@ship.zone/ci-spec 2.1.1 → 2.1.2

package/changelog.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 2026-09-27 - 2.1.2
+
+### Fixes
+
+- settle the compilation readings the text left open (ci-actions, runner-protocol)
+  - Artifact names are unique among a job's artifacts and cache names among its caches: a transfer is identified by its kind and name, so an artifact and a cache of one job may share a name without failing `transfer_name_duplicate`.
+  - The expanded-job ceiling of 256 counts the job nodes of the expanded DAG: every per-platform build job counts, and a candidate assembly node, which is a coordinator node and not a job, does not.
+  - The 128 names of a step are the union of its merged environment, its job's secret targets, `SHIPZONE_CI_MATRIX_JSON`, `SHIPZONE_CI_INPUTS_JSON`, and, with `npmRead`, `NPM_CONFIG_USERCONFIG`, each counted once; a declared `NPM_CONFIG_USERCONFIG` in a job with `npmRead` therefore fails with `npm_read_invalid`, not `environment_limit_exceeded`.
+  - An `npmRead` registry listed twice is compared as an exact string, without normalizing a trailing `/` or an explicit port 443, as each entry receives a grant that carries its registry as written.
+  - An egress entry `*.example.com` matches every name below `example.com` at any depth, and not `example.com` itself; npm registry hosts are checked against the allowlist the same way.
+  - `NPM_CONFIG_USERCONFIG` and `npmrc` are reserved in a job with `npmRead` of every profile: a build job with the secret target `NPM_CONFIG_USERCONFIG` fails with `npm_read_invalid`, and so does an `oci` or `vm` job whose steps receive the name from the workflow environment, which does not apply to build jobs.
+  - `resources_invalid` compares only a declared `sharedMemoryBytes` with a declared `memoryBytes`; a shared memory size above the deployment's default memory is not a `workflow` layer failure.
+  - A compilation failure is normative only in its code; a location or message reported with it is informative.
+  - Lines end as in YAML 1.2, in a line feed, a carriage return and a line feed, or a carriage return alone, and line breaks in scalar content read as line feeds, so a file with carriage return line breaks holds the same document as the file with line feeds.
+  - A line that begins with U+FEFF ends a block scalar: after a keep-chomped `|+` or `>+` scalar, the empty lines before it are content of the scalar, and the line and the lines after it are not.
+  - Adds 14 compile vectors: 6 workflow-layer failures, 6 workflows that pass the workflow layer and fail the deployment's timeout maximum, and 2 compiled workflows with carriage return line breaks and a byte order mark line after a keep-chomped block scalar. The test's reference YAML layer reads carriage return line breaks and ends a block scalar at a byte order mark line.
+
 ## 2026-09-27 - 2.1.1
 
 ### Fixes

package/conformance/compile-cases.json

@@ -1681,6 +1681,348 @@
         "code": "publish_reference_invalid"
       }
     },
+    {
+      "id": "workflow-transfer-names-per-kind",
+      "description": "An artifact and a cache of one job are both named results: artifacts and caches are separate name spaces. The workflow passes the workflow layer; the job's default timeout of 3,600,000 then exceeds the deployment maximum.",
+      "workflow": {
+        "source": "spec: 2.0.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: write\n  caches: read-write\n  images: none\n  npm: none\n  releaseAssets: none\njobs:\n  test:\n    artifacts:\n      - name: results\n        path: results\n        when: always\n        required: false\n        maximumBytes: 1048576\n        maximumExtractedBytes: 4194304\n        maximumEntries: 100\n    caches:\n      - name: results\n        key: results\n        access: read-write\n        paths:\n          - .cache\n        maximumBytes: 1048576\n        maximumExtractedBytes: 4194304\n        maximumEntries: 100\n    runner:\n      profile: oci\n      labels:\n        - linux\n    execution:\n      profile: oci\n      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n    steps:\n      - run:\n          - pnpm\n          - test\n"
+      },
+      "context": {
+        "repository": {
+          "tenantId": "tenant-1",
+          "repositoryId": "example/app",
+          "url": "https://code.foss.global/example/app"
+        },
+        "sourceObjectId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "source": {
+          "format": "tar.gz",
+          "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+          "sizeBytes": 1024,
+          "extractedSizeBytes": 4096,
+          "entryCount": 4
+        },
+        "trigger": {
+          "kind": "push",
+          "ref": "refs/heads/main"
+        },
+        "trustClass": "trusted",
+        "protectedTagRun": false,
+        "secrets": []
+      },
+      "policy": {
+        "limits": {
+          "maximumSourceArchiveBytes": 1048576,
+          "maximumSourceExtractedBytes": 4194304,
+          "maximumSourceEntries": 1000,
+          "maximumLogChunkBytes": 65536,
+          "maximumTotalLogBytes": 10485760,
+          "maximumWorkspaceBytes": 268435456,
+          "maximumWorkspaceEntries": 100000
+        },
+        "ociIsolation": "container",
+        "maximumTimeoutMs": 1800000
+      },
+      "expected": {
+        "outcome": "failed",
+        "code": "policy_timeout_exceeded"
+      }
+    },
+    {
+      "id": "workflow-expansion-limit-assembly-node",
+      "description": "31 by 8 matrix combinations and 8 build platforms are 256 expanded jobs; the assembly node of the build job is a 257th node and does not count. The workflow passes the workflow layer; the job's default timeout of 3,600,000 then exceeds the deployment maximum.",
+      "workflow": {
+        "source": "spec: 2.0.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: none\n  caches: none\n  images: candidate\n  npm: none\n  releaseAssets: none\njobs:\n  image:\n    runner:\n      profile: oci-image\n      labels:\n        - builder\n    build:\n      context: .\n      dockerfile: Dockerfile\n      platforms:\n        - linux/amd64\n        - linux/arm64\n        - linux/arm/v7\n        - linux/arm/v6\n        - linux/386\n        - linux/ppc64le\n        - linux/s390x\n        - linux/riscv64\n  test:\n    matrix:\n      a: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30]\n      b: [0, 1, 2, 3, 4, 5, 6, 7]\n    runner:\n      profile: oci\n      labels:\n        - linux\n    execution:\n      profile: oci\n      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n    steps:\n      - run:\n          - pnpm\n          - test\n"
+      },
+      "context": {
+        "repository": {
+          "tenantId": "tenant-1",
+          "repositoryId": "example/app",
+          "url": "https://code.foss.global/example/app"
+        },
+        "sourceObjectId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "source": {
+          "format": "tar.gz",
+          "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+          "sizeBytes": 1024,
+          "extractedSizeBytes": 4096,
+          "entryCount": 4
+        },
+        "trigger": {
+          "kind": "push",
+          "ref": "refs/heads/main"
+        },
+        "trustClass": "trusted",
+        "protectedTagRun": false,
+        "secrets": []
+      },
+      "policy": {
+        "limits": {
+          "maximumSourceArchiveBytes": 1048576,
+          "maximumSourceExtractedBytes": 4194304,
+          "maximumSourceEntries": 1000,
+          "maximumLogChunkBytes": 65536,
+          "maximumTotalLogBytes": 10485760,
+          "maximumWorkspaceBytes": 268435456,
+          "maximumWorkspaceEntries": 100000
+        },
+        "ociIsolation": "container",
+        "maximumTimeoutMs": 1800000
+      },
+      "expected": {
+        "outcome": "failed",
+        "code": "policy_timeout_exceeded"
+      }
+    },
+    {
+      "id": "workflow-expansion-limit-build-platforms",
+      "description": "31 by 8 matrix combinations, 8 build platforms, and 1 job are 257 expanded jobs: per-platform build jobs count.",
+      "workflow": {
+        "source": "spec: 2.0.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: none\n  caches: none\n  images: candidate\n  npm: none\n  releaseAssets: none\njobs:\n  image:\n    runner:\n      profile: oci-image\n      labels:\n        - builder\n    build:\n      context: .\n      dockerfile: Dockerfile\n      platforms:\n        - linux/amd64\n        - linux/arm64\n        - linux/arm/v7\n        - linux/arm/v6\n        - linux/386\n        - linux/ppc64le\n        - linux/s390x\n        - linux/riscv64\n  lint:\n    runner:\n      profile: oci\n      labels:\n        - linux\n    execution:\n      profile: oci\n      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n    steps:\n      - run:\n          - pnpm\n          - test\n  test:\n    matrix:\n      a: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30]\n      b: [0, 1, 2, 3, 4, 5, 6, 7]\n    runner:\n      profile: oci\n      labels:\n        - linux\n    execution:\n      profile: oci\n      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n    steps:\n      - run:\n          - pnpm\n          - test\n"
+      },
+      "expected": {
+        "outcome": "failed",
+        "code": "expansion_limit_exceeded"
+      }
+    },
+    {
+      "id": "workflow-environment-limit-names-counted-once",
+      "description": "100 workflow names and 25 step names, NPM_CONFIG_USERCONFIG declared in the step, and the 2 reserved step names are 128 names in a job with npmRead: the declared reserved name counts once, so the limit holds and the step fails npm_read_invalid.",
+      "workflow": {
+        "source": "spec: 2.0.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: none\n  caches: none\n  images: none\n  npm: none\n  releaseAssets: none\nenvironment:\n  W000: w\n  W001: w\n  W002: w\n  W003: w\n  W004: w\n  W005: w\n  W006: w\n  W007: w\n  W008: w\n  W009: w\n  W010: w\n  W011: w\n  W012: w\n  W013: w\n  W014: w\n  W015: w\n  W016: w\n  W017: w\n  W018: w\n  W019: w\n  W020: w\n  W021: w\n  W022: w\n  W023: w\n  W024: w\n  W025: w\n  W026: w\n  W027: w\n  W028: w\n  W029: w\n  W030: w\n  W031: w\n  W032: w\n  W033: w\n  W034: w\n  W035: w\n  W036: w\n  W037: w\n  W038: w\n  W039: w\n  W040: w\n  W041: w\n  W042: w\n  W043: w\n  W044: w\n  W045: w\n  W046: w\n  W047: w\n  W048: w\n  W049: w\n  W050: w\n  W051: w\n  W052: w\n  W053: w\n  W054: w\n  W055: w\n  W056: w\n  W057: w\n  W058: w\n  W059: w\n  W060: w\n  W061: w\n  W062: w\n  W063: w\n  W064: w\n  W065: w\n  W066: w\n  W067: w\n  W068: w\n  W069: w\n  W070: w\n  W071: w\n  W072: w\n  W073: w\n  W074: w\n  W075: w\n  W076: w\n  W077: w\n  W078: w\n  W079: w\n  W080: w\n  W081: w\n  W082: w\n  W083: w\n  W084: w\n  W085: w\n  W086: w\n  W087: w\n  W088: w\n  W089: w\n  W090: w\n  W091: w\n  W092: w\n  W093: w\n  W094: w\n  W095: w\n  W096: w\n  W097: w\n  W098: w\n  W099: w\njobs:\n  test:\n    network:\n      mode: egress\n      allow:\n        - host: 'npm.example.com'\n    npmRead:\n      - registry: https://npm.example.com\n        scopes:\n          - '@example'\n    runner:\n      profile: oci\n      labels:\n        - linux\n    execution:\n      profile: oci\n      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n    steps:\n      - run:\n          - pnpm\n          - test\n        environment:\n          S00: s\n          S01: s\n          S02: s\n          S03: s\n          S04: s\n          S05: s\n          S06: s\n          S07: s\n          S08: s\n          S09: s\n          S10: s\n          S11: s\n          S12: s\n          S13: s\n          S14: s\n          S15: s\n          S16: s\n          S17: s\n          S18: s\n          S19: s\n          S20: s\n          S21: s\n          S22: s\n          S23: s\n          S24: s\n          NPM_CONFIG_USERCONFIG: /tmp/npmrc\n"
+      },
+      "expected": {
+        "outcome": "failed",
+        "code": "npm_read_invalid"
+      }
+    },
+    {
+      "id": "workflow-environment-limit-npm-read",
+      "description": "100 workflow names, 24 step names, 2 secret targets, the 2 reserved step names, and NPM_CONFIG_USERCONFIG of a job with npmRead are 129 names.",
+      "workflow": {
+        "source": "spec: 2.0.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: none\n  caches: none\n  images: none\n  npm: none\n  releaseAssets: none\nenvironment:\n  W000: w\n  W001: w\n  W002: w\n  W003: w\n  W004: w\n  W005: w\n  W006: w\n  W007: w\n  W008: w\n  W009: w\n  W010: w\n  W011: w\n  W012: w\n  W013: w\n  W014: w\n  W015: w\n  W016: w\n  W017: w\n  W018: w\n  W019: w\n  W020: w\n  W021: w\n  W022: w\n  W023: w\n  W024: w\n  W025: w\n  W026: w\n  W027: w\n  W028: w\n  W029: w\n  W030: w\n  W031: w\n  W032: w\n  W033: w\n  W034: w\n  W035: w\n  W036: w\n  W037: w\n  W038: w\n  W039: w\n  W040: w\n  W041: w\n  W042: w\n  W043: w\n  W044: w\n  W045: w\n  W046: w\n  W047: w\n  W048: w\n  W049: w\n  W050: w\n  W051: w\n  W052: w\n  W053: w\n  W054: w\n  W055: w\n  W056: w\n  W057: w\n  W058: w\n  W059: w\n  W060: w\n  W061: w\n  W062: w\n  W063: w\n  W064: w\n  W065: w\n  W066: w\n  W067: w\n  W068: w\n  W069: w\n  W070: w\n  W071: w\n  W072: w\n  W073: w\n  W074: w\n  W075: w\n  W076: w\n  W077: w\n  W078: w\n  W079: w\n  W080: w\n  W081: w\n  W082: w\n  W083: w\n  W084: w\n  W085: w\n  W086: w\n  W087: w\n  W088: w\n  W089: w\n  W090: w\n  W091: w\n  W092: w\n  W093: w\n  W094: w\n  W095: w\n  W096: w\n  W097: w\n  W098: w\n  W099: w\njobs:\n  test:\n    network:\n      mode: egress\n      allow:\n        - host: 'npm.example.com'\n    npmRead:\n      - registry: https://npm.example.com\n        scopes:\n          - '@example'\n    secrets:\n      - name: token-one\n        environment: TOKEN_ONE\n      - name: token-two\n        environment: TOKEN_TWO\n    runner:\n      profile: oci\n      labels:\n        - linux\n    execution:\n      profile: oci\n      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n    steps:\n      - run:\n          - pnpm\n          - test\n        environment:\n          S00: s\n          S01: s\n          S02: s\n          S03: s\n          S04: s\n          S05: s\n          S06: s\n          S07: s\n          S08: s\n          S09: s\n          S10: s\n          S11: s\n          S12: s\n          S13: s\n          S14: s\n          S15: s\n          S16: s\n          S17: s\n          S18: s\n          S19: s\n          S20: s\n          S21: s\n          S22: s\n          S23: s\n"
+      },
+      "expected": {
+        "outcome": "failed",
+        "code": "environment_limit_exceeded"
+      }
+    },
+    {
+      "id": "workflow-npm-read-registry-exact",
+      "description": "https://npm.example.com and https://npm.example.com/ are two registries: registries are compared as exact strings. The workflow passes the workflow layer; the job's default timeout of 3,600,000 then exceeds the deployment maximum.",
+      "workflow": {
+        "source": "spec: 2.0.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: none\n  caches: none\n  images: none\n  npm: none\n  releaseAssets: none\njobs:\n  test:\n    network:\n      mode: egress\n      allow:\n        - host: 'npm.example.com'\n    npmRead:\n      - registry: https://npm.example.com\n        scopes:\n          - '@one'\n      - registry: https://npm.example.com/\n        scopes:\n          - '@two'\n    runner:\n      profile: oci\n      labels:\n        - linux\n    execution:\n      profile: oci\n      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n    steps:\n      - run:\n          - pnpm\n          - test\n"
+      },
+      "context": {
+        "repository": {
+          "tenantId": "tenant-1",
+          "repositoryId": "example/app",
+          "url": "https://code.foss.global/example/app"
+        },
+        "sourceObjectId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "source": {
+          "format": "tar.gz",
+          "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+          "sizeBytes": 1024,
+          "extractedSizeBytes": 4096,
+          "entryCount": 4
+        },
+        "trigger": {
+          "kind": "push",
+          "ref": "refs/heads/main"
+        },
+        "trustClass": "trusted",
+        "protectedTagRun": false,
+        "secrets": []
+      },
+      "policy": {
+        "limits": {
+          "maximumSourceArchiveBytes": 1048576,
+          "maximumSourceExtractedBytes": 4194304,
+          "maximumSourceEntries": 1000,
+          "maximumLogChunkBytes": 65536,
+          "maximumTotalLogBytes": 10485760,
+          "maximumWorkspaceBytes": 268435456,
+          "maximumWorkspaceEntries": 100000
+        },
+        "ociIsolation": "container",
+        "maximumTimeoutMs": 1800000
+      },
+      "expected": {
+        "outcome": "failed",
+        "code": "policy_timeout_exceeded"
+      }
+    },
+    {
+      "id": "workflow-egress-wildcard-any-depth",
+      "description": "The egress entry *.example.com permits the registry host npm.internal.example.com, two labels below example.com. The workflow passes the workflow layer; the job's default timeout of 3,600,000 then exceeds the deployment maximum.",
+      "workflow": {
+        "source": "spec: 2.0.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: none\n  caches: none\n  images: none\n  npm: none\n  releaseAssets: none\njobs:\n  test:\n    network:\n      mode: egress\n      allow:\n        - host: '*.example.com'\n    npmRead:\n      - registry: https://npm.internal.example.com\n        scopes:\n          - '@example'\n    runner:\n      profile: oci\n      labels:\n        - linux\n    execution:\n      profile: oci\n      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n    steps:\n      - run:\n          - pnpm\n          - test\n"
+      },
+      "context": {
+        "repository": {
+          "tenantId": "tenant-1",
+          "repositoryId": "example/app",
+          "url": "https://code.foss.global/example/app"
+        },
+        "sourceObjectId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "source": {
+          "format": "tar.gz",
+          "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+          "sizeBytes": 1024,
+          "extractedSizeBytes": 4096,
+          "entryCount": 4
+        },
+        "trigger": {
+          "kind": "push",
+          "ref": "refs/heads/main"
+        },
+        "trustClass": "trusted",
+        "protectedTagRun": false,
+        "secrets": []
+      },
+      "policy": {
+        "limits": {
+          "maximumSourceArchiveBytes": 1048576,
+          "maximumSourceExtractedBytes": 4194304,
+          "maximumSourceEntries": 1000,
+          "maximumLogChunkBytes": 65536,
+          "maximumTotalLogBytes": 10485760,
+          "maximumWorkspaceBytes": 268435456,
+          "maximumWorkspaceEntries": 100000
+        },
+        "ociIsolation": "container",
+        "maximumTimeoutMs": 1800000
+      },
+      "expected": {
+        "outcome": "failed",
+        "code": "policy_timeout_exceeded"
+      }
+    },
+    {
+      "id": "workflow-egress-wildcard-excludes-domain",
+      "description": "The egress entry *.example.com does not permit the registry host example.com itself.",
+      "workflow": {
+        "source": "spec: 2.0.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: none\n  caches: none\n  images: none\n  npm: none\n  releaseAssets: none\njobs:\n  test:\n    network:\n      mode: egress\n      allow:\n        - host: '*.example.com'\n    npmRead:\n      - registry: https://example.com\n        scopes:\n          - '@example'\n    runner:\n      profile: oci\n      labels:\n        - linux\n    execution:\n      profile: oci\n      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n    steps:\n      - run:\n          - pnpm\n          - test\n"
+      },
+      "expected": {
+        "outcome": "failed",
+        "code": "npm_read_invalid"
+      }
+    },
+    {
+      "id": "workflow-npm-read-workflow-environment",
+      "description": "The workflow environment defines NPM_CONFIG_USERCONFIG, which is in the merged environment of every step of an oci job with npmRead.",
+      "workflow": {
+        "source": "spec: 2.0.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: none\n  caches: none\n  images: none\n  npm: none\n  releaseAssets: none\nenvironment:\n  NPM_CONFIG_USERCONFIG: /tmp/npmrc\njobs:\n  test:\n    network:\n      mode: egress\n      allow:\n        - host: 'npm.example.com'\n    npmRead:\n      - registry: https://npm.example.com\n        scopes:\n          - '@example'\n    runner:\n      profile: oci\n      labels:\n        - linux\n    execution:\n      profile: oci\n      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n    steps:\n      - run:\n          - pnpm\n          - test\n"
+      },
+      "expected": {
+        "outcome": "failed",
+        "code": "npm_read_invalid"
+      }
+    },
+    {
+      "id": "workflow-npm-read-workflow-environment-build-job",
+      "description": "The workflow environment defines NPM_CONFIG_USERCONFIG and only a build job declares npmRead: the workflow environment does not apply to build jobs. The workflow passes the workflow layer; the job's default timeout of 3,600,000 then exceeds the deployment maximum.",
+      "workflow": {
+        "source": "spec: 2.0.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: none\n  caches: none\n  images: candidate\n  npm: none\n  releaseAssets: none\nenvironment:\n  NPM_CONFIG_USERCONFIG: /tmp/npmrc\njobs:\n  image:\n    network:\n      mode: egress\n      allow:\n        - host: 'npm.example.com'\n    npmRead:\n      - registry: https://npm.example.com\n        scopes:\n          - '@example'\n    runner:\n      profile: oci-image\n      labels:\n        - builder\n    build:\n      context: .\n      dockerfile: Dockerfile\n      platforms:\n        - linux/amd64\n"
+      },
+      "context": {
+        "repository": {
+          "tenantId": "tenant-1",
+          "repositoryId": "example/app",
+          "url": "https://code.foss.global/example/app"
+        },
+        "sourceObjectId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "source": {
+          "format": "tar.gz",
+          "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+          "sizeBytes": 1024,
+          "extractedSizeBytes": 4096,
+          "entryCount": 4
+        },
+        "trigger": {
+          "kind": "push",
+          "ref": "refs/heads/main"
+        },
+        "trustClass": "trusted",
+        "protectedTagRun": false,
+        "secrets": []
+      },
+      "policy": {
+        "limits": {
+          "maximumSourceArchiveBytes": 1048576,
+          "maximumSourceExtractedBytes": 4194304,
+          "maximumSourceEntries": 1000,
+          "maximumLogChunkBytes": 65536,
+          "maximumTotalLogBytes": 10485760,
+          "maximumWorkspaceBytes": 268435456,
+          "maximumWorkspaceEntries": 100000
+        },
+        "ociIsolation": "container",
+        "maximumTimeoutMs": 1800000
+      },
+      "expected": {
+        "outcome": "failed",
+        "code": "policy_timeout_exceeded"
+      }
+    },
+    {
+      "id": "workflow-npm-read-build-secret-target",
+      "description": "A build job with npmRead has the secret target NPM_CONFIG_USERCONFIG, which a build secret names.",
+      "workflow": {
+        "source": "spec: 2.0.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: none\n  caches: none\n  images: candidate\n  npm: none\n  releaseAssets: none\njobs:\n  image:\n    network:\n      mode: egress\n      allow:\n        - host: 'npm.example.com'\n    npmRead:\n      - registry: https://npm.example.com\n        scopes:\n          - '@example'\n    secrets:\n      - name: npm-config\n        environment: NPM_CONFIG_USERCONFIG\n    runner:\n      profile: oci-image\n      labels:\n        - builder\n    build:\n      context: .\n      dockerfile: Dockerfile\n      platforms:\n        - linux/amd64\n      secrets:\n        - id: npmconfig\n          environment: NPM_CONFIG_USERCONFIG\n"
+      },
+      "expected": {
+        "outcome": "failed",
+        "code": "npm_read_invalid"
+      }
+    },
+    {
+      "id": "workflow-shared-memory-without-memory",
+      "description": "A job declares sharedMemoryBytes of 8 GiB and no memoryBytes: resources_invalid compares declared values only. The workflow passes the workflow layer; the job's default timeout of 3,600,000 then exceeds the deployment maximum.",
+      "workflow": {
+        "source": "spec: 2.0.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: none\n  caches: none\n  images: none\n  npm: none\n  releaseAssets: none\njobs:\n  test:\n    resources:\n      sharedMemoryBytes: 8589934592\n    runner:\n      profile: oci\n      labels:\n        - linux\n    execution:\n      profile: oci\n      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n    steps:\n      - run:\n          - pnpm\n          - test\n"
+      },
+      "context": {
+        "repository": {
+          "tenantId": "tenant-1",
+          "repositoryId": "example/app",
+          "url": "https://code.foss.global/example/app"
+        },
+        "sourceObjectId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "source": {
+          "format": "tar.gz",
+          "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+          "sizeBytes": 1024,
+          "extractedSizeBytes": 4096,
+          "entryCount": 4
+        },
+        "trigger": {
+          "kind": "push",
+          "ref": "refs/heads/main"
+        },
+        "trustClass": "trusted",
+        "protectedTagRun": false,
+        "secrets": []
+      },
+      "policy": {
+        "limits": {
+          "maximumSourceArchiveBytes": 1048576,
+          "maximumSourceExtractedBytes": 4194304,
+          "maximumSourceEntries": 1000,
+          "maximumLogChunkBytes": 65536,
+          "maximumTotalLogBytes": 10485760,
+          "maximumWorkspaceBytes": 268435456,
+          "maximumWorkspaceEntries": 100000
+        },
+        "ociIsolation": "container",
+        "maximumTimeoutMs": 1800000
+      },
+      "expected": {
+        "outcome": "failed",
+        "code": "policy_timeout_exceeded"
+      }
+    },
     {
       "id": "trigger-branch-not-matched",
       "workflow": {
@@ -2920,6 +3262,252 @@
         ]
       }
     },
+    {
+      "id": "compile-carriage-return-line-breaks",
+      "description": "Every line ends in a carriage return alone, a YAML 1.2 line break; the block scalar reads its line breaks as line feeds.",
+      "workflow": {
+        "source": "spec: 2.0.0\ron:\r  push: {}\rpermissions:\r  source: read\r  artifacts: none\r  caches: none\r  images: none\r  npm: none\r  releaseAssets: none\rjobs:\r  test:\r    runner:\r      profile: oci\r      labels:\r        - linux\r    execution:\r      profile: oci\r      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\r    steps:\r      - run:\r          - pnpm\r          - test\r        environment:\r          NOTE: |\r            x\r            y\r"
+      },
+      "context": {
+        "repository": {
+          "tenantId": "tenant-1",
+          "repositoryId": "example/app",
+          "url": "https://code.foss.global/example/app"
+        },
+        "sourceObjectId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "source": {
+          "format": "tar.gz",
+          "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+          "sizeBytes": 1024,
+          "extractedSizeBytes": 4096,
+          "entryCount": 4
+        },
+        "trigger": {
+          "kind": "push",
+          "ref": "refs/heads/main"
+        },
+        "trustClass": "trusted",
+        "protectedTagRun": false,
+        "secrets": []
+      },
+      "policy": {
+        "limits": {
+          "maximumSourceArchiveBytes": 1048576,
+          "maximumSourceExtractedBytes": 4194304,
+          "maximumSourceEntries": 1000,
+          "maximumLogChunkBytes": 65536,
+          "maximumTotalLogBytes": 10485760,
+          "maximumWorkspaceBytes": 268435456,
+          "maximumWorkspaceEntries": 100000
+        },
+        "ociIsolation": "container"
+      },
+      "expected": {
+        "outcome": "compiled",
+        "workflowDigest": "242def6036a62e9aaa48035fe6b5718f40f3b74500d2d3262dcb5ac388212f40",
+        "nodes": [
+          {
+            "id": "test",
+            "kind": "job",
+            "needs": [],
+            "job": {
+              "spec": "2.0.0",
+              "sourceObjectId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+              "workflowDigest": "242def6036a62e9aaa48035fe6b5718f40f3b74500d2d3262dcb5ac388212f40",
+              "requirements": {
+                "executionProfile": "oci",
+                "isolation": "container",
+                "labels": [
+                  "linux"
+                ],
+                "features": [
+                  "source.tar-gz"
+                ],
+                "limits": {
+                  "maximumSourceArchiveBytes": 1048576,
+                  "maximumSourceExtractedBytes": 4194304,
+                  "maximumSourceEntries": 1000,
+                  "maximumArtifactArchiveBytes": 0,
+                  "maximumArtifactExtractedBytes": 0,
+                  "maximumArtifactEntries": 0,
+                  "maximumArtifacts": 0,
+                  "maximumCacheArchiveBytes": 0,
+                  "maximumCacheExtractedBytes": 0,
+                  "maximumCacheEntries": 0,
+                  "maximumCaches": 0,
+                  "maximumLogChunkBytes": 65536,
+                  "maximumTotalLogBytes": 10485760,
+                  "maximumWorkspaceBytes": 268435456,
+                  "maximumWorkspaceEntries": 100000
+                }
+              },
+              "permissions": {
+                "source": "read",
+                "artifacts": "none",
+                "caches": "none",
+                "images": "none"
+              },
+              "network": {
+                "mode": "none"
+              },
+              "execution": {
+                "profile": "oci",
+                "image": "registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+              },
+              "steps": [
+                {
+                  "command": [
+                    "pnpm",
+                    "test"
+                  ],
+                  "environment": {
+                    "NOTE": "x\ny\n",
+                    "SHIPZONE_CI_MATRIX_JSON": "{}",
+                    "SHIPZONE_CI_INPUTS_JSON": "{}"
+                  }
+                }
+              ],
+              "source": {
+                "format": "tar.gz",
+                "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+                "sizeBytes": 1024,
+                "extractedSizeBytes": 4096,
+                "entryCount": 4
+              },
+              "secrets": {},
+              "timeoutMs": 3600000,
+              "artifacts": [],
+              "caches": [],
+              "compiledPlanDigest": "b68c11661ebb60182581880e4513dc08619e58d7ada5ba5c09ccd20276429b8b"
+            },
+            "secretBindings": {}
+          }
+        ]
+      }
+    },
+    {
+      "id": "compile-byte-order-mark-after-keep-block",
+      "description": "A keep-chomped block scalar ends the document, followed by an empty line, a line of U+FEFF, and an empty line: the empty line before the byte order mark line is content of the scalar, the lines from the byte order mark line on are not.",
+      "workflow": {
+        "source": "spec: 2.0.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: none\n  caches: none\n  images: none\n  npm: none\n  releaseAssets: none\njobs:\n  test:\n    runner:\n      profile: oci\n      labels:\n        - linux\n    execution:\n      profile: oci\n      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n    steps:\n      - run:\n          - pnpm\n          - test\n        environment:\n          NOTE: |+\n            x\n\n\ufeff\n\n"
+      },
+      "context": {
+        "repository": {
+          "tenantId": "tenant-1",
+          "repositoryId": "example/app",
+          "url": "https://code.foss.global/example/app"
+        },
+        "sourceObjectId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "source": {
+          "format": "tar.gz",
+          "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+          "sizeBytes": 1024,
+          "extractedSizeBytes": 4096,
+          "entryCount": 4
+        },
+        "trigger": {
+          "kind": "push",
+          "ref": "refs/heads/main"
+        },
+        "trustClass": "trusted",
+        "protectedTagRun": false,
+        "secrets": []
+      },
+      "policy": {
+        "limits": {
+          "maximumSourceArchiveBytes": 1048576,
+          "maximumSourceExtractedBytes": 4194304,
+          "maximumSourceEntries": 1000,
+          "maximumLogChunkBytes": 65536,
+          "maximumTotalLogBytes": 10485760,
+          "maximumWorkspaceBytes": 268435456,
+          "maximumWorkspaceEntries": 100000
+        },
+        "ociIsolation": "container"
+      },
+      "expected": {
+        "outcome": "compiled",
+        "workflowDigest": "fde33b8dc0ca13394f5f62ac0349b963e5678eae7cce9afa4652faada80531f6",
+        "nodes": [
+          {
+            "id": "test",
+            "kind": "job",
+            "needs": [],
+            "job": {
+              "spec": "2.0.0",
+              "sourceObjectId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+              "workflowDigest": "fde33b8dc0ca13394f5f62ac0349b963e5678eae7cce9afa4652faada80531f6",
+              "requirements": {
+                "executionProfile": "oci",
+                "isolation": "container",
+                "labels": [
+                  "linux"
+                ],
+                "features": [
+                  "source.tar-gz"
+                ],
+                "limits": {
+                  "maximumSourceArchiveBytes": 1048576,
+                  "maximumSourceExtractedBytes": 4194304,
+                  "maximumSourceEntries": 1000,
+                  "maximumArtifactArchiveBytes": 0,
+                  "maximumArtifactExtractedBytes": 0,
+                  "maximumArtifactEntries": 0,
+                  "maximumArtifacts": 0,
+                  "maximumCacheArchiveBytes": 0,
+                  "maximumCacheExtractedBytes": 0,
+                  "maximumCacheEntries": 0,
+                  "maximumCaches": 0,
+                  "maximumLogChunkBytes": 65536,
+                  "maximumTotalLogBytes": 10485760,
+                  "maximumWorkspaceBytes": 268435456,
+                  "maximumWorkspaceEntries": 100000
+                }
+              },
+              "permissions": {
+                "source": "read",
+                "artifacts": "none",
+                "caches": "none",
+                "images": "none"
+              },
+              "network": {
+                "mode": "none"
+              },
+              "execution": {
+                "profile": "oci",
+                "image": "registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+              },
+              "steps": [
+                {
+                  "command": [
+                    "pnpm",
+                    "test"
+                  ],
+                  "environment": {
+                    "NOTE": "x\n\n",
+                    "SHIPZONE_CI_MATRIX_JSON": "{}",
+                    "SHIPZONE_CI_INPUTS_JSON": "{}"
+                  }
+                }
+              ],
+              "source": {
+                "format": "tar.gz",
+                "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+                "sizeBytes": 1024,
+                "extractedSizeBytes": 4096,
+                "entryCount": 4
+              },
+              "secrets": {},
+              "timeoutMs": 3600000,
+              "artifacts": [],
+              "caches": [],
+              "compiledPlanDigest": "5ea1d0fe4980d633960d99241348dc9818e7a1defb7edd0510c15204f0715830"
+            },
+            "secretBindings": {}
+          }
+        ]
+      }
+    },
     {
       "id": "compile-matrix-expansion",
       "description": "Expansion follows dimension declaration order (z before \"2\", the first dimension varying slowest); 0x1F, -0.0, and 1e3 resolve to 31, 0, and 1000 and \"01\" stays a string; the innermost environment level wins; limits take the largest declared maximum of each field; report needs every expansion and precedes test in plan order.",

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@ship.zone/ci-spec',
-    version: '2.1.1',
+    version: '2.1.2',
     description: 'The ship.zone CI standard: language-neutral CI workflow and runner protocol specifications.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxvQkFBb0I7SUFDMUIsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLDZGQUE2RjtDQUMzRyxDQUFBIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ship.zone/ci-spec",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "private": false,
   "description": "The ship.zone CI standard: language-neutral CI workflow and runner protocol specifications.",
   "main": "dist_ts/index.js",

package/readme.md

@@ -12,7 +12,7 @@ The package version is the specification version, and it is the only version in
 spec: 2.0.0
 ```
 
-Compiled jobs and runner protocol messages carry the same `spec` field. An implementation built against version `I` accepts a declared version `D` when both have the same major version and `D` is not newer than `I`; the rule is defined in `spec/runner-protocol.md` and fixed by `conformance/version-cases.json`. Every incompatible change is a new major version, and additions arrive as new minor versions: a workflow that uses a construct introduced in a later minor version declares that version or a later one. Version 2.0.0 renames the package and its normative identifiers (see Migrating from @foss.global/ci-spec), removes the 1.x cross-version rules, and completes the compilation rules: one stable failure code per compilation failure with a fixed precedence, a stricter YAML subset, the derivation of every compiled job member, and the identities of expanded nodes. Version 2.1.0 adds job failure codes: every coherence rule of a compiled job has exactly one code, and a job that is not coherent carries the code of the first rule it violates (see Job Coherence in `spec/runner-protocol.md`); it also exports the reserved names as constants. Version 2.1.1 clarifies compilation: it states the YAML 1.2 character, byte order mark, escape, and document counting rules, bounds collection nesting to 64, and counts the 16 KiB command argument limit in UTF-8 bytes. Documents written against 2.0.0 stay valid. The history of the 1.x rules is in the changelog.
+Compiled jobs and runner protocol messages carry the same `spec` field. An implementation built against version `I` accepts a declared version `D` when both have the same major version and `D` is not newer than `I`; the rule is defined in `spec/runner-protocol.md` and fixed by `conformance/version-cases.json`. Every incompatible change is a new major version, and additions arrive as new minor versions: a workflow that uses a construct introduced in a later minor version declares that version or a later one. Version 2.0.0 renames the package and its normative identifiers (see Migrating from @foss.global/ci-spec), removes the 1.x cross-version rules, and completes the compilation rules: one stable failure code per compilation failure with a fixed precedence, a stricter YAML subset, the derivation of every compiled job member, and the identities of expanded nodes. Version 2.1.0 adds job failure codes: every coherence rule of a compiled job has exactly one code, and a job that is not coherent carries the code of the first rule it violates (see Job Coherence in `spec/runner-protocol.md`); it also exports the reserved names as constants. Version 2.1.1 clarifies compilation: it states the YAML 1.2 character, byte order mark, escape, and document counting rules, bounds collection nesting to 64, and counts the 16 KiB command argument limit in UTF-8 bytes. Version 2.1.2 settles readings the text left open: separate artifact and cache name spaces, the expanded jobs and step environment names that count toward their limits, exact npm registry comparison, egress wildcards at any depth, the npm delivery names reserved in every job profile, the declared values `resources_invalid` compares, informative failure locations, carriage return line breaks, and byte order mark lines after keep-chomped block scalars. Documents written against 2.0.0 stay valid. The history of the 1.x rules is in the changelog.
 
 ## Issue Reporting and Security
 

package/spec/ci-actions.md

@@ -10,6 +10,8 @@ Statements that no conformance case can observe are marked *(non-testable)*.
 
 The coordinator reads the workflow as bytes from the exact source commit being executed. A file of more than 262,144 bytes (256 KiB) fails with `workflow_too_large`, and bytes that are not well-formed UTF-8 fail with `workflow_encoding_invalid`. The file may begin with one byte order mark (U+FEFF), which is not part of the document; the size limit and the raw workflow SHA-256 count every byte as read, including it.
 
+Lines end as in YAML 1.2: a line feed, a carriage return followed by a line feed, and a carriage return that no line feed follows are each one line break, and every line break in scalar content is read as a line feed. A file whose lines end in carriage returns alone therefore holds the same document as the same file with line feeds; the size limit and the raw workflow SHA-256 still count its bytes as read.
+
 Parsing uses YAML 1.2 with the core schema and requires:
 
 - exactly one document. As in YAML 1.2, a `---` directives end marker begins a document, and so does content that no marker precedes; a document end marker `...`, a comment, a blank line, and a byte order mark begin none. An empty file, a file of only comments or only `...` markers, and a file with a second document fail with `workflow_yaml_document_count`. A document followed by several `...` markers is one document, and a file of only `--- # comment` is one empty document, whose null value fails schema validation;
@@ -23,7 +25,7 @@ Parsing uses YAML 1.2 with the core schema and requires:
 The following YAML 1.2 rules fail with `workflow_yaml_syntax`:
 
 - Characters. A C0 control character other than tab, line feed, and carriage return is allowed nowhere, not even in a quoted scalar. DEL (U+007F), a C1 control character other than NEL (U+0080 to U+009F except U+0085), U+FFFE, U+FFFF, and U+FEFF are allowed inside a single- or double-quoted scalar, where they are content, and nowhere else, except where U+FEFF is a byte order mark. Unpaired surrogates cannot occur, because the file is well-formed UTF-8.
-- Byte order marks. One or more U+FEFF at the start of a line are byte order marks, which are not content, when the line comes before the one on which the document begins, is that line, or comes after a document end marker `...`. They are also byte order marks when the line comes after the document's content and it and every later line up to the end of the file, or up to the next `---` or `...` marker, are blank or comment lines: YAML 1.2 lets a document prefix follow a document without a `...` marker, and a `---` after it begins a second document. The file's own leading byte order mark is the first of them. Any other U+FEFF outside a quoted scalar, for example in a plain or block scalar, in a comment, or at the start of a line within the document or followed by content, fails.
+- Byte order marks. One or more U+FEFF at the start of a line are byte order marks, which are not content, when the line comes before the one on which the document begins, is that line, or comes after a document end marker `...`. They are also byte order marks when the line comes after the document's content and it and every later line up to the end of the file, or up to the next `---` or `...` marker, are blank or comment lines: YAML 1.2 lets a document prefix follow a document without a `...` marker, and a `---` after it begins a second document. A line that begins with U+FEFF is neither an empty line nor a content line of a block scalar, so it ends a block scalar as a comment line less indented than the scalar does: after a block scalar with keep chomping (`|+` or `>+`), the empty lines before such a line are content of the scalar, and the line and every line after it are not. The file's own leading byte order mark is the first of them. Any other U+FEFF outside a quoted scalar, for example in a plain or block scalar, in a comment, or at the start of a line within the document or followed by content, fails.
 - Escapes. Every escape in a double-quoted scalar denotes a Unicode scalar value, so every string can be serialized with RFC 8785. A `\u` escape of a high surrogate (`\uD800` to `\uDBFF`) directly followed by a `\u` escape of a low surrogate (`\uDC00` to `\uDFFF`) denotes the one character the pair encodes, as in JSON: `"\uD83D\uDE00"` is U+1F600. Every other escape of a surrogate code point fails, such as a lone `\uD800` or `\uDC00` or the escape `\U0000D800`. Escapes of other characters, including control characters such as `\0` and `\x7F`, are content.
 - Nesting depth. Collections nest at most 64 deep: the root collection has depth 1, and a collection that is an entry of a sequence, or a key or value of a mapping, of depth *d* has depth *d* + 1. A collection of depth 65 fails, so a parser can stop there instead of exhausting its stack. The deepest collection of a schema-valid workflow, an alias of `publish.images[].destinations[].aliases`, has depth 8.
 
@@ -173,9 +175,9 @@ Jobs form an acyclic graph through `needs`. A dependency on a job the workflow d
 
 Steps use argument arrays. Shell strings, arbitrary expression languages, GitHub action compatibility, and unpinned third-party actions are not supported. The coordinator preserves declaration order and emits an ordered compiled `steps` array. Each compiled step contains its command and the complete merged non-secret environment; runners do not perform workflow-level environment merging.
 
-Environment maps are merged in workflow, job, then step order: a name defined at more than one of these levels takes the value of the innermost one. The workflow environment applies only to the steps of `oci` and `vm` jobs. Secret references are job-wide and are injected into every step only after trust evaluation. A secret target equal to a name of the merged environment of any step of the job, two secret references with one target, and any `SHIPZONE_CI_*` name in an environment map or as a secret target fail with `environment_conflict`. A step whose merged environment names, secret targets, and reserved names (see the runner protocol's OCI Container Profile) number more than 128 fails with `environment_limit_exceeded`. A step with a command argument of more than 16,384 UTF-8 bytes, or whose command arguments total more than 131,072 UTF-8 bytes, fails with `command_limit_exceeded`; the schema bounds an argument to 16,384 characters, which can exceed 16,384 bytes.
+Environment maps are merged in workflow, job, then step order: a name defined at more than one of these levels takes the value of the innermost one. The workflow environment applies only to the steps of `oci` and `vm` jobs. Secret references are job-wide and are injected into every step only after trust evaluation. A secret target equal to a name of the merged environment of any step of the job, two secret references with one target, and any `SHIPZONE_CI_*` name in an environment map or as a secret target fail with `environment_conflict`. The names a step receives are the union of the names of its merged environment, the secret targets of its job, and the reserved names (see the runner protocol's OCI Container Profile): `SHIPZONE_CI_MATRIX_JSON`, `SHIPZONE_CI_INPUTS_JSON`, and, in a job with `npmRead`, `NPM_CONFIG_USERCONFIG`. Each name counts once, however many of these sources contain it, so a declared `NPM_CONFIG_USERCONFIG` in a job with `npmRead`, which fails with `npm_read_invalid` (see npm Read Access), adds no name. A step that receives more than 128 names fails with `environment_limit_exceeded`. A step with a command argument of more than 16,384 UTF-8 bytes, or whose command arguments total more than 131,072 UTF-8 bytes, fails with `command_limit_exceeded`; the schema bounds an argument to 16,384 characters, which can exceed 16,384 bytes.
 
-Artifact and cache names must be unique within a job; a repeated name fails with `transfer_name_duplicate`. Cache paths must not overlap each other: two paths overlap when, split at `/` with empty and `.` segments removed, the segments of one are a prefix of the segments of the other. Overlapping paths fail with `cache_path_overlap`. Artifacts and caches are `tar.gz` archives with explicit compressed-byte, extracted-byte, and entry ceilings. Produced digest and size metadata is measured at transfer time and is not part of the compiled declaration.
+Artifact names must be unique among the artifacts of a job, and cache names among its caches; a repeated name fails with `transfer_name_duplicate`. Artifacts and caches are separate name spaces, because a transfer is identified by its kind and its name (see the runner protocol's Transfers and Integrity), so an artifact and a cache of one job may share a name. Cache paths must not overlap each other: two paths overlap when, split at `/` with empty and `.` segments removed, the segments of one are a prefix of the segments of the other. Overlapping paths fail with `cache_path_overlap`. Artifacts and caches are `tar.gz` archives with explicit compressed-byte, extracted-byte, and entry ceilings. Produced digest and size metadata is measured at transfer time and is not part of the compiled declaration.
 
 A cache `key` is a literal and compiles unchanged. The cache namespace of a run is tenant, repository, trust class, and whether the run is a protected tag run (see Triggers): protected tag runs have a namespace of their own, which they alone read and write, and they neither read nor write the namespace of any other trusted run. A cache a protected tag run restores was therefore written by a protected tag run of the same repository. Within one namespace, every job that declares the same key, including every expansion of one matrix job, reads and writes the same cache; the last successful publication wins. A workflow that needs separate caches, for example one per compilation target, declares separate keys in separate jobs.
 
@@ -197,7 +199,7 @@ Limits count every job of the workflow, whether or not a run skips it.
 
 ## Resources
 
-`resources` is optional on every job and applies to every job the declaration expands to. `memoryBytes`, `cpus`, `pids`, and `sharedMemoryBytes` compile unchanged into the compiled job `resources`; `workspaceBytes` and `workspaceEntries` compile into `requirements.limits.maximumWorkspaceBytes` and `requirements.limits.maximumWorkspaceEntries`. An omitted value takes the deployment default. `sharedMemoryBytes` greater than `memoryBytes` of the same job fails with `resources_invalid`.
+`resources` is optional on every job and applies to every job the declaration expands to. `memoryBytes`, `cpus`, `pids`, and `sharedMemoryBytes` compile unchanged into the compiled job `resources`; `workspaceBytes` and `workspaceEntries` compile into `requirements.limits.maximumWorkspaceBytes` and `requirements.limits.maximumWorkspaceEntries`. An omitted value takes the deployment default. `sharedMemoryBytes` greater than `memoryBytes` of the same job fails with `resources_invalid`. The rule compares declared values only and does not apply when a job omits either of them: the `workflow` layer depends only on the workflow bytes (see Compilation Failures), and the compiled job carries only declared values (see Compiled Jobs). A `sharedMemoryBytes` above the deployment's default memory is therefore not a `workflow` layer failure; a deployment may bound it with a policy limit (see Limits), and a runner receives it only when it fits the runner's capabilities (see the runner protocol's Capabilities and Matching).
 
 The runner enforces each value as a ceiling for the whole attempt: `memoryBytes` for all its processes, `cpus` as CPU time in units of one CPU, `pids` as the number of concurrent processes and threads, and `sharedMemoryBytes` as the size of `/dev/shm` inside the sandbox. Resources are matched against runner capabilities as defined by the runner protocol.
 
@@ -237,15 +239,15 @@ A coordinator never delivers a value that is not admissible, for example one it
 
 The following fail with `npm_read_invalid`:
 
-- a registry listed twice, or a scope listed under two registries;
-- a registry whose host and port, 443 unless the URL names one, no entry of the job's `egress` allowlist permits: npm read access adds no network access;
-- in a job with `npmRead`, an environment or secret target named `NPM_CONFIG_USERCONFIG`, or a build secret with id `npmrc`. Both are reserved for grant delivery, and the reserved environment name counts toward the 128 names of every step.
+- a registry listed twice, or a scope listed under two registries. Registries are compared as exact strings, without normalization, for example of a trailing `/` or an explicit port 443: each entry receives its own grant, which carries the entry's registry as written (see the runner protocol's npm Read Grants);
+- a registry whose host and port, 443 unless the URL names one, no entry of the job's `egress` allowlist permits: npm read access adds no network access. An entry permits a host as the runner protocol's Network defines: an exact entry the host itself, and a `*.` entry every name below its domain, at any depth;
+- in a job with `npmRead`, whatever its profile, a secret target named `NPM_CONFIG_USERCONFIG`, a step whose merged environment defines `NPM_CONFIG_USERCONFIG`, or a build secret with id `npmrc`. The merged environment of an `oci` or `vm` step includes the workflow environment, which does not apply to build jobs (see Jobs and Steps). Both names are reserved for grant delivery, and the reserved environment name counts toward the 128 names of every step.
 
 Deployment policy may reject a registry for which it cannot issue grants; compilation then fails with `policy_npm_registry_denied`. npm read grants are issued only to trusted runs: compiling an untrusted run in which a job that is not skipped declares `npmRead` fails with code `npm_read_untrusted`. Every pull request run is untrusted, whatever its author (see Trust), so a workflow that installs private scopes restricts those jobs with `triggers` or declares no `pullRequest` trigger.
 
 ## Image Builds
 
-A build job compiles to one `oci-image` runner job per entry of `build.platforms`, in declared order, plus one coordinator assembly node named after the job. Each expanded build job counts toward the expanded-job ceiling. Build jobs have no matrix.
+A build job compiles to one `oci-image` runner job per entry of `build.platforms`, in declared order, plus one coordinator assembly node named after the job. Each per-platform build job counts toward the expanded-job ceiling; the assembly node is a coordinator node, not a job, and does not count. Build jobs have no matrix.
 
 - `context` and `dockerfile` are paths relative to the repository root; `target` selects a Dockerfile stage. Every entry of `platforms` is a `linux` platform.
 - `buildArgs` are non-secret values compiled into the plan and possibly persisted in image history. Names starting with `BUILDKIT_` are rejected.
@@ -343,7 +345,7 @@ Every job node compiles to one compiled job, a function of the workflow, the run
 
 - Workflow source: 256 KiB.
 - Jobs before expansion: 128.
-- Expanded jobs: 256.
+- Expanded jobs: 256, counting the job nodes of the Expanded DAG and not the candidate assembly nodes.
 - Steps per job: 128.
 - Dependencies per job: 32.
 - Matrix dimensions: 8.
@@ -371,6 +373,8 @@ All objects reject unknown properties. Implementations may use lower deployment
 
 A compilation failure fails the run before any job is enqueued and carries exactly one code. The codes are grouped into layers, which the coordinator evaluates in the order of the table; the first layer with a violation decides the failure. Within the `source`, `yaml`, `version`, and `schema` layers the failure carries the code of any violation of that layer. Within the `workflow`, `policy`, and `run` layers it carries the first code, in table order, whose rule the workflow, run, and policy violate. Trigger matching (see Triggers) happens between the `workflow` and `policy` layers, so a run that is not triggered is never evaluated against the later layers. The `source` through `workflow` layers depend only on the workflow bytes, so every run of one commit fails them alike.
 
+The code is the only normative part of a failure. A coordinator may report diagnostic details with it, such as the location of a violation in the workflow and a message; they are informative, may differ between conforming coordinators, and no conformance case fixes them. When the deciding layer or rule is violated more than once, the specification does not fix which violation such details describe.
+
 | Layer | Code | Rule |
 | --- | --- | --- |
 | source | `workflow_too_large` | the file has more than 262,144 bytes (Parsing) |
@@ -397,9 +401,9 @@ A compilation failure fails the run before any job is enqueued and carries exact
 | workflow | `environment_conflict` | a secret target or reserved-name conflict (Jobs and Steps) |
 | workflow | `environment_limit_exceeded` | more than 128 names in a step (Jobs and Steps) |
 | workflow | `command_limit_exceeded` | a command argument above 16,384 bytes or a command above 131,072 bytes (Jobs and Steps) |
-| workflow | `transfer_name_duplicate` | a repeated artifact or cache name (Jobs and Steps) |
+| workflow | `transfer_name_duplicate` | a name repeated among the artifacts or among the caches of a job (Jobs and Steps) |
 | workflow | `cache_path_overlap` | overlapping cache paths (Jobs and Steps) |
-| workflow | `resources_invalid` | `sharedMemoryBytes` above `memoryBytes` (Resources) |
+| workflow | `resources_invalid` | a declared `sharedMemoryBytes` above the declared `memoryBytes` of its job (Resources) |
 | workflow | `network_host_duplicate` | a repeated egress host (Network) |
 | workflow | `npm_read_invalid` | a broken `npmRead` rule (npm Read Access) |
 | workflow | `build_input_conflict` | a broken build argument or build secret rule (Image Builds) |

package/spec/runner-protocol.md

@@ -276,7 +276,7 @@ Every attempt has network namespaces of its own, shared with no other attempt an
 `network` is part of the compiled job and the plan digest. Its modes are:
 
 - `none`: no traffic leaves the sandbox. This is the default: a workflow job without `network` compiles to `{ "mode": "none" }`.
-- `egress`: outbound access only to the listed `allow` entries. Each entry names one lowercase DNS host, either exact or `*.` followed by at least two labels, and its TCP ports. `*.example.com` matches names below `example.com` but not `example.com` itself. IP literals and single-label names are invalid.
+- `egress`: outbound access only to the listed `allow` entries. Each entry names one lowercase DNS host, either exact or `*.` followed by at least two labels, and its TCP ports. `*.example.com` matches every name below `example.com`, at any depth, such as `a.example.com` and `a.b.example.com`, but not `example.com` itself. IP literals and single-label names are invalid.
 
 An empty allowlist cannot be expressed: `egress` requires at least one entry, `none` is the only representation of no network, and no implicit allowlist exists. Repository templates that need network access declare `egress` with the hosts they need.
 

package/spec/runner.openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "ship.zone CI Runner Protocol",
-    "version": "2.1.1",
+    "version": "2.1.2",
     "description": "Language-neutral, outbound runner protocol of @ship.zone/ci-spec. info.version is the specification version this description is written against. This draft is incompatible with the legacy internal runner protocol it replaces.",
     "license": {
       "name": "MIT",

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@ship.zone/ci-spec',
-  version: '2.1.1',
+  version: '2.1.2',
   description: 'The ship.zone CI standard: language-neutral CI workflow and runner protocol specifications.'
 }