Report a running job's environment record

POST/api/jobs/{job_id}/env-record

reportJobEnvRecord

Runner-protocol route (same lease-bearer auth as the step snapshot POST). The guest's closure, identity and flake inputs for its environment (ADR 0188 §4). The server computes the key and the system itself; a body field naming either is ignored. Written only for a `cache_commit_allowed` run, decided in the write transaction. Every accepted report answers 200 with what happened to it; a body over the caps is 400.

Requires authentication using a bearer token — see tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/jobs/JOB_ID/env-record' \
  -H 'Authorization: Bearer $NEOSOURCE_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"identity":"string","closure":[]}'

fetch

fetch("https://neosource.dev/api/jobs/JOB_ID/env-record", {
  method: "POST",
  headers: {
    Authorization: "Bearer $NEOSOURCE_TOKEN",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"identity":"string","closure":[]}),
});

Path parameters

job_idrequired: string

Request bodyrequired

application/json

ReportEnvRecordRequest

object

`POST /api/jobs/{job_id}/env-record`: a trusted job's environment, as its guest collected it after preflight (ADR 0188 §4). Carries no key and no system: the server computes both, and an extra `key` / `env_key` / `system` field is ignored (no `deny_unknown_fields`).

closurerequired

array

The environment's full closure, each path with its tier; at most 4096.

items

CiEnvPath

object

One closure path as the guest reports it (wire shape). `path` is checked as a [`NixStorePath`] by [`CiEnvReport::from_wire`].

nar_sizerequired: integerint64
pathrequired: string
tierrequired: CiEnvTier

flake_files_digest

string | null

Hex sha256 of the checkout's `flake.nix` and `flake.lock` (a flake job's consistency guard): a report whose files are not the trigger commit's is refused as `files_differ`. Absent for bare packages.

identityrequired

string

The shell's drvPath, or `outs:<hex>` for bare packages; at most 512 characters.

inputs

array

Flake inputs other than the flake itself; at most 64.

items

CiEnvInput

object

One flake input (not the flake itself) as the guest reports it. Recorded, not delivered, in slice 3 (ADR 0188 A9).

nar_hash: string | null
pathrequired: string

Responses

200What the server did with the report

application/json

ReportEnvRecordResponse

object

The answer to `POST /api/jobs/{job_id}/env-record`.

outcomerequired: CiEnvRecordOutcome
string
What the server did with one environment report (§1, §4).
"written""replaced""confirmed""stale""already_reported""not_allowed""not_live""no_key""files_differ""disabled"

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
401Authentication required
403Forbidden — one of: forbidden
404Not Found — one of: not_found
409Conflict — one of: conflict
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget

Schemas

Referenced above. Listed here rather than expanded inline, so the same definition is not repeated at every level.

`CiEnvTier`

string

Which delivery tier a recorded path belongs to (ADR 0188 §3). The guest classifies; the host re-verifies tier (a) by `require-sigs`, so a misclassification costs availability, never correctness.

"signed""fixed_output""local"