@vzn/vx 0.0.639 → 0.0.641

package/docs/schema.md

@@ -87,7 +87,7 @@ absent, which is what a conditional spread
 held to this: its plugins are objects of functions.
 
 `tasks` is a `Record<string, TaskConfig>`. Task names are strings
-referenced by `dependsOn`, by `cache.inputs.tasks`, and by the CLI
+referenced by `dependsOn`, by `inputs.tasks`, and by the CLI
 (`vx run <taskName>` or `vx run <pkg>#<taskName>`), so a name those
 could not spell is refused at load: an empty one, one with surrounding
 whitespace, one holding `#` (the project separator) or `*` (a pattern),
@@ -109,12 +109,13 @@ interface TaskConfig {
   description?: string // one-line blurb for the picker / --dry view
   exec?: ExecConfig // omit to declare a group task
   dependsOn?: readonly string[] // Turbo/Nx micro-syntax
-  cache?: CacheConfig // caching is opt-in; on a group, a key with no outputs
+  inputs?: InputsConfig // what the task reads: its key, cached or not
+  cache?: CacheConfig // caching is opt-in; needs `exec` and `inputs`
 }
 ```
 
 A task either has an `exec` (it does work) or omits `exec` and declares
-`dependsOn` or `cache` (it's a **group task**: an aggregator, or a key).
+`dependsOn` or `inputs` (it's a **group task**: an aggregator, or a key).
 The loader rejects a task that has none of them — a no-op standalone
 task is almost always a config mistake. `dependsOn: []` is the deliberate form: an
 explicit empty group, for a package that wants a task by that name to
@@ -122,7 +123,7 @@ exist and do nothing.
 
 A project whose config and plugins declare no `build` gets one (owner,
 2026-10-04): a group with `dependsOn: ['^build']` keyed on every file of
-the project (`cache.inputs.files: ['**']`, no outputs). It runs nothing,
+the project (`inputs.files: ['**']`, no outputs). It runs nothing,
 but a dependant behind `^build` folds its key, so a package consumed as
 source moves its dependants' keys and reaches them under `--affected`.
 A config can declare a keyed group too (Group tasks, below). A
@@ -156,8 +157,8 @@ places:
 test: {
   description: 'bun test against the tests/ tree',
   exec: { command: 'bun test' },
+  inputs: { files: ['src/**', 'tests/**'] },
   cache: {
-    inputs: { files: ['src/**', 'tests/**'] },
     outputs: { files: [] },
   },
 }
@@ -319,7 +320,7 @@ daemon, a Docker socket, a device, a VPN-only host.
   declares — a worker cannot reach a port served on the submitter. So is
   a task with a `sandbox` block, and its dependants: the sandbox is this
   machine's machinery, and a boundary a worker does not enforce would
-  pass vacuously. So is a task whose key folds `cache.inputs.runtime` or
+  pass vacuously. So is a task whose key folds `inputs.runtime` or
   `workspaceRuntime`: the key holds this machine's answer, which a worker
   cannot prove it shares. Its dependants are not pinned.
 - **Placement is decided once per task**, before scheduling, so the
@@ -341,8 +342,8 @@ daemon, a Docker socket, a device, a VPN-only host.
   ```ts
   install: {
     exec: { command: 'pnpm install --frozen-lockfile', remote: 'only' },
+    inputs: { files: ['package.json', 'pnpm-lock.yaml'] },
     cache: {
-      inputs: { files: ['package.json', 'pnpm-lock.yaml'] },
       outputs: { files: ['node_modules/**'] },
     },
   },
@@ -539,11 +540,11 @@ highest priority:
    build; if one does, say so explicitly:
 
    ```ts
-   cache: { inputs: { files: ['src/**'], env: ['NODE_OPTIONS'] }, outputs: { files: [] } }
+   inputs: { files: ['src/**'], env: ['NODE_OPTIONS'] }, cache: { outputs: { files: [] } }
    ```
 
    That folds its value into the key. The two axes are orthogonal on
-   purpose: `cache.inputs.env` decides what the key _sees_,
+   purpose: `inputs.env` decides what the key _sees_,
    `exec.env.passThrough` decides what the child _gets_.
 
 2. **`passThrough`** names → value taken from host `process.env` at
@@ -564,14 +565,14 @@ exec: {
 }
 ```
 
-Every name in these lists (and in `cache.inputs.env`) must be one an
+Every name in these lists (and in `inputs.env`) must be one an
 environment can hold: non-empty, with no `=` and no NUL, and a `define`
 value holds no NUL. Such a name is refused at load; it used to reach the
 child split at its `=` or not at all. A `passThrough` or `define` name is
 also a shell variable name, `[A-Za-z_][A-Za-z0-9_]*`: the task runs under
 `sh -c`, and dash (Linux's `sh`) drops any other name from the environment
 it hands the command, so `my.var` reached a task on macOS and never on
-Linux. `cache.inputs.env` takes any such name: the key reads it from vx's
+Linux. `inputs.env` takes any such name: the key reads it from vx's
 own environment.
 
 vx also sets `npm_execpath` to the workspace's package manager (the root
@@ -608,7 +609,7 @@ shows it: the task's output and the line vx adds under a shell's 127 or
 replays, the command a cache entry stores (what `vx why` prints and a
 remote cache receives), the `$ command` line, telemetry records,
 `vx show`, the hashes `vx why` gives for such a variable in
-`cache.inputs.env` (its value, unsalted: the row names it and its change), an executor's error, a plugin's warning or failure (a remote's reply; the failure masked in the error `run()` rejects with), a failed `cache.inputs` runtime probe's error (its command and output), and the run's own invocation line that `vx last` prints (a
+`inputs.env` (its value, unsalted: the row names it and its change), an executor's error, a plugin's warning or failure (a remote's reply; the failure masked in the error `run()` rejects with), a failed `inputs` runtime probe's error (its command and output), and the run's own invocation line that `vx last` prints (a
 secret passed after `--`). So are every string of a
 task `vx show` prints (a runtime probe, `readyWhen`, the description),
 the description `--dry` and the task picker print, a runtime probe's
@@ -701,7 +702,7 @@ Semantics:
   nothing anywhere stays legal, as `'name.*'` does.
 - **`'pkg#name'`** — missing pkg or task is a hard error (you named
   them explicitly). `'//#name'`, Turbo's spelling of the root package,
-  names the root project (D-39) here and in `cache.inputs.tasks`; with no
+  names the root project (D-39) here and in `inputs.tasks`; with no
   root project it is refused as such.
 - **Patterns (`'name.*'` / `'^name.*'`)** — `*` matches any run of
   characters in a task NAME; everything else is literal (the dotted
@@ -714,102 +715,37 @@ Semantics:
   ALL its matches and stops the walk. Patterns are not supported in
   the `'pkg#task'` form. (Nx 19.5 `build-*` parity.)
 - **No bare wildcards or negation here.** `'*'` / `'^*'` / `'!form'`
-  belong in `cache.inputs.tasks` (filtering which upstream hashes
+  belong in `inputs.tasks` (filtering which upstream hashes
   participate in this task's cache key), not in `dependsOn` (declaring
   graph edges). The micro-syntax parser rejects them in this position.
 - **Cycle detection** runs across the resolved graph at the end of
   `buildTaskGraph`. Cycles throw with a path-formatted message.
 
-### `cache` (optional)
-
-```ts
-interface CacheConfig {
-  inputs: CacheInputs // required when `cache` is provided
-  outputs: CacheOutputs // required when `cache` is provided
-  inputStability?: InputStability // optional
-}
-
-interface InputStability {
-  strategy?: 'immutable' | 'mutable' | 'unchecked' // default 'immutable'
-  severity?: 'warn' | 'error' // default 'warn'
-}
-```
-
-`inputStability` says what a write to an input while the command runs
-means. `strategy` says which writes count:
-
-- `'immutable'` (the default, on CI too): any write. An edit undone
-  mid-run, or another task changing the file and putting it back, cannot
-  be told from no edit.
-- `'mutable'`: a file rewritten to the bytes the key folded counts as
-  unchanged, for a task that rewrites its own input identically
-  (tsdown's `package.json`); different bytes still count, and so does
-  any write while another task that may write the file was running (one
-  of the same project, or one whose sandbox grants writes elsewhere in
-  the workspace; a server `vx watch` keeps from an earlier run counts),
-  since it may have changed the file and put it back.
-  The line names that task; order the two with `dependsOn` to save.
-- `'unchecked'`: none. The entry is saved under the key taken before the
-  command, whatever the command did to its inputs; `severity` is ignored.
-  A key that no longer held before the command started still withholds
-  it.
-
-A write that counts withholds the entry, and `severity` says what else
-happens: `'warn'` (the default) keeps the result, says why on the status
-line, and the run goes on; `'error'` fails the task, so the run fails,
-and its label names the file: `failed (src/a.ts changed during the run, exit 1)`
-(`inputMoved` in `vx last --format json`).
-Either way, every task that ran over the task's outputs, down the graph,
-withholds its save too, and a task of any project that declares the
-moved file as an input withholds its own.
-
-Each field is resolved on its own, highest first:
-
-1. `VX_CACHE_INPUT_STABILITY_STRATEGY` (`immutable`, `mutable`,
-   `unchecked`) and `VX_CACHE_INPUT_STABILITY_SEVERITY` (`warn`, `error`), for the whole run
-   (a CI job that wants `error` sets it without editing configs); any
-   other value is refused before a task runs;
-2. the task's own `cache.inputStability`;
-3. the workspace's `inputStability` (`.vx/workspace.ts`);
-4. the default, `'immutable'` and `'warn'`.
-
-Never folded into a cache key.
+### `inputs` (optional)
 
 ```ts
-import { defineProject } from '@vzn/vx/config'
-
-export default defineProject({
-  tasks: {
-    build: {
-      // tsdown rewrites package.json with the same bytes on every build;
-      // different bytes fail the run rather than rebuild next time.
-      exec: { command: 'tsdown' },
-      cache: {
-        inputs: { files: ['src/**', 'package.json'] },
-        outputs: { files: ['dist/**'] },
-        inputStability: { strategy: 'mutable', severity: 'error' },
-      },
-    },
-  },
-})
+inputs?: InputsConfig
 ```
 
-**Caching is opt-in.** Omit `cache` and the task always runs (no read,
-no write). Provide it and caching is active for that task. The
-project loader requires _both_ `inputs` and `outputs` when `cache` is
-set — declaring "what does this read?" and "what does it produce?" is
-a deliberate, conscious choice.
+What the task reads, and so what its key folds. A task is keyed on its
+inputs whether it caches or not, as Turbo and Nx hash every task: a
+dependant folds that key, so an edit to an uncached generator's inputs
+re-runs the cached task behind it. A group with `inputs` is a keyed
+group (Group tasks, below). The default `build` is
+`{ dependsOn: ['^build'], inputs: { files: ['**'] } }`.
 
-**Why opt-in?** Defaulting caching to ON with implicit "all files / no
-outputs" silently produces stale builds the moment a user forgets
-to revisit the config. The cost of a single forgotten cache miss
-(re-run a task) is much less than the cost of a stale cache hit
-(ship broken artifacts).
+A task that runs a command and declares no `inputs` has no key: nothing
+says what it read. A key that folds it is this run's alone, so every
+task behind it misses and saves nothing, never a stale hit. Declare
+`inputs` on an uncached task a cached one depends on;
+`inputs: { files: [] }` is a declaration too: it keys the task on its
+config and its dependencies' keys, and a task behind it can hit. An
+absent `inputs` and an empty one differ.
 
-#### `CacheInputs`
+#### `InputsConfig`
 
 ```ts
-interface CacheInputs {
+interface InputsConfig {
   files: readonly string[] // required
   workspaceFiles?: readonly string[] // optional; workspace-root-relative
   env?: readonly string[] // optional
@@ -880,20 +816,39 @@ lockfile change when a lockfile plugin (`@vzn/vx-lockfile`) is declared.
 
 Always applied to every glob pass (regardless of what you wrote):
 
-- **gitignore filter** — workspace-root + project `.gitignore`.
+- **gitignore filter** — workspace-root + project `.gitignore`, unless
+  an entry names the ignored path outright: a literal (`.env.local`), or
+  a glob whose fixed prefix git ignores (`dist/**`, `dist/*.js`,
+  `.cache/gen/**`), which is then walked on disk under that prefix only.
+  Such a file is hashed from disk and never stored or restored; a
+  missing one is not an input until it exists. A broad glob (`**`,
+  `src/**` over a listed `src`) still skips ignored files, so it never
+  walks `node_modules`.
+  Its bytes differ per machine, so machines with different files miss
+  each other's shared entries. An ignored file never selects a task
+  under `--affected` on its own, as in Nx (only what git sees does); `vx
+watch` re-runs it on an edit there.
 - **Always-ignored** — `.git/**`, `.vx/cache/**`,
-  `.vx/projects.lock.json`, `vx.lock.json`, `*.bun-build`, and Bun's cross-compile extraction
-  directory `.<16 hex>-<8 hex>.tmp/**`, and vx's own restore temp
-  `.vx-tmp-*`, at any depth.
-- **Installs** — an untracked file under any `node_modules/` (ignored or
-  not). A file git TRACKS there, such as a committed test fixture, is an
-  input like any other.
+  `.vx/projects.lock.json`, `vx.lock.json`, and `.vx/tmp/**`, where vx's
+  restores stage, at any depth. Nothing else: a tool's temp files are the
+  task's to exclude. A broad glob on a `bun build --compile` task, or on
+  one that runs beside it, excludes Bun's intermediate and its
+  cross-compile extraction directory itself:
+  `['**/*', '!**/*.bun-build', '!**/.????????????????-????????.tmp/**']`.
+- **Installs** — an untracked file under any `node_modules/` that git
+  does not ignore. An ignored one follows the gitignore filter above
+  like any other ignored path: named outright, it is an input
+  (`node_modules/.prisma/client/**`, a generated client); a broad glob
+  skips it because it is ignored. A file git TRACKS there, such as a committed test fixture, is an input
+  like any other.
 - **Declared `outputs.files`** are excluded — a task never invalidates
   itself via its own output. A path an output `!` entry takes back is
   no output, so it stays an input (A-44). Another task's outputs are
   not excluded for you: an input glob that can match them is refused
-  while `rules.upfrontKeys` is on (X-54), unless git ignores them
-  whole. Write the exclusion, `['**/*', '!dist/**']`, or ignore `dist/`. An input entry the task's OWN outputs take
+  (X-54), unless git ignores them whole, or the producer is a
+  dependency the key does not fold (see Inputs over outputs in §
+  Settings). Write the exclusion,
+  `['**/*', '!dist/**']`, or ignore `dist/`. An input entry the task's OWN outputs take
   back whole is always refused (X-55): vx removes outputs before a run,
   so a formatter declaring `src/**` as both would delete its sources. A
   task that rewrites files in place declares no outputs.
@@ -908,8 +863,9 @@ Workspace-root-relative globs — the Turbo `$TURBO_ROOT$` / Nx
 `{workspaceRoot}` equivalent, for inputs that live outside the project
 dir (a root `tsconfig.base.json`, shared codegen output, …). Same
 syntax as `files` (`!` negation subtracts, in any order), same git-aware
-resolution (tracked + untracked-not-ignored; gitignored files are
-invisible), and the resolved paths join the same cache-key file list.
+resolution (tracked + untracked-not-ignored; a gitignored file only when
+named outright, as in `files`), and the resolved paths join the same
+cache-key file list.
 
 ```ts
 inputs: {
@@ -937,7 +893,7 @@ backslash separator (`src\**`, `src\*.ts`) or a drive (`C:\src\**`,
 backslash stays an escape.
 
 Still applied: the always-ignored set (`.git/**`, `.vx/cache/**`,
-`.vx/projects.lock.json`, `vx.lock.json`, `*.bun-build`, `.<16 hex>-<8 hex>.tmp/**`, `.vx-tmp-*`),
+`.vx/projects.lock.json`, `vx.lock.json`, `.vx/tmp/**`),
 untracked files under `node_modules/`, and the task's own declared
 outputs, `outputs.workspaceFiles` and the `outputs.files` its globs reach
 in its own project (a task never invalidates itself).
@@ -1133,6 +1089,92 @@ task's outputs. Typical case: an integration-test task `dependsOn`s
 `build` for ordering, but its inputs are only the test source — so
 `inputs.tasks: []` to keep `build` from invalidating it.
 
+### `cache` (optional)
+
+```ts
+interface CacheConfig {
+  outputs: CacheOutputs // required when `cache` is provided
+  inputStability?: InputStability // optional
+}
+
+interface InputStability {
+  strategy?: 'immutable' | 'mutable' | 'unchecked' // default 'immutable'
+  severity?: 'warn' | 'error' // default 'warn'
+}
+```
+
+`inputStability` says what a write to an input while the command runs
+means. `strategy` says which writes count:
+
+- `'immutable'` (the default, on CI too): any write. An edit undone
+  mid-run, or another task changing the file and putting it back, cannot
+  be told from no edit.
+- `'mutable'`: a file rewritten to the bytes the key folded counts as
+  unchanged, for a task that rewrites its own input identically
+  (tsdown's `package.json`); different bytes still count, and so does
+  any write while another task that may write the file was running (one
+  of the same project, or one whose sandbox grants writes elsewhere in
+  the workspace; a server `vx watch` keeps from an earlier run counts),
+  since it may have changed the file and put it back.
+  The line names that task; order the two with `dependsOn` to save.
+- `'unchecked'`: none. The entry is saved under the key taken before the
+  command, whatever the command did to its inputs; `severity` is ignored.
+  A key that no longer held before the command started still withholds
+  it.
+
+A write that counts withholds the entry, and `severity` says what else
+happens: `'warn'` (the default) keeps the result, says why on the status
+line, and the run goes on; `'error'` fails the task, so the run fails,
+and its label names the file: `failed (src/a.ts changed during the run, exit 1)`
+(`inputMoved` in `vx last --format json`).
+Either way, every task that ran over the task's outputs, down the graph,
+withholds its save too, and a task of any project that declares the
+moved file as an input withholds its own.
+
+Each field is resolved on its own, highest first:
+
+1. `VX_CACHE_INPUT_STABILITY_STRATEGY` (`immutable`, `mutable`,
+   `unchecked`) and `VX_CACHE_INPUT_STABILITY_SEVERITY` (`warn`, `error`), for the whole run
+   (a CI job that wants `error` sets it without editing configs); any
+   other value is refused before a task runs;
+2. the task's own `cache.inputStability`;
+3. the workspace's `inputStability` (`.vx/workspace.ts`);
+4. the default, `'immutable'` and `'warn'`.
+
+Never folded into a cache key.
+
+```ts
+import { defineProject } from '@vzn/vx/config'
+
+export default defineProject({
+  tasks: {
+    build: {
+      // tsdown rewrites package.json with the same bytes on every build;
+      // different bytes fail the run rather than rebuild next time.
+      exec: { command: 'tsdown' },
+      inputs: { files: ['src/**', 'package.json'] },
+      cache: {
+        outputs: { files: ['dist/**'] },
+        inputStability: { strategy: 'mutable', severity: 'error' },
+      },
+    },
+  },
+})
+```
+
+**Caching is opt-in.** Omit `cache` and the task always runs (no read,
+no write). Provide it and caching is active for that task. The
+project loader requires `exec`, the task's `inputs` and `cache.outputs`
+when `cache` is set: declaring "what does this read?" and "what does
+it produce?" is a deliberate, conscious choice, and a task with no
+command produces nothing to cache.
+
+**Why opt-in?** Defaulting caching to ON with implicit "all files / no
+outputs" silently produces stale builds the moment a user forgets
+to revisit the config. The cost of a single forgotten cache miss
+(re-run a task) is much less than the cost of a stale cache hit
+(ship broken artifacts).
+
 #### `CacheOutputs`
 
 ```ts
@@ -1470,7 +1512,7 @@ shares (L-41): `~/.ssh`, `~/.gnupg`, `~/.aws`, `~/.azure`, `~/.kube`,
 `~/.codex/auth.json`.
 What it grants from there is the union of the read grants and, on Linux,
 the DIRECTORY holding each file-shaped write grant (above).
-Nothing is inherited from `cache` — `cache.inputs` says what INVALIDATES a task, `sandbox.allow`
+Nothing is inherited from `cache` — `inputs` says what INVALIDATES a task, `sandbox.allow`
 says what it may TOUCH, and deriving one from the other made a
 declaration added for caching silently widen the sandbox. The one grant
 vx makes for you is dependencies: `node_modules` and, through it, the
@@ -1484,7 +1526,7 @@ past its `allow.read`.
 
 A task that declares `cache` gets a linked workspace package only when
 its key already answers for it: some task of that package is folded into
-the key through `dependsOn` (as `cache.inputs.tasks` selects it, groups
+the key through `dependsOn` (as `inputs.tasks` selects it, groups
 passing everything through). Every other link inside the workspace root
 is withheld, and a read through one fails the task with the denial plus
 one line naming the package and the edge that would key it. Declaring
@@ -1576,17 +1618,16 @@ dependant's `^build`, by `vx run build --all` — and runs nothing. A
 project with no `build` gets a keyed one (above), which a bare name
 does not select.
 
-A group with `cache` is a **keyed group**: its `cache.inputs` are a key
+A group with `inputs` is a **keyed group**: its `inputs` are a key
 and nothing runs. A task that depends on it folds that key, so an edit
-to those inputs re-runs the dependant, and `--affected` reaches it. Its
-`cache.outputs` must be `{ files: [] }` (a group writes nothing), and it
-needs no `dependsOn`. It spawns nothing, writes no cache entry, and the
+to those inputs re-runs the dependant, and `--affected` reaches it. It
+takes no `cache` (a group writes nothing), and it needs no `dependsOn`. It spawns nothing, writes no cache entry, and the
 run summary does not count it. `@vzn/vx-migrate` writes one for each
 Nx `^production`-style input and each Turbo transit node.
 
 ```ts
 // `test` re-runs when a file under fixtures/ changes; nothing spawns for it
-fixtures: { cache: { inputs: { files: ['fixtures/**'] }, outputs: { files: [] } } },
+fixtures: { inputs: { files: ['fixtures/**'] } },
 test: { exec: { command: 'bun test' }, dependsOn: ['fixtures'], cache: { /* … */ } },
 ```
 
@@ -1624,15 +1665,16 @@ Group tasks:
 
 The loader rejects:
 
-- A task with no `exec`, no `dependsOn` and no `cache` (literal no-op).
-- A group whose `cache.outputs` names a file (a group writes nothing).
+- A task with no `exec`, no `dependsOn` and no `inputs` (literal no-op).
+- A group with `cache` (a group writes nothing).
 
 ## Workspace config (`.vx/workspace.ts`)
 
 Loaded from `.vx/workspace.{ts,mts,js,mjs,cts,cjs}`: the directory holding
 `.vx` is the workspace root. `.vx` also holds the lock (`.vx/projects.lock.json`)
-and `.vx/cache`, the machine-local state (the cache, the workspace id),
-which is the only part git ignores: `.vx/.gitignore` says `/cache`. Every field falls back to its
+`.vx/cache`, the machine-local state (the cache, the workspace id), and
+`.vx/tmp`, where a restore stages files; git ignores only those two:
+`.vx/.gitignore` says `/cache` and `/tmp`. Every field falls back to its
 built-in default.
 
 ```ts
@@ -1648,7 +1690,6 @@ export default defineWorkspace({
     continue: 'deps-ok',
     rules: {
       exclusiveOutputs: true,
-      upfrontKeys: true,
       dependencies: [{ from: 'tag:lib', deny: ['tag:app'] }],
     },
   },
@@ -1660,6 +1701,7 @@ export default defineWorkspace({
     scope: 'main',
     inputStability: { strategy: 'immutable', severity: 'warn' },
     outputs: { clean: true },
+    upload: { failures: 'ci' },
   },
   lock: { reviewFiles: true },
   watch: { poll: false },
@@ -1697,7 +1739,6 @@ default and where it came from.
 | `run.continue`                                 | `VX_RUN_CONTINUE`                   | `--continue`       | one of 'never', 'deps-ok', 'always'                                     | deps-ok                                    | What a failed task takes down: `never` stops the run, `deps-ok` skips its dependents, `always` runs them too.                                       |
 | `run.outputLogs` (variable or flag only)       | `VX_RUN_OUTPUT_LOGS`                | `--output-logs`    | one of 'full', 'errors-only', 'hash-only', 'none'                       | `full` on CI, else by what the run selects | Which task output the run prints. Chosen before the workspace loads, so flag and env only.                                                          |
 | `run.rules.exclusiveOutputs`                   | `VX_RUN_RULES_EXCLUSIVE_OUTPUTS`    | —                  | true or false                                                           | true                                       | Refuse two tasks whose outputs overlap even when an edge orders them.                                                                               |
-| `run.rules.upfrontKeys`                        | `VX_RUN_RULES_UPFRONT_KEYS`         | —                  | true or false                                                           | true                                       | Refuse a task whose inputs can match another task's outputs.                                                                                        |
 | `cache.dir`                                    | `VX_CACHE_DIR`                      | `--cache-dir`      | a non-blank string                                                      | .vx/cache, entries in ~/.vx/<repo>/cache   | Where the cache lives, relative to the workspace root; named, it holds the whole cache.                                                             |
 | `cache.retention.maxSize`                      | `VX_CACHE_RETENTION_MAX_SIZE`       | —                  | a size like '500MB' or '10GB'                                           | none                                       | Evict least-recently-used entries at each run's end until the cache is under this (`'10GB'`).                                                       |
 | `cache.retention.olderThan`                    | `VX_CACHE_RETENTION_OLDER_THAN`     | —                  | a duration like '45s', '12h' or '30d'                                   | none                                       | Evict entries unused for this long at each run's end (`'30d'`).                                                                                     |
@@ -1707,6 +1748,7 @@ default and where it came from.
 | `cache.inputStability.strategy`                | `VX_CACHE_INPUT_STABILITY_STRATEGY` | —                  | one of 'immutable', 'mutable', 'unchecked'                              | immutable                                  | What a write to an input during the command means for the save, for tasks without their own. A task's own `cache.inputStability.strategy` beats it. |
 | `cache.inputStability.severity`                | `VX_CACHE_INPUT_STABILITY_SEVERITY` | —                  | one of 'warn', 'error'                                                  | warn                                       | Whether a skipped save warns or fails the task, for tasks without their own. A task's own `cache.inputStability.severity` beats it.                 |
 | `cache.outputs.clean`                          | —                                   | —                  | true or false                                                           | true                                       | Remove a task's declared outputs before it runs on a miss, for tasks without their own. A task's own `cache.outputs.clean` beats it.                |
+| `cache.upload.failures`                        | —                                   | —                  | one of 'ci', 'local', 'always'                                          | ci                                         | Where a failed task's log and outputs are kept in the remote: CI runs, local runs, or both.                                                         |
 | `lock.reviewFiles`                             | `VX_LOCK_REVIEW_FILES`              | —                  | true or false                                                           | true                                       | `vx lock` writes each project's resolved config, pretty, to `vx.lock.json` beside its `vx.config`, for review; vx never reads it.                   |
 | `watch.poll`                                   | `VX_WATCH_POLL`                     | `vx watch --poll`  | true or false                                                           | false                                      | Poll for changes from the start instead of the OS watcher.                                                                                          |
 | `config.workerTimeout` (variable or flag only) | `VX_CONFIG_WORKER_TIMEOUT`          | —                  | a duration like '500ms', '30s' or '5m', at most 24 days                 | 30s                                        | How long one config evaluation may take.                                                                                                            |
@@ -1734,7 +1776,7 @@ interface RunSettings {
   retries?: number
   continue?: 'never' | 'deps-ok' | 'always'
   /** Graph rules `vx lock` checks, never a run; each on unless set to false. */
-  rules?: { exclusiveOutputs?: boolean; upfrontKeys?: boolean; dependencies?: DependencyRule[] }
+  rules?: { exclusiveOutputs?: boolean; dependencies?: DependencyRule[] }
 }
 
 /** `run.rules.dependencies`, checked by `vx lock` only. */
@@ -1753,6 +1795,7 @@ interface CacheSettings {
   download?: 'all' | 'toplevel' | 'none'
   inputStability?: InputStability
   outputs?: { clean?: boolean }
+  upload?: { failures?: 'ci' | 'local' | 'always' }
 }
 ```
 
@@ -1791,7 +1834,7 @@ interface CacheSettings {
   workspace (`'..'`, `'/'`) is refused before anything is written, since its `*`
   `.gitignore` would hide the sources from git and the cache keys. A
   directory other than the default `.vx/cache` gets that `*` `.gitignore`;
-  the default is ignored by `.vx/.gitignore` (`/cache`) instead, written
+  the default is ignored by `.vx/.gitignore` (`/cache`, `/tmp`) instead, written
   when missing and never edited.
 - **`cache.retention`** — the `vx cache clean` policy, applied at the
   end of every run: entries unused for
@@ -1835,6 +1878,13 @@ interface CacheSettings {
 - **`cache.download`** — which remote hits land on this machine:
   `all` (the default), only the requested tasks' (`toplevel`), or
   `none` (`docs/cli.md` § `--cache-download`).
+- **`cache.upload.failures`** — which runs keep a failed task's log and
+  the files its outputs left in the remote: CI runs (`'ci'`, the
+  default), runs off CI (`'local'`), or both (`'always'`). Only a run
+  whose policy writes a remote keeps any, and it always keeps the log of
+  a task that saved no entry. `ctx.cache.getRun` reads them
+  (`docs/modules/plugin.md` § Run report and run bytes).
+
 - **`cache.scope`** — where this run's cache writes land (2026-10-14).
   Omitted, a run reads and writes the default keys. A name (`'pr-123'`;
   letters, digits, `. _ - / @`, at most 128) reads the default key first,
@@ -1880,34 +1930,6 @@ own output path, or set run.rules.exclusiveOutputs: false in
     Off, the dependant adds to its upstream's tree (item 588;
     `caching.md` § Additive outputs). Two overlapping tasks with no
     edge are refused either way.
-  - **`upfrontKeys`** (X-54) — a cached task whose `inputs.files` can
-    match a same-project task's `outputs.files`, or whose
-    `inputs.workspaceFiles` can match any task's `outputs.workspaceFiles`
-    or another project's `outputs.files` read from the root, or whose
-    `inputs.files` can match another task's `outputs.workspaceFiles`
-    landing in its project (X-135), is refused,
-    edge or no edge: `<reader> reads "<glob>" in cache.inputs.<field>,
-which matches <writer>'s output "<glob>" … Exclude it: add "!<glob>"
-to <reader>'s cache.inputs.<field>, or set run.rules.upfrontKeys:
-false in .vx/workspace.ts to let it wait for its producer.` Such a key
-    reads what the producer writes this run, so vx cannot know it before
-    the producer ran: it is not probed, prefetched or restored ahead of
-    the schedule (`caching.md` § Local restore tier). The upstream's key
-    already reaches the reader through `dependsOn`. A `!` entry that
-    takes the whole output back clears it, and an output the reader's
-    `!` entries take back no longer holds its key back either. Nor does
-    an output git ignores whole: a key reads only what git lists, so
-    `**/*` beside a gitignored `**/dist/**` passes and keys up front. Git
-    is asked, never a `.gitignore` read: `git check-ignore` on the
-    output's directory (for `**/dist/**`, `dist/` and a fresh
-    `__vx_probe__/dist/`), and no tracked or listed file may match it,
-    so a tracked output is still refused. A glob no few paths stand for
-    (`*.js`) is refused as before. `vx lock` asks once for every
-    overlapped output; a run asks once beside its git walk for the
-    stability gate, so a rule changed after the lock keys the reader
-    late until the next `vx lock` refuses it. A task's
-    own outputs, a task with no `cache`, and a group are exempt. Off,
-    the key waits for its producer, as before.
   - **`dependencies`** — which workspace projects a project may depend
     on, checked by `vx lock` and `vx lock --check` only, over each
     project's direct dependencies (its `package.json` buckets and its
@@ -1923,6 +1945,41 @@ false in .vx/workspace.ts to let it wait for its producer.` Such a key
     `lib depends on app, which run.rules.dependencies[0] (from 'tag:lib') denies`,
     every broken edge on its own line. A rule with neither `allow` nor
     `deny` is refused.
+- **Inputs over outputs** (X-54, always checked, no setting) — a cached task whose `inputs.files` can
+  match a same-project task's `outputs.files`, or whose
+  `inputs.workspaceFiles` can match any task's `outputs.workspaceFiles`
+  or another project's `outputs.files` read from the root, or whose
+  `inputs.files` can match another task's `outputs.workspaceFiles`
+  landing in its project (X-135), is refused by `vx lock` unless one of
+  the exceptions below applies: `<reader> reads "<glob>" in inputs.<field>,
+which matches <writer>'s output "<glob>" … Exclude it: add "!<glob>"
+to <reader>'s inputs.<field>, or depend on <writer> and leave it out of
+<reader>'s inputs.tasks, so its key hashes those bytes instead.` Such a key
+  reads what the producer writes this run, so vx cannot know it before
+  the producer ran: it is not probed, prefetched or restored ahead of
+  the schedule (`caching.md` § Local restore tier). The upstream's key
+  already reaches the reader through `dependsOn`. A `!` entry that
+  takes the whole output back clears it, and an output the reader's
+  `!` entries take back no longer holds its key back either. Nor does
+  an output git ignores whole: a key reads only what git lists, so
+  `**/*` beside a gitignored `**/dist/**` passes and keys up front,
+  unless the reader's entry starts in the ignored path (`dist/**`):
+  naming it reads it, so the check applies. A reader may read the
+  outputs of a task in its `dependsOn` closure that its key does not
+  fold: it sets `inputs.tasks` and leaves the producer out, also
+  through the tasks it does fold (a producer folded by a folded task
+  counts as folded). Its key then waits for the producer and hashes
+  the bytes it wrote, so a producer rerun with identical output still
+  hits. `vx lock` checks all of it; a run reads only the lock. Git
+  is asked, never a `.gitignore` read: `git check-ignore` on the
+  output's directory (for `**/dist/**`, `dist/` and a fresh
+  `__vx_probe__/dist/`), and no tracked or listed file may match it,
+  so a tracked output is still refused. A glob no few paths stand for
+  (`*.js`) is refused as before. `vx lock` asks once for every
+  overlapped output; a run asks once beside its git walk for the
+  stability gate, so a rule changed after the lock keys the reader
+  late until the next `vx lock` refuses it. A task's
+  own outputs, a task with no `cache`, and a group are exempt.
 - **`plugins`** — the run-level extension points. Optional: core
   applies no plugin by default, and the local executor and the local
   cache are its floor — the tail of every executor list, and the first
@@ -1966,8 +2023,8 @@ malformed input.
 
 There are no workspace-level `globalInputs` / task-default fields:
 root-anchored file inputs are declared per task via
-`cache.inputs.workspaceFiles`, root-anchored probes via
-`cache.inputs.workspaceRuntime`, and shared task shapes compose
+`inputs.workspaceFiles`, root-anchored probes via
+`inputs.workspaceRuntime`, and shared task shapes compose
 through plain TypeScript (import a preset and spread it) — the
 language replaces Nx-style `namedInputs` / `targetDefaults` schema
 machinery by design.
@@ -2017,11 +2074,11 @@ export default defineProject({
       // too — the exec env is isolated, not inherited.
       exec: { command: 'tsc -b', env: { passThrough: ['NODE_ENV'] } },
       dependsOn: ['^build'],
+      inputs: {
+        files: ['src/**', '!**/*.test.ts', 'tsconfig.json'],
+        env: ['NODE_ENV'],
+      },
       cache: {
-        inputs: {
-          files: ['src/**', '!**/*.test.ts', 'tsconfig.json'],
-          env: ['NODE_ENV'],
-        },
         outputs: { files: ['dist/**'] },
       },
     },
@@ -2032,8 +2089,8 @@ export default defineProject({
       description: 'run unit tests',
       exec: { command: 'bun test', env: { passThrough: ['CI'] } },
       dependsOn: ['build'],
+      inputs: { files: ['src/**', 'tests/**'] },
       cache: {
-        inputs: { files: ['src/**', 'tests/**'] },
         outputs: { files: [] },
       },
     },
@@ -2044,11 +2101,11 @@ export default defineProject({
       description: 'pack the npm tarball',
       exec: { command: 'rm -rf pkg && npm pack --pack-destination ./pkg' },
       dependsOn: ['build', 'test', '^build'],
+      inputs: {
+        files: ['package.json'],
+        tasks: ['build', '^build'], // hash these upstream too
+      },
       cache: {
-        inputs: {
-          files: ['package.json'],
-          tasks: ['build', '^build'], // hash these upstream too
-        },
         outputs: { files: ['pkg/*.tgz'] },
       },
     },
@@ -2078,12 +2135,14 @@ export default defineProject({
     lint: {
       description: 'oxlint',
       exec: { command: 'oxlint .' },
-      cache: { inputs: { files: ['src/**', '.oxlintrc.json'] }, outputs: { files: [] } },
+      inputs: { files: ['src/**', '.oxlintrc.json'] },
+      cache: { outputs: { files: [] } },
     },
     'format-check': {
       description: 'oxfmt --check',
       exec: { command: 'oxfmt --check .' },
-      cache: { inputs: { files: ['src/**', '.oxfmtrc.json'] }, outputs: { files: [] } },
+      inputs: { files: ['src/**', '.oxfmtrc.json'] },
+      cache: { outputs: { files: [] } },
     },
 
     // Pure group task — `vx run ci` fans out, the group itself is
@@ -2132,12 +2191,12 @@ export default defineProject({
           weakerWhenNested: false,
         },
       },
+      inputs: {
+        files: ['e2e/**'],
+        runtime: ['npx playwright --version'],
+        workspaceRuntime: ['node -v'],
+      },
       cache: {
-        inputs: {
-          files: ['e2e/**'],
-          runtime: ['npx playwright --version'],
-          workspaceRuntime: ['node -v'],
-        },
         outputs: { files: ['test-results/**'] },
       },
     },
@@ -2162,11 +2221,13 @@ export default defineProject({
   tasks: {
     build: {
       exec: { command: 'tsc' },
-      cache: { inputs: { files: srcInputs }, outputs: { files: ['dist/**'] } },
+      inputs: { files: srcInputs },
+      cache: { outputs: { files: ['dist/**'] } },
     },
     test: {
       exec: { command: 'bun test' },
-      cache: { inputs: { files: [...srcInputs, 'tests/**'] }, outputs: { files: [] } },
+      inputs: { files: [...srcInputs, 'tests/**'] },
+      cache: { outputs: { files: [] } },
     },
   },
 })
@@ -2184,8 +2245,8 @@ export function tsBuild(opts?: { tsconfig?: string }): TaskConfig {
   return {
     description: 'compile TypeScript',
     exec: { command: `tsc -b ${opts?.tsconfig ?? ''}`.trim() },
+    inputs: { files: ['src/**', opts?.tsconfig ?? 'tsconfig.json'] },
     cache: {
-      inputs: { files: ['src/**', opts?.tsconfig ?? 'tsconfig.json'] },
       outputs: { files: ['dist/**'] },
     },
   }
@@ -2203,7 +2264,8 @@ export default defineProject({
     test: {
       exec: { command: 'bun test' },
       dependsOn: ['build'],
-      cache: { inputs: { files: ['src/**'] }, outputs: { files: [] } },
+      inputs: { files: ['src/**'] },
+      cache: { outputs: { files: [] } },
     },
   },
 })
@@ -2214,7 +2276,7 @@ to `.ts` source — see
 [`architecture.md` § Config-time imports](./architecture.md#config-time-imports--the-bootstrap-problem)
 for the bootstrap-cycle tradeoff.
 
-### When to use `cache.inputs.tasks: []`
+### When to use `inputs.tasks: []`
 
 When a `dependsOn` exists for ordering only, and the upstream's
 output doesn't influence this task's output. Common case: an
@@ -2225,11 +2287,11 @@ own inputs are just the test source.
 e2e: {
   dependsOn: ['dev'],
   exec: { command: 'playwright test' },
+  inputs: {
+    files: ['e2e/**'],
+    tasks: [],   // dev's hash does not affect e2e's cache identity
+  },
   cache: {
-    inputs: {
-      files: ['e2e/**'],
-      tasks: [],   // dev's hash does not affect e2e's cache identity
-    },
     outputs: { files: ['playwright-report/**'] },
   },
 }
@@ -2304,27 +2366,27 @@ a user meets most:
 | `sandbox is not allowed on an interactive task`                                                                                       | interactive + sandbox combined.                                                                                                                                                                                                |
 | `persistent.readyWhen is not allowed on an interactive task`                                                                          | vx reads none of an interactive task's output.                                                                                                                                                                                 |
 | `a task with no exec must declare dependsOn`                                                                                          | Group task with no edges.                                                                                                                                                                                                      |
-| `a task with no exec writes nothing`                                                                                                  | Group task with `cache.outputs` that names a file.                                                                                                                                                                             |
+| `cache needs exec — a task with no command produces nothing to cache`                                                                 | `cache` on a group: a task with no command writes nothing to cache.                                                                                                                                                            |
 | `dependsOn must be an array of strings`                                                                                               | Wrong shape.                                                                                                                                                                                                                   |
-| `cache.inputs is required when cache is set`                                                                                          | Forgot `inputs`.                                                                                                                                                                                                               |
-| `cache.inputs must be an object`                                                                                                      | Present but not an object: a string (`outputs: 'dist'`). An array is the row above.                                                                                                                                            |
-| `cache.inputs.files must be an array`                                                                                                 | Wrong shape.                                                                                                                                                                                                                   |
-| `cache.inputs.runtime must be an array of non-empty shell command strings with no NUL`                                                | Non-string / blank entry (whitespace alone runs as a no-op), or one holding a NUL.                                                                                                                                             |
-| `cache.inputs.workspaceRuntime must be an array of non-empty shell command strings with no NUL`                                       | Non-string / blank entry (whitespace alone runs as a no-op), or one holding a NUL.                                                                                                                                             |
-| `cache.inputs.tasks must be an array of non-empty strings`                                                                            | Non-string / empty entry, or a bare string.                                                                                                                                                                                    |
-| `cache.inputs.tasks: "<name>" names no task in <task>.dependsOn`                                                                      | An exact entry no `dependsOn` entry of its form names.                                                                                                                                                                         |
+| `cache needs inputs — the key is the task's inputs`                                                                                   | Forgot `inputs` on a cached task.                                                                                                                                                                                              |
+| `inputs must be an object`                                                                                                            | Present but not an object: a string (`outputs: 'dist'`). An array is the row above.                                                                                                                                            |
+| `inputs.files must be an array`                                                                                                       | Wrong shape.                                                                                                                                                                                                                   |
+| `inputs.runtime must be an array of non-empty shell command strings with no NUL`                                                      | Non-string / blank entry (whitespace alone runs as a no-op), or one holding a NUL.                                                                                                                                             |
+| `inputs.workspaceRuntime must be an array of non-empty shell command strings with no NUL`                                             | Non-string / blank entry (whitespace alone runs as a no-op), or one holding a NUL.                                                                                                                                             |
+| `inputs.tasks must be an array of non-empty strings`                                                                                  | Non-string / empty entry, or a bare string.                                                                                                                                                                                    |
+| `inputs.tasks: "<name>" names no task in <task>.dependsOn`                                                                            | An exact entry no `dependsOn` entry of its form names.                                                                                                                                                                         |
 | `cache.outputs is required when cache is set`                                                                                         | Forgot `outputs`.                                                                                                                                                                                                              |
 | `cache.inputStability must be an object`                                                                                              | A bare string (`inputStability: 'mutable'`).                                                                                                                                                                                   |
 | `cache.inputStability.strategy must be 'immutable', 'mutable' or 'unchecked'`                                                         | Any other value (`'content'`, `false`).                                                                                                                                                                                        |
 | `cache.inputStability.severity must be 'warn' or 'error'`                                                                             | Any other value (`'fail'`, `true`).                                                                                                                                                                                            |
 | `cache.outputs must be an object`                                                                                                     | Present but not an object: a string (`outputs: 'dist'`). An array is the row above.                                                                                                                                            |
 | `cache.outputs.files must be an array`                                                                                                | Wrong shape.                                                                                                                                                                                                                   |
-| `cache.inputs.files: every entry is a negation, which selects NOTHING`                                                                | Only `!` globs — nothing to subtract from.                                                                                                                                                                                     |
-| `cache.inputs.files: "<file>" is taken back by "!<glob>"`                                                                             | A literal input a `!` entry covers: the negation subtracts wherever it sits, so the file never entered the key.                                                                                                                |
+| `inputs.files: every entry is a negation, which selects NOTHING`                                                                      | Only `!` globs — nothing to subtract from.                                                                                                                                                                                     |
+| `inputs.files: "<file>" is taken back by "!<glob>"`                                                                                   | A literal input a `!` entry covers: the negation subtracts wherever it sits, so the file never entered the key.                                                                                                                |
 | `cache.outputs.files: every entry is a negation, which selects NOTHING`                                                               | Only `!` globs: a `!` entry only takes back what a positive glob selected (A-44).                                                                                                                                              |
 | `cache.outputs.files: "<glob>" covers the project's own <file>`                                                                       | An output glob that matches the project's own `vx.config.*` (`**`, `*.ts`): the clean before a run would delete it. A `!` entry that takes the file back (`!vx.config.ts`) lets it load.                                       |
 | `cache.outputs.files: "<glob>" is under workspace-outputs/`                                                                           | A project output named into the artifact's namespace for `outputs.workspaceFiles`: every hit read it back as a workspace output.                                                                                               |
-| `cache.inputs.files: '!!' is not a double negation`                                                                                   | `!!x` inverts the set — it folds only `x`.                                                                                                                                                                                     |
+| `inputs.files: '!!' is not a double negation`                                                                                         | `!!x` inverts the set — it folds only `x`.                                                                                                                                                                                     |
 | `exec.timeout of <value> exceeds the maximum timer delay`                                                                             | Past 2^31-1 ms a timer fires at once, not never.                                                                                                                                                                               |
 | `description must be a string`                                                                                                        | Non-string description.                                                                                                                                                                                                        |
 | `tag "<tag>" <why> — --filter tag:<name> could not name it`                                                                           | A tag with surrounding whitespace or a `*`, or one ending in `...` or `[<ref>]`, which a filter reads as a pattern, a dependency walk or a git range.                                                                          |
@@ -2332,7 +2394,7 @@ a user meets most:
 **Unknown fields are rejected**, not ignored, at every object level —
 the project's top level (`tasks`), the task itself, `exec`, `exec.env`,
 `exec.persistent`, `exec.sandbox` and its `allow` /
-`deny` / `ignore` blocks, `cache`, `cache.inputs`, and `cache.outputs`
+`deny` / `ignore` blocks, `cache`, `inputs`, and `cache.outputs`
 (`tests/schema-unknown-keys.test.ts` walks every one) — and at the top
 of `.vx/workspace.ts`,
 where `plugin:` (singular) would otherwise declare no plugins and run