# M3b task 13: `brokerd serve` uses the runtime

**Branch:** `m3b` (run `git switch m3b`; `git status --short` must be empty, otherwise stop)
**Commit subject:** `brokerd serve: run tools in containers when [runner] is set`

## Goal

With a `[runner]` section, `brokerd serve` runs allowed calls through `Podman`; without it, it keeps
M3a's `Refusing` runtime. It prints one line saying which, so the owner can see it at a glance.

## Files

- Copy: `crates/brokerd/tests/serve_runner.rs`
- Modify: `crates/brokerd/src/main.rs`, `docs/implementer-log.md`

## The change

In `main.rs`, after the config is loaded and before `serve::start`:

```rust
let log: Arc<dyn Fn(&str) + Send + Sync> = Arc::new(|line: &str| eprintln!("{line}"));
```

and choose the runtime and its notice:

- `cfg.runner` is `Some(runner)` → `Box::new(Podman::new(runner, cfg.egress_dir(), Arc::clone(&log)))`,
  notice `brokerd: tools run in containers from {runner.image}` (take the image before `runner`
  moves).
- `None` → `Box::new(Refusing)`, notice `brokerd: no [runner] section: every tool call is refused`.

Pass the runtime and `log` to `serve::start` (instead of `Box::new(Refusing)` and the closure made
there today). Print the notice with `eprintln!` right after the existing
`brokerd: serving tools on … and approvals on …` line. Nothing else changes.

## Steps

- [ ] **1. Copy.** `git switch m3b`, then
  `cp docs/plans/M3b/files/crates/brokerd/tests/serve_runner.rs crates/brokerd/tests/`
- [ ] **2. See it fail.** `cargo test -p brokerd --test serve_runner`. Expected: 2 fail (the
  notices are missing, and the call is refused).
- [ ] **3. Make the change.** Run `cargo fmt --all`.
- [ ] **4. See it pass.** `cargo test -p brokerd --test serve_runner --test serve`. Expected: 2
  and 9 passed.
- [ ] **5. Run the gate.** `make gate`. Expected last line: `gate: ok`, with about 638 tests in
  all.
- [ ] **6. Log and commit.** `git add crates/brokerd docs/implementer-log.md Cargo.lock && git commit`

This is the last task of M3b. Stop after the commit; the review comes next.

## Done when

- `cargo test -p brokerd` passes; `make gate` prints `gate: ok`.

## Stop and report if

- `serve::start`'s signature would have to change.