OutcomeCI

Use OutcomeCI Cloud

A workflow you have tested with oci workflow run is ready to go online. OutcomeCI Cloud runs the same file when nobody is at a terminal: an email arrives, a webhook fires, or a schedule comes due.

What changes

OutcomeCI Cloud adds:

  • shared workflow versions and run history that survive any machine or agent session;
  • email, webhook, and cron triggers;
  • managed runners that execute with the Codex, Claude Code, or OpenCode account you connect;
  • a workspace Vault that grants credentials to specific workflows; and
  • run logs that show every step, every refused call, and why a run failed.

The workflow remains outcome.yml, and a cloud run uses the same runner image as a container run on your machine. Going online changes where the run executes and where secrets and the agent login come from, not the workflow.

Take a workflow online

Cloud runs start from email, webhooks, or a schedule. Set the workflow's trigger to one of them, and check that its steps read what that trigger carries: a manual payload such as trigger.repo does not exist in a cron run.

Sign in, then sync the workflow into a workspace:

oci auth login
oci workflow sync outcome.yml --workspace-id WORKSPACE_ID --create

Sync compiles the workflow locally before uploading it, along with the files under .outcomeci/. It never uploads the local Vault, broker journals, or run outcomes. To publish a changed definition later, run the same command with --version instead of --create. Each run stays pinned to the version it was triggered with.

Before the first cloud run:

  1. Open Vault in the dashboard and connect an agent under Agents. A managed runner uses that connection for the agent the workflow names. You never supply a runner key; OutcomeCI issues each runner a single-use credential when it launches.
  2. Store each secret the workflow references in the workspace Vault, under the same path you used in the local Vault, and grant it to the workflow. See Vault.
  3. Open the workflow's Settings and enable its trigger: Enable email under Email, or Enable webhook under Webhooks. Cron triggers need no setting; they are scheduled when the version is synced.

Provider and service credentials stay in the Vault; they do not belong in outcome.yml.

Schedule a workflow

A cron trigger starts a run on a schedule:

trigger: {type: cron, expression: "0 9 * * 1-5", timezone: America/Chicago}

expression is a five-field cron expression and timezone is an IANA time zone. A schedule cannot fire more than once every five minutes, and it must leave either day-of-month or day-of-week as *. Syncing a new version updates the schedule.

Where a run executes

Email, webhook, and cron runs are queued first, then OutcomeCI launches a managed runner for each one. A run that is waiting to start shows as queued in the run list.

A connected agent account works on one run at a time. A run that fails for a retryable reason, such as its agent connection being busy with another run, is queued again, up to five times, before it fails.

Follow a run

The workspace dashboard lists each workflow's runs with their trigger, duration, events, and status. Open a run to read its log.

  • Failures. A failed run's log includes the failure category and a scrubbed error message from the runner.
  • Refused calls. A run whose calls were refused shows an N refused badge. Its log lists each one with the step, the capability, and the reason: outside the step's grants, denied by the policy reviewer, sent back for revision, or not reviewable.

Cancel a run

A queued or running run shows Cancel run in the run list. A cancelled run stops immediately and is never resumed. Its agent connections are freed for the next run and its Vault leases are revoked. Changes it already made, such as a pushed branch or a posted message, stay.

The same action is available as POST /workspaces/WORKSPACE_ID/workflow-runs/RUN_ID/cancel.

Test changes on your machine

Change the workflow locally, run it with oci workflow run, and sync a new version with --version once it does what you want. Runs already in progress stay pinned to the version they started on.

To try a change against the workspace's real credentials before you sync it, add --cloud:

oci workflow run --cloud --workspace-id WORKSPACE_ID --workflow-id WORKFLOW_ID \
  --payload .outcomeci/request.json

See Run in the container.

Reference

Use the oci command reference when you need individual command behavior rather than the guided path.