browser/openspec/changes/separate-server-run-binding/specs/server-scoped-run-binding/spec.md

ADDED Requirements

Requirement: A dedicated Run endpoint is exclusively bound to one server

The platform SHALL reserve one dedicated Run endpoint identity for each newly created server and SHALL reject attempts to bind that identity to another server. The deployment target SHALL be stored separately from the dedicated endpoint.

Scenario: A target is selected for a new server

• WHEN an operator creates a server with a compatible deployment target
• THEN the platform saves the target and a reserved dedicated Run identity on a draft without dispatching an install job

Scenario: A dedicated endpoint is reused

• WHEN a caller attempts to register or bind a dedicated endpoint reserved for another server
• THEN the platform rejects the request without changing either server binding or control session

Requirement: Component hello is constrained to its server binding

The platform SHALL accept a component-authenticated Run hello only when the server ID, component kind, current key generation, and reserved endpoint ID all match the server binding.

Scenario: A generated Run registers correctly

• WHEN a generated Run presents the current key and its reserved endpoint identity
• THEN the platform records the endpoint online and allows server-scoped work to be dispatched

Scenario: A generated Run claims another endpoint

• WHEN a generated Run presents a valid key but an endpoint identity that is not reserved for its server
• THEN the platform rejects the hello and does not replace any endpoint session

Requirement: Revocation affects only the bound dedicated Run

The platform SHALL revoke a Run control session only when the endpoint is exclusively bound to the server whose Run key is reset.

Scenario: Reset a dedicated Run key

• WHEN an operator resets a server Run key
• THEN the platform revokes that server's dedicated Run session and leaves unrelated server endpoints unchanged