Native caller variable context

loom.variable-context.v1 supplies ordinary caller-owned scalar values to native workflows. It is separate from the GitLab pipeline context.

{
  "version": "loom.variable-context.v1",
  "variables": { "BASE": "caller", "EMPTY": "", "caller_only": "value" }
}

Both fields are required. variables must be a non-null object of strings; empty objects and empty strings are valid. Unknown or duplicate fields, unsupported versions and non-string values fail before execution. The JSON file is limited to 1 MiB. Caller keys are trimmed in sorted raw-key order before merging; empty normalized keys are ignored. Caller-only lowercase keys are valid. Names containing = or NUL are rejected so process environment serialization preserves each key. A normalized key cannot collide with a declared native secret.

Pass a project-relative JSON path to loom check, loom compile or loom run with --context path.json. With --format loom, every request is a literal project-relative path, including an extensionless basename. With format omitted, a bare name without .json keeps GitLab short-name lookup; write ./name or use --format loom for a native extensionless path. GitLab short context names and config defaults.context remain GitLab-only. Explicit format and source content choose the decoder. For ambiguous include-only sources, the context version supplies a format hint; an included native version is still native.

MCP loom_validate, loom_compile, loom_run_local and loom_start_run accept this object as variable_context with source_format: "loom" (the default). Omitted or null means no context. gitlab_context requires GitLab format, and supplying both contexts is invalid.

Caller values override composed YAML root/default/parent/job values, including with an empty string. Each caller string replaces an entire rich YAML definition, including its expansion mode; caller values use normal native scalar expansion. Options validate authored defaults and do not restrict explicit caller values. Scalar dependencies resolve after those winners are known. Predefined registry values fill missing keys. An exported CI_PROJECT_DIR, CI_BUILDS_DIR or LOOM_PROJECT_DIR override does not move the physical command working directory or alter provider mounts and cleanup. Contexts are explicit data; dependency lookup never reads ambient process environment.

Native compile selection uses these same explicit winners and resolved scalar bindings. Workflow selection sees only root plus caller values; job selection sees composed job plus caller values. Missing ordinary names are null and an explicit empty remains present. Evaluated unavailable runtime bindings fail with WF_SELECTION_PHASE; provider defaults are not early compile facts. Short-circuited operands are not read, but their syntax must still be valid.