pi-dispatch v1.10.0

Where a job's container gets built is now a named backend, and what each one guarantees is declared rather than assumed (#227).

Nothing changes for an existing deployment. There is still exactly one backend, local, the Docker daemon on the worker's own host, and a deployment that sets neither new variable runs exactly as before: same argv, same env, same mounts, byte for byte.

What is new

PI_BACKENDS names which backends this deployment blesses. PI_BACKEND_FLOOR is the minimum every one of them must declare, as property=word pairs (egress=enforced,nonRoot=asserted). Both are env-only, deliberately: a bound that can be widened from the surface it bounds is not a bound.

A trigger can name its venue with run.backend, refused at load if the name is unknown and refused before it spends if your deployment does not bless it. The panel's dispatch_trigger_add and _edit offer it as a picker bounded by the same list.

pi-dispatch doctor prints the declaration. Every backend declares thirteen properties in one of three words:

• enforced: this worker builds it, in its own code, and a test reads it back
• asserted: something outside the worker provides it, and doctor names who
• absent: not provided, and a deployment that needs it is refused rather than downgraded

The three print differently on purpose. A control you believe in but do not have is worse than one you know is missing, so asserted renders as a warning naming its source, and absent as a failure.

Two of local's thirteen are asserted, and both are worth reading: nonRoot, because USER pi is the image's and not the worker's argv, and credentialTransit, because every spawn inherits the worker's environment and DOCKER_HOST would redirect it to another machine with your provider key and per-job token along for the ride.

docs/backends.md is the contract for adding a venue: the five functions and what each must return, the thirteen properties, the transfer rules, and the three conflicts no vendor resolves.

Worth knowing

A floor naming a switched-off control refuses to boot. Asking for egress=enforced while PI_EGRESS=0 is a bound you would believe in and not have, so the worker says so instead of starting.

pi-dispatch sandbox is local-only and says so, rather than failing on a missing directory.

The conformance suite verifies three of the thirteen properties plus a bundle's shape. The other ten need a live container on the target runtime, and the harness names each one and what it would take. A green run is not a conformant backend.

Upgrading

Nothing to do. PI_BACKENDS and PI_BACKEND_FLOOR are documented in .env.example and both are optional.