32 lines
3.2 KiB
Markdown
32 lines
3.2 KiB
Markdown
## Why
|
|
|
|
Creating a server instance currently forces the owner to pick a deployment target before any run executor exists. The target dropdown lists already-registered run endpoints, but the intended flow is create server → platform builds run → operator executes run on the machine → run registers back. At creation time there is nothing correct to select, so the field can only be filled with an unrelated endpoint or bypassed with the draft checkbox.
|
|
|
|
Distribution building is also routed through machine-side run endpoints, while a generated run is intentionally stripped of `distribution.build` authority. Both restrictions are individually sound, but together they mean an instance bound to its own generated run can never build again: `generate-run` reports `run endpoint cannot build distributions`. Building only works when a separately maintained privileged worker endpoint happens to be registered and online, which makes the platform's core build path depend on hand-maintained machine state.
|
|
|
|
The current build dispatch additionally hands the plaintext component `authKey` to whichever endpoint claims the build job, so a privileged worker accumulates credentials for every server it has ever built. Moving builds into a platform-owned Docker builder removes that credential egress path instead of widening it.
|
|
|
|
## What Changes
|
|
|
|
- Remove deployment target selection from the server creation form. Creation requires only game plugin type and server name; the run endpoint binding is established when the generated run registers itself.
|
|
- Keep deployment target and runtime profile selection available as optional actions on an already-created instance, never as creation prerequisites.
|
|
- Move `distribution.build` execution into a platform-owned Docker builder. The platform builds run and client-manager packages itself and no longer dispatches build jobs to machine-side run endpoints.
|
|
- Keep the generated-run build restriction intact as a security boundary; `generate-run` availability must no longer depend on any run endpoint advertising `distribution.build`.
|
|
- Stop exposing plaintext component auth keys over the job channel for builds executed by the platform builder.
|
|
- Add tests proving an instance bound only to its own generated run can still generate a new run distribution.
|
|
|
|
## Capabilities
|
|
|
|
### New Capabilities
|
|
- `platform-side-distribution-builds`: Covers platform-owned Docker build execution, creation-time field requirements, and run-endpoint-independent build availability.
|
|
|
|
### Modified Capabilities
|
|
- `run-distribution-and-client-managers`: Build execution moves from machine-side run endpoints to the platform Docker builder; generated-run build restriction is preserved.
|
|
- `run-build-download-flow`: Build source snapshotting and artifact download must work without a privileged worker endpoint.
|
|
|
|
## Impact
|
|
|
|
- Affected roots: `platform/`, `platform_web/`, `scripts/`.
|
|
- Affected behavior: server creation validation, `generate-run` and `generate-client-manager` availability, job channel build dispatch, build input secret exposure.
|
|
- Verification requires `scripts/check-structure.sh`, platform tests, frontend tests, OpenSpec strict validation, and a local proof that run generation succeeds on an instance whose only endpoint is its own generated run.
|