26 lines
1.4 KiB
Markdown
26 lines
1.4 KiB
Markdown
## Why
|
|
|
|
A legacy server can use one endpoint ID for both the trusted local Run builder and its generated Windows Run. When the generated Run starts on the target host it authenticates with the server component key as the builder endpoint, displacing the local builder. Later Windows distribution builds are consequently executed without the approved local source snapshot and fail at source preparation.
|
|
|
|
## What Changes
|
|
|
|
- Separate a legacy server's build-target endpoint from the endpoint identity embedded in a newly generated Run before queuing the build.
|
|
- Reject component-authenticated Run registration against a shared build endpoint.
|
|
- Make a generated server Run omit build-only capabilities, including `distribution.build`.
|
|
- Preserve a clear, safe source-preparation failure reason for operational diagnosis.
|
|
|
|
## Capabilities
|
|
|
|
### New Capabilities
|
|
|
|
- `run-build-worker-roles`: Separates trusted Run build workers from server-scoped generated Run workers and protects the endpoint identities used by each.
|
|
|
|
### Modified Capabilities
|
|
|
|
- `run-distribution-and-client-managers`: Run distribution generation assigns the generated package a server-scoped endpoint identity rather than reusing a legacy builder identity.
|
|
|
|
## Impact
|
|
|
|
- Affected roots: `platform/`, the independent `run/` checkout, and OpenSpec contracts.
|
|
- Existing failed legacy instances migrate on their next Run generation; no browser, plugin, or remote-host path/credential exposure is introduced.
|