kyleandClaude Opus 5.5
b426ca1958
A draft spec for the owner's review and 13 offline tasks with their given tests: shared tool arguments and host rules in proto, the sealed fetch target (M3a finding 14), the toolkit tools and SOCKS5 egress proxy, and brokerd's [runner], podman argument lists, runtime and proxy lifecycle. Each task's tests were run against a reference at that task's end state (560 to 638 tests, clippy clean); the reference is not in the repository. Adds the runner-unavailable runbook entry and tip T23 (ETXTBSY in script tests). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
57 lines
2.2 KiB
Markdown
57 lines
2.2 KiB
Markdown
# M3b task 13: `brokerd serve` uses the runtime
|
|
|
|
**Branch:** `m3b` (run `git switch m3b`; `git status --short` must be empty, otherwise stop)
|
|
**Commit subject:** `brokerd serve: run tools in containers when [runner] is set`
|
|
|
|
## Goal
|
|
|
|
With a `[runner]` section, `brokerd serve` runs allowed calls through `Podman`; without it, it keeps
|
|
M3a's `Refusing` runtime. It prints one line saying which, so the owner can see it at a glance.
|
|
|
|
## Files
|
|
|
|
- Copy: `crates/brokerd/tests/serve_runner.rs`
|
|
- Modify: `crates/brokerd/src/main.rs`, `docs/implementer-log.md`
|
|
|
|
## The change
|
|
|
|
In `main.rs`, after the config is loaded and before `serve::start`:
|
|
|
|
```rust
|
|
let log: Arc<dyn Fn(&str) + Send + Sync> = Arc::new(|line: &str| eprintln!("{line}"));
|
|
```
|
|
|
|
and choose the runtime and its notice:
|
|
|
|
- `cfg.runner` is `Some(runner)` → `Box::new(Podman::new(runner, cfg.egress_dir(), Arc::clone(&log)))`,
|
|
notice `brokerd: tools run in containers from {runner.image}` (take the image before `runner`
|
|
moves).
|
|
- `None` → `Box::new(Refusing)`, notice `brokerd: no [runner] section: every tool call is refused`.
|
|
|
|
Pass the runtime and `log` to `serve::start` (instead of `Box::new(Refusing)` and the closure made
|
|
there today). Print the notice with `eprintln!` right after the existing
|
|
`brokerd: serving tools on … and approvals on …` line. Nothing else changes.
|
|
|
|
## Steps
|
|
|
|
- [ ] **1. Copy.** `git switch m3b`, then
|
|
`cp docs/plans/M3b/files/crates/brokerd/tests/serve_runner.rs crates/brokerd/tests/`
|
|
- [ ] **2. See it fail.** `cargo test -p brokerd --test serve_runner`. Expected: 2 fail (the
|
|
notices are missing, and the call is refused).
|
|
- [ ] **3. Make the change.** Run `cargo fmt --all`.
|
|
- [ ] **4. See it pass.** `cargo test -p brokerd --test serve_runner --test serve`. Expected: 2
|
|
and 9 passed.
|
|
- [ ] **5. Run the gate.** `make gate`. Expected last line: `gate: ok`, with about 638 tests in
|
|
all.
|
|
- [ ] **6. Log and commit.** `git add crates/brokerd docs/implementer-log.md && git commit`
|
|
|
|
This is the last task of M3b. Stop after the commit; the review comes next.
|
|
|
|
## Done when
|
|
|
|
- `cargo test -p brokerd` passes; `make gate` prints `gate: ok`.
|
|
|
|
## Stop and report if
|
|
|
|
- `serve::start`'s signature would have to change.
|