feat: collapse builder onto coold's gRPC stream, isolate builds via systemd-run scope

Builder now rides on coold's Agent.Stream rather than holding a second
persistent gRPC connection to broker — one stream per host, not two.
Coold advertises the "builder" capability in its Hello frame (gated by
COOLD_BUILDER_ENABLED) and the broker capability-routes build:cmd
envelopes from Redis to a host that carries it.

Each build runs as a short-lived builder subprocess wrapped in a
`systemd-run --scope` transient unit so it gets cgroup + FS isolation
(PrivateTmp, ProtectSystem=strict, ReadWritePaths allowlist, MemoryMax,
CPUQuota, RuntimeMaxSec) without requiring an outer container. The
subprocess emits NDJSON frames on stdout; coold parses them and relays
a final BuildResponse over the existing stream.

Cancellation is wired end-to-end: a `{"type":"cancel"}` payload on
build:cmd routes via the broker's pending map to the owning host,
where coold runs `systemctl kill --signal=SIGTERM <scope>`; the cgroup
kill takes the builder + buildah + git down in one sweep.

Workspace layout:
  - New builder-core crate — git + buildah pipeline as a reusable lib.
  - builder/ stays as a binary but is now a one-shot CLI (no gRPC, no
    JWT, no broker URL); coold invokes it per request.
  - broker/:6444 listener and builder.proto deleted; agent.proto gains
    BuildRequest/CancelBuild/BuildResponseBody plus capabilities +
    builder_capacity in Hello.
  - JWT audience collapsed to a single "coold"; per-capability auth
    moves into a `caps` claim the broker cross-checks against Hello.

Breaking: a new coold/broker pair cannot interoperate with the old
builder binary or split-port broker. Deploy in lockstep.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: andrasbacsai

.github/workflows/nightly.yml

@@ -39,7 +39,6 @@ jobs:
     env:
       COOLD_VERSION: ${{ needs.prep.outputs.tag }}
       BROKER_VERSION: ${{ needs.prep.outputs.tag }}
-      BUILDER_VERSION: ${{ needs.prep.outputs.tag }}
     steps:
       - uses: actions/checkout@v4
 
@@ -115,9 +114,9 @@ jobs:
             echo "**Commit:** $(git log -1 --pretty=format:'%s')"
             echo
             echo "### Artifacts"
-            echo "- \`coold\` — per-host agent"
-            echo "- \`broker\` — central-side gRPC stream broker"
-            echo "- \`builder\` — OCI image build agent"
+            echo "- \`coold\` — per-host agent (holds the single gRPC stream to broker; spawns builder subprocess per BuildRequest when COOLD_BUILDER_ENABLED=1)"
+            echo "- \`broker\` — central-side gRPC stream broker (single listener on :6443; capability-aware routing)"
+            echo "- \`builder\` — short-lived build subprocess invoked by coold under a \`systemd-run --scope\` transient unit"
             echo
             if [ -n "$PREV" ]; then
               echo "### Changes since $PREV"

Cargo.lock

@@ -1,5 +1,5 @@
 [workspace]
-members = ["coold", "broker", "builder", "proto"]
+members = ["coold", "broker", "builder", "builder-core", "proto"]
 resolver = "2"
 
 [workspace.package]

Cargo.toml

@@ -41,6 +41,8 @@ async fn main() -> Result<()> {
             coold_version: "fake-0.1".into(),
             schema_min: 1,
             schema_max: 1,
+            capabilities: vec!["coold".into()],
+            builder_capacity: 0,
         })),
     })
     .await?;
@@ -72,6 +74,9 @@ async fn main() -> Result<()> {
                 })
                 .await?;
             }
+            server_msg::Command::Build(_) | server_msg::Command::CancelBuild(_) => {
+                // fake_coold does not implement the builder capability.
+            }
         }
     }
 

broker/examples/fake_coold.rs

@@ -1,7 +1,10 @@
 //! Generate ES256 keypair and sign a test JWT.
 //!
 //! Usage:
-//!   cargo run -p broker --example sign_jwt -- <host_id> <priv_pem_out> <pub_pem_out>
+//!   cargo run -p broker --example sign_jwt -- <host_id> <priv_pem_out> <pub_pem_out> [caps]
+//!
+//! `caps` is an optional comma-separated capability list; defaults to "coold".
+//! Example: `coold,builder` for a host that should accept build dispatches.
 //!
 //! Prints the signed JWT to stdout.
 
@@ -15,34 +18,36 @@ use serde::Serialize;
 struct Claims {
     sub: String,
     aud: String,
+    caps: Vec<String>,
     exp: usize,
     iat: usize,
 }
 
 fn main() -> anyhow::Result<()> {
     let args: Vec<String> = std::env::args().collect();
     if args.len() < 4 {
-        eprintln!("usage: sign_jwt <host_id> <priv_pem_out> <pub_pem_out>");
+        eprintln!("usage: sign_jwt <host_id> <priv_pem_out> <pub_pem_out> [caps]");
         std::process::exit(2);
     }
     let host_id = &args[1];
     let priv_path = &args[2];
     let pub_path = &args[3];
+    let caps: Vec<String> = args
+        .get(4)
+        .map(|s| s.split(',').map(|c| c.trim().to_string()).filter(|c| !c.is_empty()).collect())
+        .unwrap_or_else(|| vec!["coold".to_string()]);
 
-    // Generate EC P-256 key via openssl CLI (keeps this example tiny).
     let status = Command::new("openssl")
         .args(["ecparam", "-name", "prime256v1", "-genkey", "-noout", "-out", priv_path])
         .status()?;
     anyhow::ensure!(status.success(), "openssl ecparam failed");
 
-    // Convert to PKCS8 (jsonwebtoken requires PKCS8 for EC).
     let pkcs8_path = format!("{priv_path}.pkcs8");
     let status = Command::new("openssl")
         .args(["pkcs8", "-topk8", "-nocrypt", "-in", priv_path, "-out", &pkcs8_path])
         .status()?;
     anyhow::ensure!(status.success(), "openssl pkcs8 failed");
 
-    // Derive public PEM.
     let status = Command::new("openssl")
         .args(["ec", "-in", priv_path, "-pubout", "-out", pub_path])
         .status()?;
@@ -57,6 +62,7 @@ fn main() -> anyhow::Result<()> {
     let claims = Claims {
         sub: host_id.clone(),
         aud: "coold".into(),
+        caps,
         exp: now + 3600,
         iat: now,
     };

broker/examples/sign_jwt.rs

@@ -6,20 +6,33 @@ use serde::Deserialize;
 struct Claims {
     /// host_id issued by Laravel at enrollment.
     sub: String,
+    /// Capabilities this host is authorized for. Always includes "coold";
+    /// hosts running builds also carry "builder".
+    #[serde(default)]
+    caps: Vec<String>,
 }
 
-/// Verify a per-host JWT against the expected audience ("coold" or "builder").
-/// Returns the `sub` claim (caller id) on success.
-pub fn verify_jwt(token: &str, public_key_pem: &str, expected_audience: &str) -> Result<String> {
+pub struct VerifiedJwt {
+    pub host_id: String,
+    pub caps: Vec<String>,
+}
+
+/// Verify a per-host JWT. Audience is fixed to "coold" — capability-based
+/// authorization (e.g. accepting a build dispatch) is decided from the
+/// `caps` claim, not from audience splits.
+pub fn verify_jwt(token: &str, public_key_pem: &str) -> Result<VerifiedJwt> {
     let key = DecodingKey::from_ec_pem(public_key_pem.as_bytes())
         .or_else(|_| DecodingKey::from_rsa_pem(public_key_pem.as_bytes()))
         .map_err(|e| anyhow!("load JWT pubkey: {e}"))?;
 
     let mut validation = Validation::new(Algorithm::ES256);
-    validation.set_audience(&[expected_audience]);
+    validation.set_audience(&["coold"]);
 
-    let data = decode::<Claims>(token, &key, &validation)
-        .map_err(|e| anyhow!("JWT verification failed: {e}"))?;
+    let data =
+        decode::<Claims>(token, &key, &validation).map_err(|e| anyhow!("JWT verification failed: {e}"))?;
 
-    Ok(data.claims.sub)
+    Ok(VerifiedJwt {
+        host_id: data.claims.sub,
+        caps: data.claims.caps,
+    })
 }