browser/openspec/changes/fix-run-build-worker-role/specs/run-build-worker-roles/spec.md

ADDED Requirements

Requirement: Generated Run identity is distinct from its build target

When Platform generates a Run package for a failed or draft legacy server without deploymentTargetId, it SHALL reserve server-run-<server-instance-id> as the package endpoint identity and persist the previous endpoint as the deployment target before the distribution build job is queued.

Scenario: Failed legacy server generates a new Windows Run

• GIVEN a failed legacy server has runEndpointId=run-local-debug and no deployment target
• WHEN an authorized owner generates a Windows amd64 Run package
• THEN the build job targets run-local-debug, the server persists deploymentTargetId=run-local-debug, and the generated package is assigned runEndpointId=server-run-<server-id>

Requirement: Shared builders reject component Run identity

Platform SHALL reject a component-authenticated Run hello unless its endpoint identity equals the server's dedicated Run endpoint identity.

Scenario: Old package tries to claim the builder ID

• GIVEN an instance has a dedicated Run endpoint and a separate deployment target
• WHEN a Run component uses the instance key to register as the deployment target endpoint
• THEN Platform rejects the hello and leaves the build endpoint registration unchanged

Requirement: Generated Run does not advertise build-only capabilities

A Run configured as a server component SHALL NOT advertise distribution.build or run.self-update.

Scenario: Generated Run registers on the target host

• WHEN a package with component kind run creates its capability report
• THEN lifecycle capabilities remain available and build-only capabilities are absent