Source-bound remote runs and recovery.

What is submitted#

Probierz packages its toolkit and the application source, records the exact Git revision and worktree hash, and submits one job to the selected Stado host. `--app-repo` selects the primary checkout that is actually measured and packed.

The worker receives `PROBIERZ_APP_SOURCE`, `PROBIERZ_TOOLKIT_ROOT` and `PROBIERZ_SOURCE_IDENTITY`. Its manifest records the submitter's identity rather than trying to read the submitter's absolute checkout paths on another machine.

Cargo source, a prebuilt native application bundle with its source, and Node source are supported provisioning modes. Cargo provisioning builds all product binaries; `--binary` selects the entry point without dropping required sibling helpers such as Jeden's macOS sandbox helper. A queued job is accepted work, not a successful journey.

Every Stado `desktop:cua` bundle run also builds the CLI from the submitted source, exports `PROBIERZ_STADO_BIN`, and puts that candidate first on `PATH`. The graphical interface uses the matching CLI for every selected journey, not an older installed command.

Run the real Jeden lifecycle#

The `task-contract-lifecycle` journey uses the real Jeden CLI and RPC, changes isolated settings, and asks a real Brama-backed model to create, edit and delete a file. It inspects the final file and session records, including all seven task-report entries.

The example assumes sibling product checkouts. Both Jeden manifests use `https://brama.wisent.com`, the `probierz` model identity and the configured `local-openai/chat-primary` deployment; they do not require a local forwarding process or a new paid provider. Secret values are materialized from the application manifest's references and do not belong in command arguments.

probierz stado run tui --app jeden   --spec jeden-task-contract-lifecycle --host stado:mini   --cargo-release --app-repo ../jeden --binary jeden   --env PROBIERZ_JOURNEY=task-contract-lifecycle --no-watch

Native GUI evidence#

The registered `jeden-desktop` journey opens the real Settings screen, reads the seven requirements through Jeden RPC, and inspects a real recorded task report in the conversation without a duplicate final answer.

Native GUI readiness is a separate Stado audit with a 30-minute deadline. A timeout means readiness is unknown and no GUI job was submitted. This audit does not grant operating-system permissions or open consent prompts.

probierz stado run desktop:cua --app jeden-desktop   --spec jeden-desktop-task-contract --host stado:mini   --app-bundle-path ../jeden-desktop/.build/Jeden.app   --app-repo ../jeden-desktop --no-watch

Conditions and credentials#

Repeated `--env NAME=VALUE` and `--env=NAME=VALUE` are equivalent for non-secret remote conditions, including values containing `=`. Conditions use the same selected journey contract on the submitter and the worker.

`PROBIERZ_JOURNEY=<journey>` selects one declared journey. A declared `journeyOverrides.when.PROBIERZ_JOURNEY` group selector, such as Stado's `cli-release-qualification`, selects its complete group when every condition matches. Submission, worker execution, source identity, evidence attribution and the remote wait budget use that same selection.

Unknown selectors and unmatched named groups are configuration refusals before source upload or job submission: `PROBIERZ_JOURNEY <value> is not declared for this surface`. An unrelated override cannot accept an unknown selector, and a selected spec cannot mark unselected journeys as passed.

Remote jobs preserve CARGO_HOME and RUSTUP_HOME, defaulting to $HOME/.cargo and $HOME/.rustup, and put $CARGO_HOME/bin on PATH. Product journeys can isolate their application HOME without losing the compiler or dependency cache. On macOS, $HOME/.stado/bin also precedes system and Homebrew locations. Single-file native provisioning does not supply separate runtime helpers; use Cargo source provisioning for Jeden on macOS.

Generic selectors such as stado:local and stado:any detect the worker's actual operating system and architecture before provisioning Node. They support Linux and macOS on x64 or arm64, use an installed Node when present, and refuse unsupported combinations instead of fetching an incompatible binary.

A dedicated host selector changes placement only. Every upload, submission, status read and evidence download uses Stado's configured endpoint; stado:macbook no longer substitutes a fixed loopback port.

Remote spec authoring reads STADO_MODEL_ROUTER_URL and PROBIERZ_MODEL from the selected surface's conditions, then from the submitting process. Jeden pins local-openai/chat-primary for its model-scoped bearer rather than requesting the broader any selector. The bearer must permit that exact model; a grant for codex/gpt-5.6-sol alone does not authorize it.

Credentials use the application's `secretRefs`. Brama must recognize the configured bearer, request-signing identity and model permissions; merely finding a nonempty token does not prove that a model ran.

Recover instead of submitting again#

Submission requests and responses remain under `test-results/.remote/`. Before waiting, stderr prints the saved request and accepted job ID, so an interrupted client does not lose the identity of its existing job.

`stado collect` returns the current state immediately and imports evidence only when the job is terminal. `stado resume` waits for that same job using its original run budget. Both preserve the original run ID, source identity, reports and supported media.

probierz stado collect <job-id> --app jeden --host stado:mini
probierz stado resume <job-id> --host stado:mini

Interpret the recorded result#

A queued or running result is not passed. A failed journey keeps its failed verdict after collection, even when downloading its evidence succeeds. Missing or wrong-application evidence is refused.

The watch allowance comes from the selected journeys and provisioning steps. Reports, traces and screenshots describe the path actually exercised; an HTTP 401 is an authentication failure, not model or GUI evidence.

Input uploads retry Stado's retryable exit 69 at most six times, waiting 5, 10, 15, 20 and 25 seconds between attempts. Each attempt uses the same destination and content-addressed chunks. Other exits fail immediately, and this upload handling never submits an accepted job again.

A failed Stado command emits a probierz-process-failure record with its command, arguments, exit code, captured stdout and stderr, and spawn error before the bounded probierz-failure summary. Read that full process record when a long object URL leaves the summary without the actual cause.

MCP exposes the same separate operations as `probierz_stado_run`, `probierz_stado_collect` and `probierz_stado_resume`.