "claim",
+      "given": "A runner has received and validated a live lease",
+      "when": "Execution would start before a fenced accept request returns 204",
+      "then": "The runner does not start execution"
+    },
+    {
+      "id": "claim-tombstone",
+      "category": "claim",
+      "given": "A claim key previously returned a lease that is now expired or terminal",
+      "when": "The exact claim is retried during the session tombstone period",
+      "then": "The coordinator returns 409 and never leases a different job for that key"
+    },
+    {
+      "id": "accept-exact-replay",
+      "category": "claim",
+      "given": "A valid acceptance transitioned a lease to running but its response was lost",
+      "when": "The exact accept request is retried while retained",
+      "then": "The coordinator returns 204 without another transition or reviving terminal work"
+    },
+    {
+      "id": "recovery-ownership",
+      "category": "recovery",
+      "given": "A runner starts a new authenticated session",
+      "when": "It reports an interrupted attempt not owned by the same runner and exact previous session",
+      "then": "The coordinator returns 409 without disclosing state or reconciling the target attempt"
+    },
+    {
+      "id": "recovery-never-resumes",
+      "category": "recovery",
+      "given": "A valid interrupted-attempt recovery is accepted",
+      "when": "The runner tries to use recovery as execution, transfer, log, fence renewal, or completion authority",
+      "then": "Every operation is rejected because recovery only reconciles and never restores a fence"
+    },
+    {
+      "id": "compiled-step-order",
+      "category": "execution",
+      "given": "A workflow job compiles to multiple ordered steps",
+      "when": "The runner executes the accepted job",
+      "then": "Fresh containers run each argument array in declaration order against the same bounded workspace and stop after the first non-zero exit"
+    },
+    {
+      "id": "immutable-image-required",
+      "category": "execution",
+      "given": "A compiled job names an OCI image without a sha256 digest",
+      "when": "The coordinator validates or runner receives the job",
+      "then": "The job is rejected before execution"
+    },
+    {
+      "id": "command-total-bytes",
+      "category": "limits",
+      "given": "Every command argument is individually valid but their combined UTF-8 bytes exceed 128 KiB",
+      "when": "The workflow is compiled or the lease is validated",
+      "then": "The job is rejected before execution"
+    },
+    {
+      "id": "workflow-dag-rejection",
+      "category": "compilation",
+      "given": "A workflow contains a missing dependency, cycle, or self-dependency",
+      "when": "The coordinator compiles the expanded DAG",
+      "then": "The workflow fails before any job is enqueued"
+    },
+    {
+      "id": "workflow-expansion-limit",
+      "category": "compilation",
+      "given": "Matrix expansion would produce more than 256 jobs",
+      "when": "The coordinator expands the workflow",
+      "then": "The entire workflow fails without truncation or enqueueing"
+    },
+    {
+      "id": "duplicate-transfer-names",
+      "category": "compilation",
+      "given": "A job repeats an artifact name, cache name, or overlaps declared cache paths",
+      "when": "The coordinator compiles the job",
+      "then": "The workflow fails before enqueueing"
+    },
+    {
+      "id": "environment-secret-collision",
+      "category": "compilation",
+      "given": "Merged environment, job-wide secret targets, or reserved SHIPZONE_CI names collide or exceed 128 names",
+      "when": "The coordinator compiles a step",
+      "then": "The workflow fails before secret resolution or enqueueing"
+    },
+    {
+      "id": "capability-fail-closed",
+      "category": "claim",
+      "given": "A leased job violates the runner capability snapshot despite coordinator matching",
+      "when": "The runner validates before acceptance",
+      "then": "The runner does not accept or execute the job and abandons it as runner_error while the fence is live"
+    },
+    {
+      "id": "archive-path-escape",
+      "category": "integrity",
+      "given": "A source, artifact, or cache archive contains traversal, duplicate normalized paths, unsafe links, or unsupported entry types",
+      "when": "The receiver validates the staged archive",
+      "then": "The archive is rejected before extraction or atomic publication"
+    },
+    {
+      "id": "archive-decompression-limit",
+      "category": "limits",
+      "given": "A source, artifact, or cache archive exceeds compressed bytes, extracted bytes, or entry ceilings",
+      "when": "Either party independently measures the staged archive",
+      "then": "Processing stops, no partial archive is published, and execution terminates system_error when required"
+    },
+    {
+      "id": "transfer-metadata-recomputed",
+      "category": "integrity",
+      "given": "Transfer headers declare digest, compressed bytes, extracted bytes, and entries",
+      "when": "The receiver stages the complete tar.gz archive",
+      "then": "The receiver recomputes all values and rejects any mismatch rather than trusting sender metadata"
+    },
+    {
+      "id": "workspace-limit",
+      "category": "limits",
+      "given": "Source, restored caches, or step output exceeds negotiated workspace bytes or entries",
+      "when": "The runner enforces its attempt-owned workspace quota",
+      "then": "Execution is terminated and completed system_error while the fence remains valid"
+    },
+    {
+      "id": "total-log-limit",
+      "category": "limits",
+      "given": "An attempt reaches its negotiated total log byte ceiling",
+      "when": "Execution produces additional output",
+      "then": "The runner terminates execution and completes system_error without silently truncating logs"
+    },
+    {
+      "id": "artifact-upload-exact-replay",
+      "category": "transfers",
+      "given": "An artifact was atomically published but its TransferRecord response was lost",
+      "when": "The exact transfer request ID, identity, metadata, and body digest are retried",
+      "then": "The coordinator returns the same TransferRecord without publishing another artifact"
+    },
+    {
+      "id": "cache-upload-exact-replay",
+      "category": "transfers",
+      "given": "A cache generation was atomically published but its TransferRecord response was lost",
+      "when": "The exact transfer request ID, identity, metadata, and body digest are retried",
+      "then": "The coordinator returns the same TransferRecord without creating another generation"
+    },
+    {
+      "id": "credential-replay-window-ordering",
+      "category": "credentials",
+      "given": "A registration or replacement credential response declares a replay or overlap deadline",
+      "when": "The response is created",
+      "then": "Credential expiry is at least one maximum heartbeat interval after the corresponding deadline"
+    },
+    {
+      "id": "session-start-exact-replay",
+      "category": "sessions",
+      "given": "A session was atomically created and its response was lost",
+      "when": "The exact session request ID and canonical body are retried",
+      "then": "The coordinator returns the same session response without fencing that session or creating another"
+    },
+    {
+      "id": "session-start-atomic-fencing",
+      "category": "sessions",
+      "given": "A runner intentionally starts a session with a new request ID",
+      "when": "The new response and replay record are durably committed",
+      "then": "All older sessions become stale atomically and cannot mutate their attempts"
+    },
+    {
+      "id": "compiled-job-permission-coherence",
+      "category": "compilation",
+      "given": "A compiled job declares transfers inconsistent with its permissions or required feature flags",
+      "when": "The coordinator enqueues or runner validates the job",
+      "then": "The job is rejected before execution"
+    },
+    {
+      "id": "compiled-job-limit-coherence",
+      "category": "compilation",
+      "given": "Source metadata, declaration counts, or artifact/cache maxima exceed the compiled job requirements",
+      "when": "The coordinator enqueues or runner validates the job",
+      "then": "The job is rejected before execution"
+    },
+    {
+      "id": "source-header-ceilings",
+      "category": "limits",
+      "given": "A source response declares compressed or extracted measurements",
+      "when": "The response is validated",
+      "then": "The source-specific 8 GiB compressed, 64 GiB extracted, and 1,000,000 entry ceilings apply"
+    },
+    {
+      "id": "safe-archive-collection",
+      "category": "integrity",
+      "given": "An artifact or cache path contains symlinks, mount points, or filesystem boundaries",
+      "when": "The runner creates its tar.gz archive",
+      "then": "Traversal never follows links or leaves the declared attempt-workspace root"
+    },
+    {
+      "id": "matrix-json-binding",
+      "category": "compilation",
+      "given": "A matrix job expands to a selected dimension/value object",
+      "when": "The coordinator compiles each expanded job",
+      "then": "Every step receives the RFC 8785 object as SHIPZONE_CI_MATRIX_JSON without interpolation"
+    },
+    {
+      "id": "manual-input-json-binding",
+      "category": "compilation",
+      "given": "A manual dispatch supplies values matching the declared types and choices",
+      "when": "The coordinator compiles the run",
+      "then": "Every step receives the RFC 8785 supplied-value object as SHIPZONE_CI_INPUTS_JSON without interpolation"
+    },
+    {
+      "id": "anchored-glob-grammar",
+      "category": "triggers",
+      "given": "Branch and tag filters contain literals, star, globstar, question mark, or escapes",
+      "when": "The coordinator matches a complete UTF-8 short ref name",
+      "then": "Matching follows the normative anchored case-sensitive grammar and rejects invalid patterns"
+    },
+    {
+      "id": "matrix-number-domain",
+      "category": "compilation",
+      "given": "A matrix contains a YAML numeric scalar",
+      "when": "The coordinator resolves the scalar before schema validation and RFC 8785 binding",
+      "then": "It rejects non-finite or unsafe-integer values and converts accepted values to IEEE 754 binary64 using round-to-nearest ties-to-even"
+    },
+    {
+      "id": "json-and-log-limits",
+      "category": "limits",
+      "given": "A client sends a JSON body above 2 MiB or a log chunk above the negotiated maximum",
+      "when": "The request crosses the limit",
+      "then": "The server stops reading, returns 413, and performs no state mutation"
+    },
+    {
+      "id": "profile-shape-exclusive",
+      "category": "execution",
+      "given": "A compiled job mixes profile shapes, such as an oci-image job with steps or an oci job with a build object",
+      "when": "The coordinator enqueues or the runner validates the job",
+      "then": "The job is rejected before execution because each execution profile admits exactly one shape"
+    },
+    {
+      "id": "lease-grant-binding-coherence",
+      "category": "claim",
+      "given": "A lease has a missing or extra image binding, a second grant for one registry, repository, and access, a push grant on an oci job, or an oci-image job without exactly one push grant",
+      "when": "The runner validates the lease before acceptance",
+      "then": "The runner does not accept the job and abandons it as runner_error while the fence is live"
+    },
+    {
+      "id": "builder-runner-dedicated",
+      "category": "claim",
+      "given": "A runner advertises oci-image together with another execution profile or without microvm isolation",
+      "when": "The coordinator validates the capability snapshot",
+      "then": "The capability snapshot is rejected and no build job is leased to that runner"
+    },
+    {
+      "id": "native-platform-only",
+      "category": "isolation",
+      "given": "A job requires a platform that the runner can execute only through binfmt_misc or user-mode emulation",
+      "when": "The runner advertises capabilities or validates the lease",
+      "then": "The platform is not advertised, the coordinator does not lease the job, and a leased mismatch is abandoned as runner_error"
+    },
+    {
+      "id": "microvm-attempt-teardown",
+      "category": "isolation",
+      "given": "A microvm attempt reaches a terminal state, is abandoned, or loses its fence",
+      "when": "The runner releases the attempt",
+      "then": "The guest, its root filesystem, image store, builder state, and workspace are destroyed and no later attempt observes any of them"
+    },
+    {
+      "id": "grant-not-in-environment",
+      "category": "grants",
+      "given": "A lease carries push or pull grants",
+      "when": "The runner executes steps or Dockerfile instructions and emits logs, errors, and image layers",
+      "then": "No grant secret appears in any step environment, build argument, build secret, log chunk, error body, image layer, or image configuration"
+    },
+    {
+      "id": "grant-fence-revocation",
+      "category": "grants",
+      "given": "An attempt holds a push grant or a pull grant",
+      "when": "Its fence is lost, it is abandoned, or it becomes terminal before a later registry request that uses the grant, whether a read or a write",
+      "then": "The registry rejects the request immediately because it checks live attempt and fence state on every grant use, without waiting for grant expiry"
+    },
+    {
+      "id": "push-grant-scope",
+      "category": "grants",
+      "given": "A build attempt holds a push grant for one candidate repository",
+      "when": "It writes a tag, deletes content, or writes to any other repository",
+      "then": "The registry rejects the request; only blob uploads, permitted blob mounts, and manifests referenced by digest are accepted"
+    },
+    {
+      "id": "pull-grant-read-only",
+      "category": "grants",
+      "given": "An attempt holds a pull grant for one repository",
+      "when": "It uploads or mounts a blob, writes a manifest or a tag, deletes content, or reads any other repository",
+      "then": "The registry rejects the request; only reads of blobs and manifests in the granted repository are accepted"
+    },
+    {
+      "id": "grant-origin-binding",
+      "category": "grants",
+      "given": "A grant names one registry host",
+      "when": "A registry response redirects, or a request would reach any other origin",
+      "then": "The runner never sends the grant credential to another origin and fails the operation instead of following the redirect"
+    },
+    {
+      "id": "image-record-exact-replay",
+      "category": "images",
+      "given": "An image record was accepted and its response was lost",
+      "when": "The exact recordRequestId, identity, and canonical body are retried",
+      "then": "The coordinator returns the same ImageRecord without creating another record; a changed body returns 409"
+    },
+    {
+      "id": "image-record-verification",
+      "category": "images",
+      "given": "A runner records an image whose manifest digest, size, media type, platform, or configuration labels differ from the pushed manifest or the compiled job, or whose manifest was not written under the attempt push grant",
+      "when": "The coordinator verifies the record against the registry",
+      "then": "The coordinator returns 409, records nothing, and the attempt cannot succeed"
+    },
+    {
+      "id": "build-success-requires-image-record",
+      "category": "images",
+      "given": "An oci-image attempt has no accepted image record",
+      "when": "The runner submits a succeeded completion",
+      "then": "The coordinator returns 409; the runner completes system_error while its fence remains valid"
+    },
+    {
+      "id": "build-output-single-manifest",
+      "category": "builds",
+      "given": "An oci-image build completes",
+      "when": "The runner pushes its output",
+      "then": "Exactly one single-platform OCI image manifest is pushed by digest without tags, provenance, SBOM, or attestation manifests"
+    },
+    {
+      "id": "build-unpinned-base-rejected",
+      "category": "builds",
+      "given": "A Dockerfile resolves an image source, including a syntax frontend, that is neither a declared base image nor pinned by SHA-256 digest",
+      "when": "The runner builds the job",
+      "then": "The build fails before the image source is fetched and the attempt completes failed"
+    },
+    {
+      "id": "build-secret-not-in-history",
+      "category": "builds",
+      "given": "A build secret is mounted into a Dockerfile instruction that reads it without writing it to the image filesystem",
+      "when": "The output image and build cache are inspected",
+      "then": "The secret value appears in no layer, history entry, configuration, label, or exported cache record"
+    },
+    {
+      "id": "build-input-secret-collision",
+      "category": "compilation",
+      "given": "A build argument name equals a job secret target or build secret id, or a build secret references an undeclared secret target, or a declared secret target is not referenced by any build secret",
+      "when": "The coordinator compiles the workflow",
+      "then": "The workflow fails before secret resolution or enqueueing",
+      "fixture": "conformance/ci-actions/compile-invalid/build-arg-secret-collision.yml"
+    },
+    {
+      "id": "candidate-reference-requires-needs",
+      "category": "compilation",
+      "given": "A job references a candidate without listing the producing build job in needs, or references a job that is not a build job, or a base-image candidate lacks a platform of the consuming build",
+      "when": "The coordinator compiles the workflow",
+      "then": "The workflow fails before any job is enqueued",
+      "fixture": "conformance/ci-actions/compile-invalid/candidate-without-needs.yml"
+    },
+    {
+      "id": "candidate-binding-mismatch",
+      "category": "bindings",
+      "given": "A lease binds a candidate to a digest",
+      "when": "The pulled manifest or index digest differs, or the index lacks the job platform",
+      "then": "The runner does not execute the job and completes system_error while the fence remains valid"
+    },
+    {
+      "id": "candidate-trust-isolation",
+      "category": "bindings",
+      "given": "Candidates exist from runs of different trust classes",
+      "when": "The coordinator issues bindings and pull grants",
+      "then": "A job is bound only to candidates assembled in its own run, and a grant never reaches a repository of another trust class"
+    },
+    {
+      "id": "candidate-pull-attempt-private",
+      "category": "bindings",
+      "given": "An image was pulled with a pull grant",
+      "when": "Another attempt on the same runner requests the same digest",
+      "then": "The content is served only from the pulling attempt private store, which is removed at attempt end"
+    },
+    {
+      "id": "index-assembly-deterministic",
+      "category": "candidates",
+      "given": "Every platform build of a candidate has an accepted image record",
+      "when": "The coordinator assembles the candidate index",
+      "then": "The index lists the manifests in declared platform order with no annotations and is serialized with RFC 8785, so equal inputs produce the candidate-image-index digest fixture bytes"
+    },
+    {
+      "id": "untrusted-candidate-retention",
+      "category": "candidates",
+      "given": "An untrusted run assembles a candidate",
+      "when": "The coordinator stores and later evaluates it for publication",
+      "then": "The candidate lives only in the untrusted candidate namespace, is deleted within 7 days, and is never promotable"
+    },
+    {
+      "id": "network-default-none",
+      "category": "network",
+      "given": "A workflow job omits network",
+      "when": "The coordinator compiles the job",
+      "then": "The compiled job carries network mode none; no implicit allowlist exists and egress requires at least one entry"
+    },
+    {
+      "id": "egress-unlisted-host",
+      "category": "network",
+      "given": "A job runs with an egress allowlist",
+      "when": "Code in the sandbox resolves or connects to a name outside the allowlist, uses a non-allowlisted port, or sends UDP other than DNS to the runner resolver",
+      "then": "The resolver refuses the name and the connection is blocked"
+    },
+    {
+      "id": "egress-ip-literal",
+      "category": "network",
+      "given": "A job runs with an egress allowlist",
+      "when": "Code connects to an IP address that the runner resolver did not return to this attempt for an allowed name within its TTL",
+      "then": "The connection is blocked; IP literals are also rejected in allowlist entries at compilation"
+    },
+    {
+      "id": "egress-private-rebinding",
+      "category": "network",
+      "given": "An allowlisted name resolves to a loopback, private, link-local, metadata, shared, unique-local, multicast, unspecified, or deployment-internal address",
+      "when": "The runner resolver answers the query",
+      "then": "The address is withheld and connections to it are blocked"
+    },
+    {
+      "id": "egress-name-mismatch",
+      "category": "network",
+      "given": "A connection to an address pinned for an allowed name uses port 443 or 80",
+      "when": "Its TLS SNI or HTTP Host names a different host",
+      "then": "The runner blocks the connection"
+    },
+    {
+      "id": "publish-requires-all-jobs-succeeded",
+      "category": "publication",
+      "given": "A tag run has at least one failed, canceled, timed-out, or system_error job",
+      "when": "The run finishes",
+      "then": "Qualification never starts and nothing is published"
+    },
+    {
+      "id": "publish-denied-untrusted",
+      "category": "publication",
+      "given": "A pull request, branch push, manual dispatch, or other untrusted run declares a publish block",
+      "when": "The coordinator resolves permissions",
+      "then": "Publish permissions resolve to none and no qualification or publication occurs"
+    },
+    {
+      "id": "publish-requires-protected-tag",
+      "category": "publication",
+      "given": "A tag push runs a workflow with a publish block",
+      "when": "The tag matches no protected-tag rule, the rule does not authorize the actor, or the tagged commit is not reachable from a protected branch",
+      "then": "Publish permissions resolve to none and nothing is published"
+    },
+    {
+      "id": "publish-resume-authorized-maintainer",
+      "category": "publication",
+      "given": "A tag run stopped before completing its publications",
+      "when": "A maintainer authorized by the protected-tag rule dispatches a resume",
+      "then": "The coordinator reuses the compiled plan, candidates, artifacts, and qualification record, continues from the first incomplete publication, and rejects the resume from any other actor"
+    },
+    {
+      "id": "publish-credentials-coordinator-held",
+      "category": "publication",
+      "given": "A publication targets an image registry, npm registry, or release asset store",
+      "when": "The coordinator publishes",
+      "then": "It uses destination credentials held by the coordinator and no job, lease, grant, log, or artifact ever receives them"
+    },
+    {
+      "id": "promotion-predecessor-precondition",
+      "category": "publication",
+      "given": "Qualification recorded the predecessor of each destination alias",
+      "when": "The alias target changes before promotion writes it",
+      "then": "The coordinator does not overwrite the alias and marks the publication conflict for human resolution"
+    },
+    {
+      "id": "promotion-exact-replay",
+      "category": "publication",
+      "given": "A destination alias already points at the candidate index digest",
+      "when": "Promotion runs again for the same run",
+      "then": "The coordinator treats the alias as published without another write"
+    },
+    {
+      "id": "npm-version-matches-tag",
+      "category": "publication",
+      "given": "An npm publication references an artifact tarball",
+      "when": "Qualification reads the tarball package.json",
+      "then": "Publication proceeds only when its version equals the tag version, and an existing identical version is success while different content is a conflict"
+    },
+    {
+      "id": "version-alias-requires-semver-tag",
+      "category": "publication",
+      "given": "A publish block uses a version alias or an npm publication",
+      "when": "A tag run is triggered by a tag that, with one optional leading v removed, is not a SemVer 2.0.0 version",
+      "then": "Compilation fails and nothing is built or published"
+    },
+    {
+      "id": "sandbox-loopback-private",
+      "category": "network",
+      "given": "Two concurrent attempts, one with network mode none and one with egress, each start a server on the same fixed loopback port and connect to it",
+      "when": "The runner executes both attempts",
+      "then": "Each attempt reaches only its own server over loopback, neither bind fails, and no loopback traffic is subject to the network mode or reaches another attempt or the host"
+    },
+    {
+      "id": "matrix-cache-key-shared",
+      "category": "compilation",
+      "given": "A matrix job declares a cache with a literal key",
+      "when": "The coordinator expands and compiles the job",
+      "then": "Every expanded job carries the unchanged key, so all expansions address the same cache in the run's cache namespace"
+    },
+    {
+      "id": "workspace-resources-compile-to-limits",
+      "category": "compilation",
+      "given": "A workflow job declares resources with workspaceBytes, workspaceEntries, memoryBytes, cpus, pids, and sharedMemoryBytes",
+      "when": "The coordinator compiles the job",
+      "then": "workspaceBytes and workspaceEntries become requirements.limits.maximumWorkspaceBytes and maximumWorkspaceEntries, and the other values appear unchanged in the compiled resources"
+    },
+    {
+      "id": "shared-memory-within-memory",
+      "category": "compilation",
+      "given": "A workflow job declares resources.sharedMemoryBytes greater than its resources.memoryBytes",
+      "when": "The coordinator compiles the workflow",
+      "then": "Compilation fails before enqueueing",
+      "fixture": "conformance/ci-actions/compile-invalid/shared-memory-above-memory.yml"
+    },
+    {
+      "id": "shared-memory-size",
+      "category": "execution",
+      "given": "A compiled oci job declares resources.sharedMemoryBytes",
+      "when": "A step inspects /dev/shm",
+      "then": "/dev/shm in every step container has exactly the declared size, and writes beyond it fail inside the step"
+    },
+    {
+      "id": "resource-capability-matching",
+      "category": "claim",
+      "given": "A runner advertises resources maxima and a queued job declares a resources value above the matching maximum",
+      "when": "The runner claims work",
+      "then": "The coordinator does not lease that job to the runner; a job whose declared resources all fit the maxima remains leasable"
+    },
+    {
+      "id": "version-alias-affixes",
+      "category": "publication",
+      "given": "A tag run for tag v1.2.3 publishes a destination with aliases { kind: version, prefix: v } and { kind: version, prefix: base_, suffix: -alpine }",
+      "when": "The coordinator compiles and promotes the candidate",
+      "then": "The aliases are v1.2.3 and base_1.2.3-alpine; an expansion that is not a valid OCI tag of at most 128 characters, or two aliases expanding to the same tag, fails compilation"
+    },
+    {
+      "id": "publish-order-declared",
+      "category": "publication",
+      "given": "A qualified run declares publish.order [releaseAssets, npm]",
+      "when": "The coordinator publishes",
+      "then": "Every release-asset publication completes before the first npm publication starts, and a release-asset failure leaves npm unpublished; without publish.order the order is images, npm, releaseAssets"
+    },
+    {
+      "id": "release-asset-files-flattened",
+      "category": "publication",
+      "given": "A release-asset artifact contains a nested path, a link, or a file whose name another release-asset file of the run also uses",
+      "when": "The coordinator qualifies the run",
+      "then": "Qualification fails and nothing is published; an artifact of regular root files publishes one asset per file named by its file name"
+    },
+    {
+      "id": "release-asset-readback-verified",
+      "category": "publication",
+      "given": "The forge serves a release asset whose bytes differ from the uploaded file",
+      "when": "The coordinator verifies the publication by downloading every asset from the release download location",
+      "then": "The publication fails on the size or SHA-256 mismatch and the remaining publications do not run"
+    },
+    {
+      "id": "release-asset-exact-replay",
+      "category": "publication",
+      "given": "The tag release already holds an asset with the same name and SHA-256, and another asset with the same name but different bytes",
+      "when": "Release-asset publication runs",
+      "then": "The identical asset counts as published without another upload, and the differing asset is a conflict requiring a human decision"
+    },
+    {
+      "id": "release-prerelease-from-tag",
+      "category": "publication",
+      "given": "Release-asset publications run for tags v2.0.0-rc.1 and v2.0.0",
+      "when": "The coordinator creates the releases",
+      "then": "The v2.0.0-rc.1 release is marked as a prerelease and the v2.0.0 release is not"
+    },
+    {
+      "id": "release-draft-conflict",
+      "category": "publication",
+      "given": "Tag v1.2.3 has an existing draft release named v1.2.3 with the expected body and prerelease mark",
+      "when": "Release-asset publication runs for the tag",
+      "then": "The publication is a conflict that needs a human; the coordinator neither uploads assets to the draft nor reports success, and every release it creates itself is published, not a draft"
+    },
+    {
+      "id": "release-notes-artifact",
+      "category": "publication",
+      "given": "publish.releaseNotes references an artifact with exactly one UTF-8 file of at most 1 MiB",
+      "when": "The coordinator creates the tag release",
+      "then": "The file content is the release body; an artifact with more than one entry, a non-regular entry, or more than 1 MiB fails qualification, and an existing release with a different body is a conflict"
+    },
+    {
+      "id": "vm-requires-microvm",
+      "category": "compilation",
+      "given": "A workflow job declares runner.profile vm, or a compiled vm job declares container isolation or no requirements.platform",
+      "when": "The coordinator compiles or enqueues the job, or the runner validates it",
+      "then": "A valid vm job compiles to requirements.isolation microvm and requirements.platform equal to runner.platform; a vm job with container isolation or without a platform is rejected before execution"
+    },
+    {
+      "id": "vm-platform-matching",
+      "category": "claim",
+      "given": "Runners advertise vm with microvm for linux/amd64, vm with microvm for darwin/arm64, and oci without vm, and a vm job requires linux/amd64 or darwin/arm64",
+      "when": "The coordinator matches the job to runners",
+      "then": "The job is leased only to a runner whose capability snapshot contains vm, microvm, and exactly the job platform; a darwin/arm64 job never reaches a linux runner, a linux job never reaches a runner that advertises only darwin/arm64, and a capability snapshot with vm but without microvm, or with vm and oci-image, is rejected"
+    },
+    {
+      "id": "vm-guest-root-confined",
+      "category": "isolation",
+      "given": "A vm job step runs as root in the guest, attaches a loop device, creates network namespaces, starts a container engine, and enumerates devices",
+      "when": "The step inspects its environment and attempts to reach host resources",
+      "then": "Root privileges work inside the guest, but no host device, filesystem path, or socket is visible, no image grant or runner credential is present in the guest, network enforcement is unchanged, and no other attempt is observable"
+    },
+    {
+      "id": "vm-step-process-teardown",
+      "category": "execution",
+      "given": "A vm job step starts a daemonized descendant process, such as a container engine, and exits zero",
+      "when": "The runner starts the next step",
+      "then": "Every process the previous step started, including detached and daemonized descendants, has been terminated before the next step starts, while files the previous step wrote remain in the guest"
+    },
+    {
+      "id": "vm-nested-traffic-enforced",
+      "category": "network",
+      "given": "A vm job with an egress allowlist runs a container engine in the guest and a nested container connects to an unlisted host, an allowlisted host, and a private address, and a second nested container on the guest bridge",
+      "when": "The connections leave the guest through the guest address translation, or stay on the guest bridge",
+      "then": "Only the connection to the allowlisted host on an allowlisted port leaves the sandbox; the unlisted host and the private address are refused as for any sandbox connection, and traffic between the two nested containers on the guest bridge is permitted and never leaves the guest"
+    },
+    {
+      "id": "container-platform-linux-only",
+      "category": "compilation",
+      "given": "An oci job pins runner.platform darwin/arm64, a build job lists darwin/arm64 in build.platforms, or a compiled oci or oci-image job carries requirements.platform darwin/arm64",
+      "when": "The workflow or the compiled job is validated",
+      "then": "The schema rejects it before compilation or execution, because oci and oci-image execute only linux platforms; darwin/arm64 is accepted only for vm jobs"
+    },
+    {
+      "id": "job-trigger-filter-skips",
+      "category": "compilation",
+      "given": "A workflow declares push and tag triggers and a job with triggers [tag] that references a secret",
+      "when": "A branch push run and a tag run of the same commit are compiled",
+      "then": "The push run contains no compiled job, plan digest, lease, or resolved secret for the job or any of its expansions, and its result is unaffected by it; the tag run compiles the job exactly as it would compile it without triggers"
+    },
+    {
+      "id": "needs-on-skipped-job",
+      "category": "compilation",
+      "given": "A job admits a trigger kind that a job it needs does not admit",
+      "when": "The coordinator compiles any run of the workflow, whatever its kind",
+      "then": "Compilation fails before enqueueing, so no executed job ever waits for a skipped job",
+      "fixture": "conformance/ci-actions/compile-invalid/needs-wider-triggers.yml"
+    },
+    {
+      "id": "publish-reference-admits-tag",
+      "category": "compilation",
+      "given": "A publish entry references an artifact of a job, or a candidate of a build job, whose triggers do not include tag",
+      "when": "The coordinator compiles any run of the workflow",
+      "then": "Compilation fails before enqueueing",
+      "fixture": "conformance/ci-actions/compile-invalid/publish-job-excludes-tag.yml"
+    },
+    {
+      "id": "trigger-kind-admitted",
+      "category": "compilation",
+      "given": "A workflow declares a trigger kind in on that no job admits",
+      "when": "The coordinator compiles any run of the workflow",
+      "then": "Compilation fails before enqueueing, so no run consists only of skipped jobs",
+      "fixture": "conformance/ci-actions/compile-invalid/trigger-kind-without-job.yml"
+    },
+    {
+      "id": "secret-denied-untrusted",
+      "category": "secrets",
+      "given": "A job that is not skipped references a repository secret, in one workflow a secret the repository does not mark protected and in another a protected secret",
+      "when": "An untrusted run of the workflow, such as any pull request run, is compiled",
+      "then": "Compilation fails with code secret_untrusted before any secret value is resolved or any job is enqueued, whether or not the secret is marked protected"
+    },
+    {
+      "id": "protected-secret-denied-unprotected-run",
+      "category": "secrets",
+      "given": "A repository marks a secret protected and a job that is not skipped references it",
+      "when": "A trusted branch push or manual run of the workflow is compiled",
+      "then": "Compilation fails with code protected_secret_denied before any secret value is resolved or any job is enqueued"
+    },
+    {
+      "id": "protected-secret-denied-unprotected-tag",
+      "category": "secrets",
+      "given": "A repository marks a secret protected and a tag-only job references it",
+      "when": "A trusted tag run is compiled whose tag matches no protected-tag rule, whose rule does not authorize the pushing actor, or whose tagged commit is not reachable from a protected branch",
+      "then": "Compilation fails with code protected_secret_denied before any secret value is resolved or any job is enqueued"
+    },
+    {
+      "id": "protected-secret-protected-tag-delivered",
+      "category": "secrets",
+      "given": "A repository marks a secret protected and a tag-only job references it",
+      "when": "A protected tag run of the workflow is compiled and the job is leased",
+      "then": "Only the lease of that job carries the secret value under its declared target; the compiled plan digest carries only the target, and no other job of the run receives the value"
+    },
+    {
+      "id": "protected-secret-lease-recheck",
+      "category": "secrets",
+      "given": "A protected tag run compiled a job that references a protected secret",
+      "when": "Before the job is leased, the protected-tag rule stops authorizing the tag or the tag moves to another commit",
+      "then": "The job is not leased, the secret value is never resolved into a lease, and the job completes system_error"
+    },
+    {
+      "id": "protected-run-cache-isolation",
+      "category": "authorization",
+      "given": "Caches with one key exist, one published by a job of a trusted branch push run and one by a job of a protected tag run of the same repository",
+      "when": "A protected tag run and a trusted run that is not a protected tag run each restore that key and publish it again",
+      "then": "The protected tag run restores only the cache a protected tag run published and the other run only the cache the trusted run published; each publication is visible only in its own namespace, and an untrusted run restores neither"
+    },
+    {
+      "id": "secret-log-redaction",
+      "category": "secrets",
+      "given": "A job receives a secret value of at least 8 bytes, including a multi-line value, and its steps print the value and each of its lines, also across a log chunk boundary",
+      "when": "The runner sends the log chunks",
+      "then": "Every occurrence is replaced with *** and no chunk, and no concatenation of consecutive chunks, contains the value or any of its lines of at least 8 bytes"
+    },
+    {
+      "id": "secret-artifact-rejected",
+      "category": "secrets",
+      "given": "A job writes a secret value or an npm grant token into the content, path, or link target of an entry of a declared artifact or read-write cache",
+      "when": "The runner prepares the archive for publication",
+      "then": "The archive is not published; a required artifact or a cache completes the attempt system_error and an optional artifact is omitted and reported"
+    },
+    {
+      "id": "npm-read-coherence",
+      "category": "compilation",
+      "given": "A job with npmRead lists a registry twice, lists a scope under two registries, names a registry that its egress allowlist does not permit, or defines NPM_CONFIG_USERCONFIG or a build secret with id npmrc",
+      "when": "The coordinator compiles the workflow",
+      "then": "Compilation fails before enqueueing",
+      "fixture": "conformance/ci-actions/compile-invalid/npm-read-registry-not-allowlisted.yml"
+    },
+    {
+      "id": "npm-read-untrusted-rejected",
+      "category": "compilation",
+      "given": "A job that is not skipped declares npmRead",
+      "when": "An untrusted run of the workflow is compiled, including a pull request from a repository writer",
+      "then": "Compilation fails with code npm_read_untrusted before any grant is issued or any job is enqueued"
+    },
+    {
+      "id": "npm-grant-delivery",
+      "category": "grants",
+      "given": "A trusted run leases an oci job, a vm job, and an oci-image job, each with npmRead",
+      "when": "The runner executes them",
+      "then": "The oci and vm steps find NPM_CONFIG_USERCONFIG naming a read-only file outside the workspace that maps every declared scope to its registry and holds one token per registry; the oci-image build receives the same content only as the BuildKit secret npmrc"
+    },
+    {
+      "id": "npm-grant-not-in-environment",
+      "category": "grants",
+      "given": "A lease carries npm grants and the job's steps and Dockerfile instructions use the npm configuration without copying it",
+      "when": "The runner prepares the steps or the build, sends logs and errors, publishes artifacts and caches, and records the built image",
+      "then": "The runner has placed the token only in the npm configuration file or the npmrc BuildKit secret: no other environment value, command, build argument, build secret, compiled job, log chunk, error body, published artifact or cache, or image layer, label, or configuration field contains it"
+    },
+    {
+      "id": "npm-grant-fence-revocation",
+      "category": "grants",
+      "given": "An attempt holds an npm grant",
+      "when": "Its fence is lost, it is abandoned, or it becomes terminal before a later registry request that uses the token, or the token is used to write or to read another scope",
+      "then": "The registry rejects the request immediately because it checks live attempt state and the granted scopes on every use, without waiting for grant expiry"
+    },
+    {
+      "id": "concurrency-waits-in-order",
+      "category": "concurrency",
+      "given": "A workflow declares concurrency with cancelInProgress false, run A with its concurrency key is active, and runs B and then C with the same key are created",
+      "when": "The coordinator schedules the runs",
+      "then": "No job of B or C is enqueued while A is active; B starts only after A is terminal and C only after B is terminal, and no run is canceled"
+    },
+    {
+      "id": "concurrency-cancel-in-progress",
+      "category": "concurrency",
+      "given": "Run A with a concurrency key is active and has not begun qualification; it has a running attempt, a queued job, and a job waiting on needs",
+      "when": "Run B with the same key and cancelInProgress true is created",
+      "then": "A's waiting and queued jobs become canceled without a lease, the running attempt receives a cancellation directive with reason superseded, no job of A is leased again, A publishes nothing, and no job of B is enqueued before A is terminal"
+    },
+    {
+      "id": "concurrency-cancel-pending",
+      "category": "concurrency",
+      "given": "Run A with a concurrency key is active and run B with the same key is pending",
+      "when": "Run C with the same key and cancelInProgress true is created",
+      "then": "B becomes terminal as canceled without any of its jobs being enqueued, A is canceled unless it has begun qualification, and C starts once A is terminal"
+    },
+    {
+      "id": "concurrency-publication-not-canceled",
+      "category": "concurrency",
+      "given": "Run A with a concurrency key has begun qualification or publication",
+      "when": "Run B with the same key and cancelInProgress true is created",
+      "then": "A is not canceled and completes its publications; B stays pending until A is terminal"
+    },
+    {
+      "id": "concurrency-key-scope",
+      "category": "concurrency",
+      "given": "Workflows that declare the same concurrency group and cancelInProgress true, with runs of equal trust class on refs/heads/main, on refs/heads/feature, on two pull requests, a second run of one of those pull requests at a new head commit, and a manual run executing refs/heads/main",
+      "when": "The runs are created while earlier ones are active",
+      "then": "Runs on different refs and runs of different pull requests never wait for or cancel each other; the second run of a pull request supersedes its first run; the manual run on refs/heads/main supersedes the branch push run of main"
+    },
+    {
+      "id": "concurrency-trust-isolation",
+      "category": "concurrency",
+      "given": "An active trusted run and an active protected tag run, each with a concurrency key",
+      "when": "An untrusted run with the same group and ref as the trusted run, and a trusted tag run that is not a protected tag run with the same group and tag as the protected tag run, are created with cancelInProgress true",
+      "then": "Neither new run waits for or cancels the active run it shares a group and ref with, because trust class and the protected-tag-run condition are part of the key"
+    },
+    {
+      "id": "concurrency-requires-key",
+      "category": "concurrency",
+      "given": "An active run with a concurrency key on a ref, a later commit on that ref whose workflow declares no concurrency, and another commit whose workflow fails compilation",
+      "when": "Runs for both commits are created",
+      "then": "The run without concurrency executes without waiting and cancels nothing, and the run that failed compilation cancels nothing"
+    },
+    {
+      "id": "concurrency-not-compiled",
+      "category": "compilation",
+      "given": "Two workflows that differ only in their concurrency declaration",
+      "when": "The coordinator compiles both for the same run context",
+      "then": "The compiled jobs and their compiled plan digests are identical"
+    },
+    {
+      "id": "timeout-default-compiled",
+      "category": "compilation",
+      "given": "A matrix job and a build job with two platforms, neither declaring timeoutMs",
+      "when": "The coordinator compiles the workflow",
+      "then": "Every matrix expansion and every per-platform build job carries timeoutMs 3600000, and the compiled plan digest covers it"
+    },
+    {
+      "id": "timeout-policy-maximum",
+      "category": "limits",
+      "given": "A deployment job-timeout maximum below a job's declared timeoutMs, or below 3600000 for a job that declares none",
+      "when": "The coordinator compiles the workflow",
+      "then": "Compilation fails before any job is enqueued; the coordinator never compiles a shortened timeout"
+    },
+    {
+      "id": "timeout-deadline-enforced",
+      "category": "execution",
+      "given": "An accepted oci or vm attempt whose steps are still running when timeoutMs has elapsed since the runner received HTTP 204 for acceptance; the job declares artifacts with when always, failure, and success and a read-write cache",
+      "when": "The deadline is reached",
+      "then": "The runner begins termination immediately, force-stops execution within 30 seconds, archives only the always and failure artifacts, publishes no cache, and completes timed_out while its fence remains valid"
+    },
+    {
+      "id": "timeout-deadline-scope",
+      "category": "execution",
+      "given": "An accepted attempt whose source extraction or cache restoration, or for oci-image whose build, push, or image record, has not finished when timeoutMs elapses, and another attempt whose last step ends before the deadline but whose artifact upload and cache publication end after it",
+      "when": "The runner handles both attempts",
+      "then": "The first completes timed_out; the second completes by its step outcome, because artifact collection and upload, cache publication, and completion are outside the deadline"
+    },
+    {
+      "id": "timeout-cancellation-precedence",
+      "category": "cancellation",
+      "given": "An attempt that receives a cancellation directive before its deadline, and another that reaches its deadline before a cancellation directive arrives",
+      "when": "Both finish termination",
+      "then": "The first completes canceled with the directive ID and the second completes timed_out"
+    },
+    {
+      "id": "timeout-grant-expiry",
+      "category": "grants",
+      "given": "A lease of a job with timeoutMs T that carries image grants or npm grants",
+      "when": "The coordinator issues the lease",
+      "then": "Every grant expiresAt is no later than the attempt timeout plus 30 seconds; because the lease precedes acceptance, the coordinator bounds it by the time it issues the lease plus T plus 30 seconds"
+    },
+    {
+      "id": "retention-compiles-unchanged",
+      "category": "compilation",
+      "given": "A job with one artifact and one cache that declare retentionDays and one artifact and one cache that do not",
+      "when": "The coordinator compiles the workflow",
+      "then": "Each compiled declaration carries retentionDays exactly when the workflow declares it, with the declared value"
+    },
+    {
+      "id": "retention-policy-maximum",
+      "category": "limits",
+      "given": "A deployment retention maximum below a declared retentionDays, or below 30 for an artifact or 7 for a cache that declares none",
+      "when": "The coordinator compiles the workflow",
+      "then": "Compilation fails before any job is enqueued; the coordinator never shortens retention"
+    },
+    {
+      "id": "artifact-retention-expiry",
+      "category": "retention",
+      "given": "Artifacts published with retentionDays N and without retentionDays",
+      "when": "N days, respectively 30 days, have passed since the createdAt of their TransferRecord",
+      "then": "Each artifact is no longer served for download or usable for qualification or publication, and its content is deleted within 7 days after its expiry"
+    },
+    {
+      "id": "cache-retention-expiry",
+      "category": "retention",
+      "given": "The current cache of a key was published with retentionDays N, or without retentionDays, and has been restored since",
+      "when": "N days, respectively 7 days, have passed since the createdAt of its TransferRecord and a job declaring the key starts",
+      "then": "The restores did not extend the expiry; the attempt restores nothing into the cache paths and proceeds as when no cache of the key was ever published, and an older superseded publication of the key is never restored"
+    },
+    {
+      "id": "retention-upload-replay",
+      "category": "retention",
+      "given": "An artifact or cache upload whose content has expired",
+      "when": "The runner sends an exact replay of the upload",
+      "then": "The coordinator returns the recorded TransferRecord without making the content available again or extending its expiry"
+    },
+    {
+      "id": "publication-expired-artifact",
+      "category": "publication",
+      "given": "A protected tag run whose publish block references an artifact that has expired, either before qualification or before a publication resume",
+      "when": "The coordinator qualifies the run or resumes its publications",
+      "then": "Qualification fails, or the publication that needs the artifact fails and stops the remaining publications; release assets and npm packages published earlier from the artifact are unaffected"
+    },
+    {
+      "id": "secret-value-minimum-bytes",
+      "category": "secrets",
+      "given": "A repository secret value of 7 UTF-8 bytes, such as abcdefg, and a value of four two-byte characters, such as äöüß, which is 8 UTF-8 bytes",
+      "when": "Each is stored as a new secret and as the replacement of an existing secret",
+      "then": "The 7-byte value is refused with code secret_too_short, nothing is stored, and a replaced secret keeps its previous value; the 8-byte value is stored, because length counts UTF-8 bytes and not characters"
+    },
+    {
+      "id": "secret-value-short-line",
+      "category": "secrets",
+      "given": "Values of at least 8 bytes: one with a line shorter than 8 bytes, one with an empty line between two lines of at least 8 bytes, and one whose lines are separated by a lone CR and one of them is shorter than 8 bytes",
+      "when": "Each is stored as a secret, and a job that receives it prints the value and then each of its lines on its own",
+      "then": "Every value is stored; the runner replaces the whole value and every line of at least 8 bytes with ***, and leaves every line shorter than 8 bytes, including the line after the lone CR, unmasked by design"
+    },
+    {
+      "id": "secret-value-short-not-delivered",
+      "category": "secrets",
+      "given": "A coordinator holds a secret value shorter than 8 bytes, stored before it implemented the rule, and a job that is not skipped references it",
+      "when": "A trusted run of the workflow is compiled, and, if the secret is protected, the run is a protected tag run",
+      "then": "Compilation fails with code secret_too_short before any secret value is resolved or any job is enqueued; an untrusted run fails with secret_untrusted and a trusted run that is not a protected tag run with protected_secret_denied instead"
+    },
+    {
+      "id": "npm-grant-token-single-line",
+      "category": "grants",
+      "given": "A job that declares npmRead",
+      "when": "The coordinator issues the lease",
+      "then": "Every npmGrants secret has at least 32 characters and contains neither CR nor LF, so the runner's npm configuration holds it on one line and its redaction set holds it as one member of at least 32 bytes"
+    },
+    {
+      "id": "trust-pull-request-untrusted",
+      "category": "trust",
+      "given": "A workflow with a pullRequest trigger and a job that is not skipped referencing a secret the repository does not mark protected, and pull requests opened by a repository writer from a branch of the same repository, by the repository owner, and by an actor without write access from another repository",
+      "when": "The coordinator creates a run for each pull request, and for each update of its head",
+      "then": "Every run is untrusted: compilation fails with code secret_untrusted, and a run of the same workflow without that job restores and publishes caches only in the untrusted namespace"
+    },
+    {
+      "id": "trust-writer-runs-trusted",
+      "category": "trust",
+      "given": "A workflow whose job that is not skipped references a secret the repository does not mark protected",
+      "when": "A repository writer pushes a branch, pushes a tag, or dispatches a manual run, and the coordinator creates and compiles the run",
+      "then": "The run is trusted: compilation succeeds and the lease of that job carries the secret value under its declared target"
+    },
+    {
+      "id": "trust-non-writer-untrusted",
+      "category": "trust",
+      "given": "An actor that the repository's access control does not permit to push to the repository, such as an actor with read access only",
+      "when": "The coordinator creates a manual or push run whose actor is that actor",
+      "then": "The run is untrusted: a job that is not skipped and references a secret fails compilation with code secret_untrusted, and the run is never a protected tag run"
+    },
+    {
+      "id": "trust-fixed-at-creation",
+      "category": "trust",
+      "given": "A trusted branch push run whose actor was a repository writer when the coordinator created the run",
+      "when": "The actor loses write access before the run's jobs are leased",
+      "then": "The run stays trusted: its cache namespace, concurrency key, and secret delivery are those of a trusted run, and no deployment policy or workflow content changes its trust class"
+    },
+    {
+      "id": "lease-feature-matching",
+      "category": "claim",
+      "given": "A runner whose capability snapshot contains leaseFeatures listing image-pull-grants only, and queued jobs whose leases would carry a pull grant, a candidate binding, or npmGrants",
+      "when": "The runner claims work",
+      "then": "The coordinator leases only the job whose lease carries pull grants and no binding or npmGrants; a runner whose snapshot has no leaseFeatures is matched as before, without a lease-feature condition"
+    },
+    {
+      "id": "timeout-capability-matching",
+      "category": "claim",
+      "given": "A runner whose capability snapshot contains maximumTimeoutMs 7200000, and queued jobs with timeoutMs 7200000 and 7200001",
+      "when": "The runner claims work",
+      "then": "The coordinator leases the first job and never the second to that runner; a runner whose snapshot has no maximumTimeoutMs may be leased either"
+    },
+    {
+      "id": "lease-feature-fail-closed",
+      "category": "claim",
+      "given": "A runner that advertised leaseFeatures without npm-read-grants and maximumTimeoutMs 3600000",
+      "when": "It nevertheless receives a lease that carries npmGrants, or a job whose timeoutMs is 3600001",
+      "then": "The runner does not accept or execute the job and abandons it as runner_error before acceptance while the fence is live"
+    },
+    {
+      "id": "grant-applies-exact",
+      "category": "grants",
+      "given": "A lease with a pull grant for registry registry.example and repository ci/deno, and images registry.example/ci/deno@sha256:…, registry.example/ci/deno-tools@sha256:…, and the hostless deno@sha256:…",
+      "when": "The runner pulls each image",
+      "then": "It presents the grant only when pulling registry.example/ci/deno@sha256:…, and pulls the other two without credentials; no default registry or repository prefix is applied to the hostless reference"
+    },
+    {
+      "id": "grant-coherence-mapping",
+      "category": "claim",
+      "given": "A job whose private image is registry.example:5000/team/app@sha256:…",
+      "when": "The coordinator issues the lease",
+      "then": "The lease carries a pull grant whose registry is registry.example:5000 and whose repository is team/app, the text before the first / and between it and the @; a lease without such a grant is not coherent and is not issued"
+    },
+    {
+      "id": "trust-runner-registration-matching",
+      "category": "trust",
+      "given": "Runners registered for trusted work, for untrusted work, and for both, and queued jobs of a trusted branch push run, a protected tag run, and a pull request run, which is always untrusted",
+      "when": "Each runner claims work",
+      "then": "The runner registered for trusted work is leased only jobs of the trusted and protected tag runs, the runner registered for untrusted work only jobs of the pull request run, and the runner registered for both any of them; no lease or capability snapshot carries the trust class"
+    },
+    {
+      "id": "compile-failure-single-code",
+      "category": "compilation",
+      "given": "A workflow and run that violate rules of several layers, or several rules of the workflow, policy, or run layer",
+      "when": "The coordinator compiles the run",
+      "then": "Compilation fails with exactly one code: a code of the first violated layer in the Compilation Failures table and, within the workflow, policy, and run layers, the first violated code in table order"
+    },
+    {
+      "id": "yaml-subset-before-schema",
+      "category": "compilation",
+      "given": "A workflow that is schema-valid except for an anchor, alias, merge key, explicit tag, directive, duplicate key, or non-string key",
+      "when": "The coordinator parses the workflow",
+      "then": "Compilation fails with the YAML-layer code of the violation before JSON Schema validation runs"
+    },
+    {
+      "id": "spec-checked-before-schema",
+      "category": "versioning",
+      "given": "A workflow whose canonical spec is newer than or of another major version than the coordinator's, and which uses a property the coordinator's schema does not define",
+      "when": "The coordinator compiles the workflow",
+      "then": "Compilation fails with spec_incompatible, not with workflow_schema_invalid"
+    },
+    {
+      "id": "trigger-event-not-matched",
+      "category": "triggers",
+      "given": "A valid workflow whose on block does not declare the event's kind, or whose filter does not match the event's ref or target branch",
+      "when": "The event occurs",
+      "then": "No run is created; a commit whose workflow fails the source, YAML, version, schema, or workflow layer instead gets a run that fails with that code for every event"
+    },
+    {
+      "id": "secret-unknown-rejected",
+      "category": "secrets",
+      "given": "A trusted run in which a job that is not skipped references a secret the repository does not hold",
+      "when": "The coordinator compiles the run",
+      "then": "Compilation fails with code secret_unknown before any secret value is resolved or any job is enqueued"
+    },
+    {
+      "id": "secret-catalogue-hidden-from-untrusted",
+      "category": "secrets",
+      "given": "An untrusted run in which jobs that are not skipped reference secrets that do not exist, are protected, or hold values shorter than 8 bytes",
+      "when": "The coordinator compiles the run",
+      "then": "Compilation fails with secret_untrusted, whatever secrets the repository holds, so the failure reveals nothing about them"
+    },
+    {
+      "id": "permission-declaration-required",
+      "category": "compilation",
+      "given": "A job declares an artifact without resolved artifacts write, a cache without resolved caches read or read-write, or a read-write cache without resolved caches read-write",
+      "when": "The coordinator compiles the workflow",
+      "then": "Compilation fails with permission_insufficient and no declaration is dropped"
+    },
+    {
+      "id": "environment-innermost-wins",
+      "category": "compilation",
+      "given": "A name defined in the workflow, job, and step environment of a container job",
+      "when": "The coordinator compiles the job",
+      "then": "Each compiled step carries the value of the innermost level that defines the name, and the name counts once toward the 128-name limit"
+    },
+    {
+      "id": "compiled-job-derivation",
+      "category": "compilation",
+      "given": "A workflow, run context, and deployment policy of a compile vector",
+      "when": "Two conforming coordinators compile the run",
+      "then": "Both produce the node identities, compiled jobs, and compiled plan digests the vector fixes, including requirements.limits derived from the declarations, the isolation of oci jobs, and the order of features and labels"
+    },
+    {
+      "id": "expansion-node-identity",
+      "category": "compilation",
+      "given": "A plain job, a matrix job, and a build job with two platforms",
+      "when": "The coordinator expands the run",
+      "then": "The nodes are named job, job[n] in expansion order, and job[platform] followed by the assembly node job, in plan order, and needs edges point at every expansion of a needed job or at the assembly node of a needed build job"
+    },
+    {
+      "id": "candidate-platform-required",
+      "category": "compilation",
+      "given": "A container or VM job with a candidate image and a runner.platform that the producing build job does not list, or a base-image candidate that lacks a platform of the consuming build",
+      "when": "The coordinator compiles the workflow",
+      "then": "Compilation fails with candidate_platform_missing before any job is enqueued"
+    }
+  ]
+}