Files

T

kyleandClaude Opus 5.5 b426ca1958 Specify and plan M3b: the runner and the tools

A draft spec for the owner's review and 13 offline tasks with their given
tests: shared tool arguments and host rules in proto, the sealed fetch
target (M3a finding 14), the toolkit tools and SOCKS5 egress proxy, and
brokerd's [runner], podman argument lists, runtime and proxy lifecycle. Each
task's tests were run against a reference at that task's end state (560 to
638 tests, clippy clean); the reference is not in the repository. Adds the
runner-unavailable runbook entry and tip T23 (ETXTBSY in script tests).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-09-22 22:29:27 -07:00

2.2 KiB

Raw Blame History

M3b task 13: `brokerd serve` uses the runtime

Branch: m3b (run git switch m3b; git status --short must be empty, otherwise stop) Commit subject: brokerd serve: run tools in containers when [runner] is set

Goal

With a [runner] section, brokerd serve runs allowed calls through Podman; without it, it keeps M3a's Refusing runtime. It prints one line saying which, so the owner can see it at a glance.

Files

Copy: crates/brokerd/tests/serve_runner.rs
Modify: crates/brokerd/src/main.rs, docs/implementer-log.md

The change

In main.rs, after the config is loaded and before serve::start:

let log: Arc<dyn Fn(&str) + Send + Sync> = Arc::new(|line: &str| eprintln!("{line}"));

and choose the runtime and its notice:

cfg.runner is Some(runner) → Box::new(Podman::new(runner, cfg.egress_dir(), Arc::clone(&log))), notice brokerd: tools run in containers from {runner.image} (take the image before runner moves).
None → Box::new(Refusing), notice brokerd: no [runner] section: every tool call is refused.

Pass the runtime and log to serve::start (instead of Box::new(Refusing) and the closure made there today). Print the notice with eprintln! right after the existing brokerd: serving tools on … and approvals on … line. Nothing else changes.

Steps

1. Copy. git switch m3b, then cp docs/plans/M3b/files/crates/brokerd/tests/serve_runner.rs crates/brokerd/tests/
2. See it fail. cargo test -p brokerd --test serve_runner. Expected: 2 fail (the notices are missing, and the call is refused).
3. Make the change. Run cargo fmt --all.
4. See it pass. cargo test -p brokerd --test serve_runner --test serve. Expected: 2 and 9 passed.
5. Run the gate. make gate. Expected last line: gate: ok, with about 638 tests in all.
6. Log and commit. git add crates/brokerd docs/implementer-log.md && git commit

This is the last task of M3b. Stop after the commit; the review comes next.

Done when

cargo test -p brokerd passes; make gate prints gate: ok.

Stop and report if

serve::start's signature would have to change.

2.2 KiB Raw Blame History

M3b task 13: brokerd serve uses the runtime