browser/openspec/changes/archive/2026-07-30-platform-side-docker-distribution-builds/tasks.md

1. Server creation form

• 1.1 Remove the deployment target selector from the create branch of platform_web/components/ServerDeploymentWorkflow.tsx, keeping the run endpoint selector on the non-create branch unchanged.
• 1.2 Simplify the create-branch step gating so it no longer depends on deploymentTargetId or on saveAsDraft for target selection.
• 1.3 Keep deploymentTargetId accepted in platform_web/schemas/serverManagement.ts and the create DTO for post-creation and programmatic flows.
• 1.4 Update or add frontend tests proving creation submits with plugin type and server name only.

2. Platform Docker builder

• 2.1 Add a platform-owned builder that executes a distribution build in a container from a pinned image, with run source mounted read-only and a per-job output directory mounted writable.
• 2.2 Add a builder readiness probe and expose its unavailable reason as a platform-builder reason, not a run endpoint capability reason.
• 2.3 Route distribution.build job execution to the platform builder so the job is claimed and completed internally instead of over the job channel.
• 2.4 Preserve job idempotency, ArtifactOwnerKindJob artifact ownership, progress projection, and the existing validateDistributionBuildResult artifact-scope assertions.
• 2.5 Keep build workspaces isolated per plugin and per job as required by run-build-download-flow.

3. Build availability derivation

• 3.1 Remove the endpointSupports(..., JobCapabilityDistributionBuild) term from generate-run and generate-client-manager availability in platform/service/distributions.go.
• 3.2 Derive availability from plugin declaration, complete runtime bindings, and builder readiness, keeping existing binding reasons intact.
• 3.3 Stop resolving a machine-side builder endpoint for build dispatch in GenerateRunDistribution and the client-manager build path.

4. Secret handling

• 4.1 Resolve component auth keys inside the platform for builder-executed builds and pass them to the container through the per-job input rather than a job-channel response.
• 4.2 Keep the distribution.build capability-stripping guard in platform/service/job_channel.go as defense in depth.
• 4.3 Add a test proving builder-executed builds do not return a plaintext auth key to a machine-side endpoint.

5. Tests and verification

• 5.1 Add a platform test proving an instance whose only endpoint is its own generated run can generate a new run distribution.
• 5.2 Add a platform test proving run generation succeeds with no endpoint advertising distribution.build registered or online.
• 5.3 Keep TestCoreServiceComponentRunCannotClaimDistributionBuild passing.
• 5.4 Add a builder-unavailable test proving the reason names the platform builder.
• 5.5 Run scripts/check-structure.sh, platform tests, frontend tests, and openspec validate platform-side-docker-distribution-builds --strict.
• 5.6 Prove the flow end to end in local debug: create a server with plugin type and name only, generate a run, download and execute it, confirm registration and heartbeat.

6. Documentation

• 6.1 Add server creation field rules and platform-side build ownership rules to AGENTS.md.
• 6.2 Document builder configuration values operators must provide or may tune.