Module runner 

The build runner: checkout, sandbox, artifacts, signed provenance. The build runner (roadmap phase 3).

A push lands. The runner materialises exactly that commit, builds it with no network, hashes what came out, and signs a [BuildRecord] naming the commit it was made from — which is the join that lets gunnar verify walk from an artifact to a line of source.

  RefUpdated ──▶ checkout(commit) ──▶ sandbox(build) ──▶ artifacts ──▶ signed record ──▶ log

The recipe is in the commit, on purpose

gunnar-build.toml is read out of the tree being built, not off the runner’s disk. So the recipe is part of what was pushed, part of what was signed, and part of what a verifier can go back and look at. A recipe kept beside the runner would be a build input nobody attested to — the one input that decides what every other input does.

network = false is a fact here, not a claim

crate::sandbox puts the build in a network namespace of its own. The runner refuses to build when it cannot, rather than building anyway and recording network: true: a server that quietly downgrades is a server whose records mean different things on different machines. --allow-network is the explicit opt-out, and it is recorded in the signed record.

What it is not

Not a scheduler, not a queue, not a fleet. One build at a time, in the process that watched the event. Scaling it horizontally is the phase-5 item and it is a different problem: this is the part that has to be right.

Structs

Built

What one build did.

Recipe

How a repository is built.

WatchConfig

How the runner is configured when it watches rather than being told.

Enums

Watched

What one watched build turned into.

Constants

RECIPE_FILE

The file a repository carries to say how it is built.

Functions

build_commit

Build one commit and attest to what came out.

said_end

How the watch ended, as the server says it (A28 M18 follow-up): the server runs watch for its whole life, so ANY end while the server runs means pushes are no longer built. Never silent: an error is an ALERT runner at ERROR, any other end a WARN.

watch

Watch the event bus and build what lands.