@edgehero/pi-dispatch-admin 1.8.0 → 1.10.0

package/dist/index.mjs

@@ -7598,6 +7598,214 @@ var init_build = __esm({
   }
 });
 
+// ../worker/src/backends.mjs
+function backendFor(name) {
+  const key = name ?? DEFAULT_BACKEND;
+  return Object.hasOwn(BACKENDS, key) ? BACKENDS[key] : void 0;
+}
+function parseBackendList(raw) {
+  const names = (raw ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+  if (names.length === 0) return [DEFAULT_BACKEND];
+  for (const name of names) {
+    if (!Object.hasOwn(BACKENDS, name)) {
+      throw new Error(`PI_BACKENDS names an unknown backend ${JSON.stringify(name)} (known: ${BACKEND_NAMES.join(", ")})`);
+    }
+  }
+  const unique = [...new Set(names)];
+  if (!unique.includes(DEFAULT_BACKEND)) {
+    throw new Error(`PI_BACKENDS must include ${JSON.stringify(DEFAULT_BACKEND)}: a trigger that names no backend is dispatched there, so a set without it leaves every unflagged trigger nowhere to run`);
+  }
+  return unique;
+}
+var DOCKER_NEVER_STARTED_EXITS, ENFORCED, ASSERTED, ABSENT, RANK, PROPERTIES_TABLE, PROPERTIES, PROPERTY_NAMES, BACKENDS_TABLE, BACKENDS, BACKEND_NAMES, DEFAULT_BACKEND;
+var init_backends = __esm({
+  "../worker/src/backends.mjs"() {
+    DOCKER_NEVER_STARTED_EXITS = Object.freeze([125, 126, 127]);
+    ENFORCED = "enforced";
+    ASSERTED = "asserted";
+    ABSENT = "absent";
+    RANK = { [ABSENT]: 0, [ASSERTED]: 1, [ENFORCED]: 2 };
+    PROPERTIES_TABLE = {
+      isolation: {
+        question: "capabilities dropped, no-new-privileges, pid and memory bounds on the job container",
+        armedBy: null
+      },
+      ephemeral: {
+        // CONST-ISOLATION-CONTAINER-PER-JOB's core sentence, and NOT covered by `isolation`: a backend
+        // reusing one long-lived container satisfies every flag above word for word and still leaks state
+        // between mutually untrusting issue authors, which is the whole reason that constraint exists.
+        question: "one container per job, destroyed after it, never reused across jobs",
+        armedBy: null
+      },
+      mountSet: {
+        // The Acceptance clause of CONST-ISOLATION-CONTAINER-PER-JOB: "the agent has no filesystem path to
+        // the host outside the declared mounts", and it names PI_SESSIONS_DIR as never bind-mounted into any
+        // container. Without this property a backend could declare everything else enforced and mount the
+        // docker socket, which is not a weakened boundary but no boundary at all.
+        question: "only the declared mounts exist; no docker socket, no home dir, no shared session store",
+        armedBy: null
+      },
+      egress: {
+        // ARMED, not unconditional, and the table would be re-proposing a rejected constitution entry if it
+        // said otherwise. See the header.
+        question: "the job reaches only what the allowlist proxy permits (CONST-EGRESS-POLICY-IN-THE-ARGV)",
+        armedBy: "PI_EGRESS"
+      },
+      jobToJobIsolation: {
+        // The measured half of REQ-EGRESS-ALLOWLIST. `egress` is about OUTBOUND reach; this is about whether
+        // two jobs can reach each other, which a backend could fail while passing the egress question by
+        // routing every job through the proxy on one shared segment. Also armed: with PI_EGRESS=0 both job
+        // containers sit on docker's default bridge, where egress.mjs records they can reach each other by
+        // IP today.
+        question: "two jobs cannot reach each other, structurally rather than by policy",
+        armedBy: "PI_EGRESS"
+      },
+      imagePinning: {
+        question: "the image cannot be fetched at run time, so a typo'd name is unreachable (--pull=never)",
+        armedBy: null
+      },
+      exitCodes: {
+        // Narrowed deliberately. An earlier draft also claimed "un-interleaved stdout arrives undistorted",
+        // which this project does not have: run-container.mjs tees two independently buffered pipes into one
+        // sink, run-history.mjs reads only the last 8KB, and `OQ-003` records that anything sharing the
+        // container's stdout can land a partial write inside a runner line. The integer is the part that is
+        // actually guaranteed, and it is the part every retry decision rests on.
+        question: "the container's integer exit code reaches the processor unmodified (INT-RUNNER-EXIT-CODE-PROTOCOL)",
+        armedBy: null
+      },
+      abortable: {
+        // REQ-JOB-TIMEOUT-30M. Declared two slices before the seam existed, on purpose: `stopContainer` was
+        // hard-wired in index.mjs's abort path, so a second backend could have passed every other check with
+        // no way to stop a runaway container and nothing in this table would have moved. A gap that is
+        // declared is a refusal; a gap that is unnamed is a surprise. The seam landed in slice 4.
+        question: "a running job can be stopped on the 30-minute timeout or a shutdown, and the abort is distinguishable from a crash",
+        armedBy: null
+      },
+      readOnlyJobInputs: {
+        question: "/job is read-only by the kernel, not by convention (INT-CONTAINER-JOB-INPUTS)",
+        armedBy: null
+      },
+      nonRoot: {
+        question: "the agent runs as a non-root user",
+        armedBy: null
+      },
+      secretsCustody: {
+        // Stated as what the code actually earns and a test can read back, rather than as "values stay on the
+        // operator's host", which is a topological fact about `remote: false` and not something the worker
+        // builds. The host-side argv exposure under a default `hidepid` is real, pre-existing, disclosed in
+        // SECURITY.md, and deliberately outside this sentence rather than denied by it. WHETHER THE VALUES
+        // CROSS A NETWORK is deliberately not asked here either -- that is `credentialTransit`, which answers
+        // it honestly, and folding the two would let this one's verified half carry the other's unverified.
+        question: "no resolved secret VALUE reaches a log, a run record or a forge comment",
+        armedBy: null
+      },
+      credentialTransit: {
+        // CONST-TOKEN-SCOPED-PER-JOB is what CONST-EGRESS-POLICY-IN-THE-ARGV calls "what actually bounds the
+        // damage", and the first draft of this table had no property for it at all. A remote backend must
+        // ship the provider key and the per-job forge token to a daemon it does not own; that is a different
+        // question from secretsCustody, which is about this host's own logs and records.
+        question: "the provider key and the per-job forge token reach the container without crossing a network this deployment does not own",
+        armedBy: null
+      },
+      localFolders: {
+        question: "a local folder can be bind-mounted and edited in place (DES-WORKER-ON-HOST finding 2)",
+        armedBy: null
+      }
+    };
+    PROPERTIES = Object.freeze(
+      Object.fromEntries(Object.entries(PROPERTIES_TABLE).map(([name, entry]) => [name, Object.freeze({ ...entry })]))
+    );
+    PROPERTY_NAMES = Object.freeze(Object.keys(PROPERTIES));
+    BACKENDS_TABLE = {
+      local: {
+        /**
+         * The Docker daemon on the worker's own host -- what every deployment has always used, and what
+         * `DES-WORKER-ON-HOST` chose deliberately: the worker runs on the host and shells out to the real
+         * `docker` CLI, inheriting its cross-platform path translation rather than reimplementing it.
+         */
+        describe: "the Docker daemon on this worker's host",
+        remote: false,
+        declares: {
+          // Built by this worker's own argv, in `ISOLATION_FLAGS`, and asserted back member-by-member
+          // against the imported array by two tests. `dockerArgsFromSpec` additionally refuses a
+          // `dockerExtra` carrying a flag that would supersede one of them -- membership in an argv is not
+          // effectiveness of that argv, and without that guard those two assertions would pass on an argv
+          // with no boundary left. It is a deny-list, so it NARROWS that gap rather than closing it; what
+          // closes it today is that the only production caller passes fixed literals.
+          isolation: ENFORCED,
+          // `--rm` leads ISOLATION_FLAGS and the container name carries the job id, so no container is
+          // reachable to reuse even in principle.
+          ephemeral: ENFORCED,
+          // The mount list is built by `containerSpec` from a fixed set of named host paths and nothing
+          // else. There is no pass-through, and the shared session store under PI_SESSIONS_DIR is never
+          // among them -- only this job's own copy.
+          mountSet: ENFORCED,
+          // CAPABILITY, gated by PI_EGRESS. When armed: `--network=pi-job-<id>-net`, `--internal`, created
+          // before the spawn and removed in a finally. When PI_EGRESS=0 the flag is absent and the job is
+          // on docker's default bridge -- which is why this word is `armedBy` rather than flat.
+          egress: ENFORCED,
+          // Same switch, and the same reason: an `--internal` network holding exactly two endpoints is what
+          // makes job-to-job structurally impossible. Unarmed, egress.mjs records the opposite is true.
+          jobToJobIsolation: ENFORCED,
+          // `--pull=never`, which makes the fetch branch unreachable rather than merely unlikely. Every
+          // path that starts a container from the job image carries it, doctor's probes included.
+          imagePinning: ENFORCED,
+          // `spawn` on the CLI: the integer comes from the `close` event and is passed to `decideRetry`
+          // unmodified.
+          exitCodes: ENFORCED,
+          // `docker stop` on the name, and the abort FLAG rather than the code is the discriminator -- a
+          // worker SIGKILL and a kernel OOM both surface as 137. The worker also BOUNDS the wait after the
+          // abort, so a stop that does not take frees the slot instead of holding it forever.
+          abortable: ENFORCED,
+          // `-v <host>:/job:ro` -- the kernel enforces it. `verify-image.sh` proves it with a live write
+          // attempt rather than trusting the flag.
+          readOnlyJobInputs: ENFORCED,
+          // ASSERTED, not enforced, and this is the honest one. Non-root is `USER pi` in the IMAGE, not in
+          // the worker's argv -- SECURITY.md says so in terms: "Non-root is not in that argv." An
+          // operator-built image can run as root and nothing here would refuse it (`OQ-012`).
+          nonRoot: ASSERTED,
+          // Traced end to end: the resolver logs a stderr BYTE COUNT and never the bytes, the refusal
+          // comment carries neither the reference nor the resolver's path nor a byte of what it printed,
+          // and `buildRecord` is an explicit literal with no spread. Where the values GO is
+          // `credentialTransit`'s question, not this one's.
+          secretsCustody: ENFORCED,
+          // ASSERTED, and this is the second honest one. The intent is that the daemon is on this host, so
+          // nothing leaves it -- but every spawn is `docker` with the worker's own environment inherited,
+          // and `DOCKER_HOST=tcp://...` or a `docker context` redirects that connection to another machine
+          // with the provider key and the per-job forge token riding along as `-e NAME=VALUE`. `DOCKER_HOST`
+          // appears NOWHERE in this repository: no code sets it, no check refuses it, no test reads it back.
+          // By this file's own definition of `enforced` -- "this worker CAN build it, in its own code, and a
+          // test in this repo reads it back" -- there is no such code, so the word would be exactly the
+          // overclaim `nonRoot` avoids one property up. A boot check on DOCKER_HOST would earn `enforced`.
+          credentialTransit: ASSERTED,
+          // The whole reason `DES-WORKER-ON-HOST` reversed the containerised worker.
+          localFolders: ENFORCED
+        },
+        /**
+         * WHO is asserting each `asserted` property. Required for every property this backend declares
+         * ASSERTED and meaningless for the others, which a test pins both ways.
+         *
+         * Exists because "asserted" alone is not actionable: it tells an operator the worker is not the one
+         * providing the property without telling them who is, so they cannot go and check. `doctor` prints
+         * this beside the word, which is what lets the claim "asserted names who is asserting it" be true
+         * rather than aspirational. For a vendor adapter this is where "the vendor's documentation" goes.
+         */
+        asserts: {
+          nonRoot: "the job image's USER directive (this repo's builds `USER pi`; an operator-built image may not)",
+          credentialTransit: "the docker endpoint DOCKER_HOST resolves to, which is this host unless something redirects it"
+        }
+      }
+    };
+    BACKENDS = Object.freeze(
+      Object.fromEntries(
+        Object.entries(BACKENDS_TABLE).map(([name, entry]) => [name, Object.freeze({ ...entry, declares: Object.freeze({ ...entry.declares }) })])
+      )
+    );
+    BACKEND_NAMES = Object.freeze(Object.keys(BACKENDS));
+    DEFAULT_BACKEND = "local";
+  }
+});
+
 // ../worker/src/egress.mjs
 var init_egress = __esm({
   "../worker/src/egress.mjs"() {
@@ -7738,6 +7946,7 @@ function defaultSettingsFile() {
 var CHAIN_DEPTH_MAX_DEFAULT, CHAIN_MAX_PER_JOB_DEFAULT, WORKER_ONLY_SECRET_VARS, EGRESS_ENV_VARS;
 var init_config2 = __esm({
   "../worker/src/config.mjs"() {
+    init_backends();
     init_egress();
     init_forges();
     init_secret_profiles();
@@ -8557,10 +8766,11 @@ function normalizeCron(on, run, index, path, state) {
   validateDisarmed(on, `cron trigger "${id}"`, path, { onType: "cron" });
   const secrets = validateSecrets(run, `cron trigger "${id}"`, path);
   const secretsProfile = validateSecretsProfile(run, `cron trigger "${id}"`, path);
+  const backend = validateBackend(on, run, `cron trigger "${id}"`, path, { localWorkspace: true });
   validateWaitFor(on, run, `cron trigger "${id}"`, path, { onType: "cron" });
   return {
     on: { type: "cron", id, pattern },
-    run: { kind: "local", folder: run.folder, flow: run.flow, task: run.task, provider: run.provider, model: run.model, maxTurns: run.maxTurns, github: run.github, packages, image, resume, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile } }
+    run: { kind: "local", folder: run.folder, flow: run.flow, task: run.task, provider: run.provider, model: run.model, maxTurns: run.maxTurns, github: run.github, packages, image, resume, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...backend !== void 0 && { backend } }
   };
 }
 function validatePackagesFlag(run, at, path) {
@@ -8807,6 +9017,45 @@ function validateSecretsProfile(run, at, path) {
   }
   return profile;
 }
+function refusesLocalWorkspace(entry, localWorkspace) {
+  return Boolean(localWorkspace) && entry?.remote !== false;
+}
+function validateBackend(on, run, at, path, { localWorkspace }) {
+  for (const [label, source, exactIsLegal] of [
+    ["run", run, true],
+    ["on", on, false]
+  ]) {
+    for (const key of Object.keys(source ?? {})) {
+      if (exactIsLegal && key === "backend") continue;
+      const normalized = key.replace(/[^a-z0-9]/gi, "").toLowerCase();
+      const targets = ["backend", "backends"];
+      const isSubsequence = (needle, hay) => {
+        let i = 0;
+        for (const ch of hay) if (i < needle.length && needle[i] === ch) i++;
+        return i === needle.length;
+      };
+      const suspicious = /^[\x20-\x7E]*$/.test(key) ? targets.includes(normalized) : normalized.length >= 4 && targets.some((t) => isSubsequence(normalized, t));
+      if (!suspicious) continue;
+      throw configError(`${at}: ${label}.${key} is not a field -- did you mean run.backend? A venue the loader drops runs the job somewhere else while the file reads as though it chose, so a near miss is refused rather than dropped: ${path}`);
+    }
+  }
+  const backend = run.backend;
+  if (backend === void 0) return void 0;
+  if (!isNonEmptyString5(backend)) {
+    throw configError(`${at}: run.backend must be a non-empty string naming one of the backends this deployment can run jobs in (got ${JSON.stringify(backend)}): ${path}`);
+  }
+  if (!ID_CHARSET.test(backend)) {
+    throw configError(`${at}: run.backend ${JSON.stringify(backend)} may use letters, digits, dot, dash and underscore only -- PI_BACKENDS is a comma-separated list, so a name carrying that separator could not be blessed: ${path}`);
+  }
+  const entry = backendFor(backend);
+  if (!entry) {
+    throw configError(`${at}: run.backend ${JSON.stringify(backend)} is not a backend this build knows (known: ${BACKEND_NAMES.join(", ")}) -- whether your deployment BLESSES it is PI_BACKENDS, checked before the job spends: ${path}`);
+  }
+  if (refusesLocalWorkspace(entry, localWorkspace)) {
+    throw configError(`${at}: run.backend ${JSON.stringify(backend)} is remote, and this trigger runs against a folder on THIS machine that has to be bind-mounted and edited in place -- there is no volume to hide behind (DES-WORKER-ON-HOST): ${path}`);
+  }
+  return backend;
+}
 function validateWaitFor(on, run, at, path, { onType }) {
   for (const [label, source, exactIsLegal] of [
     ["run", run, true],
@@ -8902,10 +9151,11 @@ function normalizeLabel(on, run, index, path) {
   const replicas = validateReplicas(run, at, path);
   const secrets = validateSecrets(run, at, path);
   const secretsProfile = validateSecretsProfile(run, at, path);
+  const backend = validateBackend(on, run, at, path, { localWorkspace: false });
   const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
   return {
     on: { type: "label", any: predicate.any, all: predicate.all, none: predicate.none },
-    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor } }
+    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor }, ...backend !== void 0 && { backend } }
   };
 }
 function normalizeComment(on, run, index, path, state) {
@@ -8934,10 +9184,11 @@ function normalizeComment(on, run, index, path, state) {
   const replicas = validateReplicas(run, at, path);
   const secrets = validateSecrets(run, at, path);
   const secretsProfile = validateSecretsProfile(run, at, path);
+  const backend = validateBackend(on, run, at, path, { localWorkspace: false });
   const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
   return {
     on: { type: "comment", phrase: on.phrase },
-    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor } }
+    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor }, ...backend !== void 0 && { backend } }
   };
 }
 function normalizeIssue(on, run, index, path) {
@@ -8976,6 +9227,7 @@ function normalizeIssue(on, run, index, path) {
   const replicas = validateReplicas(run, at, path);
   const secrets = validateSecrets(run, at, path);
   const secretsProfile = validateSecretsProfile(run, at, path);
+  const backend = validateBackend(on, run, at, path, { localWorkspace: false });
   const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
   return {
     on: {
@@ -8986,7 +9238,7 @@ function normalizeIssue(on, run, index, path) {
       ...number !== void 0 && { number },
       ...once !== void 0 && { once }
     },
-    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor } }
+    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor }, ...backend !== void 0 && { backend } }
   };
 }
 function normalizePullRequest(on, run, index, path) {
@@ -9034,6 +9286,7 @@ function normalizePullRequest(on, run, index, path) {
   const replicas = validateReplicas(run, at, path);
   const secrets = validateSecrets(run, at, path);
   const secretsProfile = validateSecretsProfile(run, at, path);
+  const backend = validateBackend(on, run, at, path, { localWorkspace: false });
   const waitFor = validateWaitFor(on, run, at, path, { onType: on.type });
   return {
     on: {
@@ -9049,7 +9302,7 @@ function normalizePullRequest(on, run, index, path) {
       ...number !== void 0 && { number },
       ...once !== void 0 && { once }
     },
-    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor } }
+    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile }, ...waitFor !== void 0 && { waitFor }, ...backend !== void 0 && { backend } }
   };
 }
 function validateReviewState(on, actions, run, at, path) {
@@ -9074,6 +9327,7 @@ function validateReviewState(on, actions, run, at, path) {
 var ON_TYPES, DISARMED_TYPE, PR_ACTIONS, PR_CLOSE_ACTIONS, ISSUE_ACTIONS, REVIEW_STATES, REVIEW_ACTION, ID_CHARSET, REPLICAS_MAX, SECRETS_MAX, ENV_NAME, RESERVED_ENV_NAMES, INSTRUCTIONS_MAX;
 var init_triggers = __esm({
   "../worker/src/triggers.mjs"() {
+    init_backends();
     init_config2();
     init_flow_gate();
     init_forges();
@@ -9133,7 +9387,7 @@ function fleetQueueNames(hosts) {
 function makeQueue(connection, { name = QUEUE } = {}) {
   return new Queue(name, { connection });
 }
-async function enqueueLocalJob(queue, { folder, flow, task, command, provider, model, maxTurns, image, skillsDir, secrets, secretsProfile, chainDepth, parentJobId, jobId, now = /* @__PURE__ */ new Date() }) {
+async function enqueueLocalJob(queue, { folder, flow, task, command, provider, model, maxTurns, image, backend, skillsDir, secrets, secretsProfile, chainDepth, parentJobId, jobId, now = /* @__PURE__ */ new Date() }) {
   const minute = now.toISOString().slice(0, 16);
   const id = jobId ?? localJobId({ folder, flow: command !== void 0 ? `cmd:${command}` : flow, task, minute });
   const data = {
@@ -9149,6 +9403,12 @@ async function enqueueLocalJob(queue, { folder, flow, task, command, provider, m
     model,
     maxTurns,
     ...image !== void 0 && { image },
+    // #227. WHERE this job's container is built. Conditional like `image`, so a trigger that named no
+    // venue produces byte-identical job data -- and at JOB level, never inside `trigger`, for the reason
+    // `image` and `skillsDir` are: `trigger` is copied VERBATIM into `/job/event.json`, so a key added
+    // there becomes agent-visible input, and where the box was built is the worker's business rather
+    // than the agent's.
+    ...backend !== void 0 && { backend },
     // The host directory of operator-authored skills this trigger injects (REQ-PER-TRIGGER-SKILLS).
     // Conditional like `image`, so an unflagged job's data stays byte-identical, and at JOB level rather
     // than inside `trigger` because a worker-host path is an execution knob, not a fact about the
@@ -9346,8 +9606,8 @@ var init_import_pi = __esm({
   }
 });
 
-// ../worker/src/docker-run.mjs
-function buildDockerRunArgs({
+// ../worker/src/container-spec.mjs
+function containerSpec({
   image,
   env,
   jobDir,
@@ -9364,50 +9624,34 @@ function buildDockerRunArgs({
   if (!image) throw new Error("docker run: image is required");
   if (!name) throw new Error("docker run: container name is required");
   if (!workspace) throw new Error("docker run: workspace mount is required");
-  const args = ["run", `--name=${name}`, ...ISOLATION_FLAGS, `--memory=${memory}`, `--cpus=${cpus}`];
-  if (network) args.push(`--network=${network}`);
-  args.push(...extraFlags);
-  for (const [k, v] of Object.entries(env ?? {})) {
-    if (v === void 0 || v === null) continue;
-    args.push("-e", `${k}=${v}`);
-  }
-  if (jobDir) args.push("-v", `${jobDir}:/job:ro`);
-  args.push("-v", `${workspace}:/workspace`);
-  if (outboxDir) args.push("-v", `${outboxDir}:/outbox`);
-  if (sessionDir) args.push("-v", `${sessionDir}:${CONTAINER_SESSION_DIR}`);
-  if (globalPiDir) args.push("-v", `${globalPiDir}:${CONTAINER_GLOBAL_PI_DIR}:ro`);
-  args.push(image);
-  return args;
+  const mounts = [];
+  if (jobDir) mounts.push({ host: jobDir, container: "/job", readOnly: true });
+  mounts.push({ host: workspace, container: "/workspace", readOnly: false });
+  if (outboxDir) mounts.push({ host: outboxDir, container: "/outbox", readOnly: false });
+  if (sessionDir) mounts.push({ host: sessionDir, container: CONTAINER_SESSION_DIR, readOnly: false });
+  if (globalPiDir) mounts.push({ host: globalPiDir, container: CONTAINER_GLOBAL_PI_DIR, readOnly: true });
+  return {
+    image,
+    name,
+    memory,
+    cpus,
+    network,
+    // UNCONDITIONALLY true, and there is deliberately no parameter that can unset it. The boundary is
+    // not a thing a caller opts into -- CONST-ISOLATION-CONTAINER-PER-JOB is why every other flag here
+    // exists -- so the spec is simply unable to describe an unisolated container, and the builder in
+    // docker-run.mjs refuses one it is handed. A field that could be false would be a way to ask for less.
+    isolated: true,
+    mounts,
+    env,
+    dockerExtra: extraFlags
+  };
 }
-var CONTAINER_GLOBAL_PI_DIR, CONTAINER_SESSION_DIR, CONTAINER_SESSION_FILE, ISOLATION_FLAGS;
-var init_docker_run = __esm({
-  "../worker/src/docker-run.mjs"() {
+var CONTAINER_GLOBAL_PI_DIR, CONTAINER_SESSION_DIR, CONTAINER_SESSION_FILE;
+var init_container_spec = __esm({
+  "../worker/src/container-spec.mjs"() {
     CONTAINER_GLOBAL_PI_DIR = "/opt/pi-global";
     CONTAINER_SESSION_DIR = "/session";
     CONTAINER_SESSION_FILE = `${CONTAINER_SESSION_DIR}/current.jsonl`;
-    ISOLATION_FLAGS = [
-      // The image must ALREADY be on this host. `docker run` defaults to --pull=missing, so an unknown name is
-      // a registry FETCH: a typo in the operator's image config would otherwise pull and execute a stranger's
-      // image under a name that looks like theirs. Every other flag here bounds what a chosen image may DO;
-      // this one bounds which image is chosen at all, which is why it leads. The same make-it-unreachable move
-      // PI_OFFLINE=1 makes one layer up, and it costs nothing the documented flow was using: the README's
-      // install step is an explicit `docker pull && docker tag`, and `pi-job:latest` is a local-only tag with
-      // no registry behind it. A readable diagnosis is the preflight's job (image-preflight.mjs); this is the
-      // part that cannot be raced.
-      "--pull=never",
-      "--rm",
-      // ephemeral: gone after the run
-      "--init",
-      // reap zombies (Chromium spawns many); node is PID 1 and does not reap
-      "--cap-drop=ALL",
-      // pi would otherwise inherit the launching user's capabilities
-      "--security-opt",
-      "no-new-privileges",
-      "--pids-limit=512",
-      // bound a fork bomb (UNVERIFIED figure; measured headroom ~4.5x, see spec)
-      "--shm-size=1g"
-      // Chromium OOMs on the default 64MB /dev/shm; NOT --ipc=host (shares host ns)
-    ];
   }
 });
 
@@ -9491,7 +9735,7 @@ var init_packages = __esm({
   "../worker/src/packages.mjs"() {
     init_config2();
     init_import_pi();
-    init_docker_run();
+    init_container_spec();
     PACKAGES_SUBDIR = "packages";
     STAGE_MANIFEST = "packages.json";
     CONTAINER_PACKAGES_ROOT = `${CONTAINER_GLOBAL_PI_DIR}/${PACKAGES_SUBDIR}`;
@@ -11408,6 +11652,7 @@ function normalizeTriggerForDisplay(entry) {
   const command = typeof run.command === "string" ? run.command : null;
   const packages = run.packages !== false;
   const image = typeof run.image === "string" && run.image.trim() !== "" ? run.image : null;
+  const backend = typeof run.backend === "string" && run.backend.trim() !== "" ? run.backend : null;
   const skillsDir = typeof run.skillsDir === "string" && run.skillsDir.trim() !== "" ? run.skillsDir : null;
   const instructions = typeof run.instructions === "string" && run.instructions.trim() !== "";
   const resume = run.resume === true;
@@ -11429,6 +11674,7 @@ function normalizeTriggerForDisplay(entry) {
         model: typeof run.model === "string" ? run.model : null,
         packages,
         image,
+        backend,
         skillsDir,
         instructions,
         resume,
@@ -11436,9 +11682,9 @@ function normalizeTriggerForDisplay(entry) {
         secretsProfile
       };
     case "label":
-      return { type: "label", any: normalizeSelector(on.any), all: normalizeSelector(on.all), none: normalizeSelector(on.none), flow, command, packages, image, skillsDir, instructions, resume, secrets, secretsProfile, replicas, forge };
+      return { type: "label", any: normalizeSelector(on.any), all: normalizeSelector(on.all), none: normalizeSelector(on.none), flow, command, packages, image, backend, skillsDir, instructions, resume, secrets, secretsProfile, replicas, forge };
     case "comment":
-      return { type: "comment", phrase: typeof on.phrase === "string" ? on.phrase : null, flow, command, packages, image, skillsDir, instructions, resume, secrets, secretsProfile, replicas, forge };
+      return { type: "comment", phrase: typeof on.phrase === "string" ? on.phrase : null, flow, command, packages, image, backend, skillsDir, instructions, resume, secrets, secretsProfile, replicas, forge };
     case "pull_request": {
       const prDisarmed = on.disarmed !== null && typeof on.disarmed === "object" && !Array.isArray(on.disarmed) ? on.disarmed : null;
       return {
@@ -11454,6 +11700,7 @@ function normalizeTriggerForDisplay(entry) {
         command,
         packages,
         image,
+        backend,
         skillsDir,
         instructions,
         resume,
@@ -11481,6 +11728,7 @@ function normalizeTriggerForDisplay(entry) {
         command,
         packages,
         image,
+        backend,
         skillsDir,
         instructions,
         resume,
@@ -39860,6 +40108,108 @@ var init_pricing = __esm({
   }
 });
 
+// ../worker/src/docker-run.mjs
+function dockerArgsFromSpec(spec) {
+  if (spec?.isolated !== true) throw new Error("docker run: refusing to build an argv for a spec that is not isolated");
+  for (const flag of spec.dockerExtra ?? []) {
+    if (typeof flag !== "string") {
+      throw new Error(`docker run: dockerExtra must contain only strings; got ${typeof flag}`);
+    }
+    if (DOCKER_EXTRA_FORBIDDEN.includes(flag.split("=", 1)[0])) {
+      throw new Error(`docker run: refusing a dockerExtra flag that would supersede the isolation boundary: ${flag}`);
+    }
+  }
+  const args = ["run", `--name=${spec.name}`, ...ISOLATION_FLAGS, `--memory=${spec.memory}`, `--cpus=${spec.cpus}`];
+  if (spec.network) args.push(`--network=${spec.network}`);
+  args.push(...spec.dockerExtra ?? []);
+  for (const [k, v] of Object.entries(spec.env ?? {})) {
+    if (v === void 0 || v === null) continue;
+    args.push("-e", `${k}=${v}`);
+  }
+  for (const m of spec.mounts ?? []) args.push("-v", `${m.host}:${m.container}${m.readOnly ? ":ro" : ""}`);
+  args.push(spec.image);
+  return args;
+}
+function buildDockerRunArgs(opts) {
+  return dockerArgsFromSpec(containerSpec(opts));
+}
+var ISOLATION_FLAGS, DOCKER_EXTRA_FORBIDDEN;
+var init_docker_run = __esm({
+  "../worker/src/docker-run.mjs"() {
+    init_container_spec();
+    init_container_spec();
+    ISOLATION_FLAGS = [
+      // The image must ALREADY be on this host. `docker run` defaults to --pull=missing, so an unknown name is
+      // a registry FETCH: a typo in the operator's image config would otherwise pull and execute a stranger's
+      // image under a name that looks like theirs. Every other flag here bounds what a chosen image may DO;
+      // this one bounds which image is chosen at all, which is why it leads. The same make-it-unreachable move
+      // PI_OFFLINE=1 makes one layer up, and it costs nothing the documented flow was using: the README's
+      // install step is an explicit `docker pull && docker tag`, and `pi-job:latest` is a local-only tag with
+      // no registry behind it. A readable diagnosis is the preflight's job (image-preflight.mjs); this is the
+      // part that cannot be raced.
+      "--pull=never",
+      "--rm",
+      // ephemeral: gone after the run
+      "--init",
+      // reap zombies (Chromium spawns many); node is PID 1 and does not reap
+      "--cap-drop=ALL",
+      // pi would otherwise inherit the launching user's capabilities
+      "--security-opt",
+      "no-new-privileges",
+      "--pids-limit=512",
+      // bound a fork bomb (UNVERIFIED figure; measured headroom ~4.5x, see spec)
+      "--shm-size=1g"
+      // Chromium OOMs on the default 64MB /dev/shm; NOT --ipc=host (shares host ns)
+    ];
+    DOCKER_EXTRA_FORBIDDEN = [
+      // Each of the seven logical flags in ISOLATION_FLAGS, and the argv member beside them that the worker's
+      // own machinery reads back. A flag missing from here is a flag the array cannot defend.
+      "--rm",
+      // `--rm=false` leaves the container behind; verified against docker 27.4.0. `ephemeral` rests on it.
+      "--init",
+      "--shm-size",
+      // The container NAME is not an isolation flag and is the sharpest entry on this list: both boot reapers
+      // match `pi-job-` as a substring and the abort path is `docker stop <name>`, so a second `--name` wins
+      // last and leaves a container no sweep finds and no timeout can stop. `ephemeral` and `abortable` both
+      // rest on it.
+      "--name",
+      "--privileged",
+      "--cap-add",
+      "--security-opt",
+      "--pids-limit",
+      "--memory",
+      "-m",
+      "--cpus",
+      "--network",
+      "--net",
+      "--pull",
+      // Add a mount, which is what `-v`/`--volume`/`--mount` are blocked for; `mountSet` rests on all five.
+      "--volumes-from",
+      "--tmpfs",
+      // Relax the memory bound without repeating `--memory`.
+      "--memory-swap",
+      "--oom-kill-disable",
+      // Widen what the process may do without repeating a flag already listed.
+      "--ulimit",
+      "--sysctl",
+      "--group-add",
+      "--cgroup-parent",
+      "--device-cgroup-rule",
+      "--gpus",
+      "--runtime",
+      "-v",
+      "--volume",
+      "--mount",
+      "--device",
+      "--pid",
+      "--ipc",
+      "--uts",
+      "--userns",
+      "--cgroupns"
+    ];
+  }
+});
+
 // ../worker/src/sandbox-store.mjs
 import { lstatSync, mkdirSync, readFileSync as readFileSync3, readdirSync as readdirSync2, renameSync, rmSync, writeFileSync } from "node:fs";
 import { isAbsolute as isAbsolute3, join as join5, relative } from "node:path";
@@ -40175,10 +40525,11 @@ var init_render = __esm({
 });
 
 // ../worker/src/scheduler-stall-guard.mjs
-var STALL_KEY, STALL_WINDOW_SECONDS;
+var STALL_KEY, stallKey, STALL_WINDOW_SECONDS;
 var init_scheduler_stall_guard = __esm({
   "../worker/src/scheduler-stall-guard.mjs"() {
     STALL_KEY = "pi-dispatch:sched-stalls";
+    stallKey = (schedulerId) => `${STALL_KEY}:${schedulerId}`;
     STALL_WINDOW_SECONDS = 24 * 60 * 60;
   }
 });
@@ -40444,7 +40795,9 @@ function createDashboardDeps(paths, {
     async fetchSnapshot() {
       const queues = await fleetQueues();
       const merged = await mergedRunsOn(redis, { logsDir: paths.logsDir, limit: RUNS_ON_DASHBOARD }).catch(() => ({ runs: [], hosts: [], mirror: "off" }));
-      const [pausedStates, countsPer, workerList, dayRaw, weekRaw, monthRaw, tokenRaw, schedulerLists, activeLists, stallHash] = await Promise.all([
+      const triggersView = readTriggers({ triggersPath: paths.triggersPath });
+      const cronIds = Array.isArray(triggersView?.triggers) ? triggersView.triggers.filter((t) => t?.type === "cron" && typeof t?.id === "string" && t.id !== "").map((t) => t.id) : [];
+      const [pausedStates, countsPer, workerList, dayRaw, weekRaw, monthRaw, tokenRaw, schedulerLists, activeLists, stallCounts] = await Promise.all([
         Promise.all(queues.map((q) => q.isPaused())),
         Promise.all(queues.map((q) => q.getJobCounts("waiting", "active", "paused", "delayed", "failed"))),
         queue.getWorkers().catch(() => []),
@@ -40458,8 +40811,10 @@ function createDashboardDeps(paths, {
         Promise.all(queues.map((q, i) => i === 0 ? q.getJobSchedulers(0, -1, true) : q.getJobSchedulers(0, -1, true).catch(() => []))),
         Promise.all(queues.map((q) => q.getActive(0, 0).catch(() => []))),
         // Per-scheduler stall counts (money backstop) for the cron drill-in; reuses the held client like the
-        // budget GETs. HGETALL of an absent key is `{}`, so a never-stalled deployment shows 0 stalls.
-        redis.hgetall(STALL_KEY).catch(() => ({}))
+        // budget GETs. ONE MGET for every declared cron id, so this stays one round trip however many
+        // schedulers exist. An absent key reads as an honest 0 -- a scheduler that has never stalled -- which
+        // is the same posture `readScopedBudget` takes for a scope that has never run.
+        cronIds.length > 0 ? redis.mget(...cronIds.map((id) => stallKey(id))).catch(() => []) : Promise.resolve([])
       ]);
       const workers = Array.isArray(workerList) && workerList.length > 0 ? workerList.length : "unknown";
       const counts = {};
@@ -40492,7 +40847,9 @@ function createDashboardDeps(paths, {
         queue: { pausedState, pausedPartial, counts, workers, queues: queues.length, fleetDegraded },
         budget: { day: Number(dayRaw ?? 0), week: Number(weekRaw ?? 0), month: Number(monthRaw ?? 0), tokensToday: Number(tokenRaw ?? 0) },
         schedulers: mapSchedulers(schedulerList, Date.now()),
-        schedulerStalls: stallHash ?? {},
+        // Rebuilt into the `{ id -> count }` shape the drill-in and the LIST badge already index by, so
+        // neither reader changes.
+        schedulerStalls: Object.fromEntries(cronIds.map((id, i) => [id, Number(stallCounts?.[i] ?? 0) || 0])),
         schedulerStallMax: paths.schedulerStallMax,
         // Merged across the fleet (issue #57, Gap 3). This host's files stay the truth and the single-host
         // path; the mirror adds the other hosts' records. On a shared `PI_LOGS_DIR` the local read is
@@ -40501,7 +40858,7 @@ function createDashboardDeps(paths, {
         runHosts: merged.hosts,
         runMirror: merged.mirror,
         settings: readSettingsView({ settingsFile: paths.settingsFile }),
-        triggers: readTriggers({ triggersPath: paths.triggersPath }),
+        triggers: triggersView,
         pauseWindows: readPauseWindows({ pauseWindowsPath: paths.pauseWindowsPath }),
         // The operator's staged third-party pi packages (REQ-GLOBAL-PI-OVERLAY), for the armed triggers'
         // trust model. Like the four reads above it is a plain file read whose fs access lives entirely in
@@ -41383,6 +41740,7 @@ function renderTriggerDetail(t, inner, styler, sched = null, staged = null) {
   }
   if (typeof t.command === "string" && t.command.trim() !== "") out.push(kv("command", `/${t.command.trim()}`, "accent"));
   out.push(kv("image", t.image ?? "deployment default", t.image ? "accent" : "dim"));
+  out.push(kv("backend", t.backend ?? "deployment default", t.backend ? "accent" : "dim"));
   out.push(kv("resume", t.resume === true ? "continues the previous session" : "cold start", t.resume === true ? "warning" : "dim"));
   out.push(kv("replicas", t.replicas > 1 ? `${t.replicas} sandboxes race this flow` : "one run per delivery", t.replicas > 1 ? "warning" : "dim"));
   blank();
@@ -42247,7 +42605,7 @@ var init_setup_wizard = __esm({
     init_deployment_pointer();
     init_read_model();
     init_index();
-    RUNTIME_VERSION = "1.8.0";
+    RUNTIME_VERSION = "1.10.0";
     RECEIVER_VERSION = "1.5.0";
     RUNTIME_PKG = "@edgehero/pi-dispatch";
     RECEIVER_PKG = "@edgehero/pi-dispatch-receiver";
@@ -42558,7 +42916,7 @@ function registerTools(pi) {
   pi.registerTool({
     name: "dispatch_trigger_add",
     label: "pi-dispatch add trigger",
-    description: "Adds a trigger to triggers.json and applies it live. The operator MUST approve a confirm dialog showing the entry; with no interactive operator it is refused. `flow` is the .pi/skills/<name> skill the job runs (its SKILL.md is the agent's instructions). `kind` = cron|label|comment|pull_request|issue. cron (local) needs id, pattern, `folder` (absolute host path the job runs in), `flow`, and `task` (the prompt text handed to the agent), and may set optional model/provider/maxTurns for that schedule (omit = deployment default). label needs labels[]+flow; comment needs phrase+flow; pull_request needs action[] (+ optional labels[]) + flow. issue fires when an ISSUE closes: it needs flow, its action[] defaults to the forge's close word (github/forgejo closed, gitlab close; azure has no close trigger), and it may set `number` (the forge's own item number, narrowing the rule to that one issue) and `once: true` (a one-shot: it fires once, the run is recorded, then the worker disarms the entry by writing on.disarmed; once requires number). A close-only pull_request rule accepts the same number/once narrowing. Webhook triggers take an optional `forge` = github (default) | gitlab | forgejo | azure, which also decides which action words pull_request accepts: github is labeled|opened|synchronize|reopened|review_submitted|closed, gitlab is open|update|reopen|approved|close, forgejo is label_updated|opened|synchronized|reopened|closed, azure is created|updated (no close word). The close word rides alone: it cannot be mixed with other actions in one entry. An azure label or comment trigger must also set `repository` (a work item belongs to a project, not a repository), and an azure pull_request trigger may not carry labels[] at all. A github review_submitted trigger may also set reviewState[] (approved|changes_requested|commented) to narrow which verdicts fire; omitted, all three do. For webhook triggers the repo and the task come from the triggering issue/PR event \u2014 set only the match + flow \u2014 and they run under the deployment default model.",
+    description: "Adds a trigger to triggers.json and applies it live. The operator MUST approve a confirm dialog showing the entry; with no interactive operator it is refused. `flow` is the .pi/skills/<name> skill the job runs (its SKILL.md is the agent's instructions). `kind` = cron|label|comment|pull_request|issue. cron (local) needs id, pattern, `folder` (absolute host path the job runs in), `flow`, and `task` (the prompt text handed to the agent), and may set optional model/provider/maxTurns for that schedule (omit = deployment default). label needs labels[]+flow; comment needs phrase+flow; pull_request needs action[] (+ optional labels[]) + flow. issue fires when an ISSUE closes: it needs flow, its action[] defaults to the forge's close word (github/forgejo closed, gitlab close; azure has no close trigger), and it may set `number` (the forge's own item number, narrowing the rule to that one issue) and `once: true` (a one-shot: it fires once, the run is recorded, then the worker disarms the entry by writing on.disarmed; once requires number). A close-only pull_request rule accepts the same number/once narrowing. Webhook triggers take an optional `forge` = github (default) | gitlab | forgejo | azure, which also decides which action words pull_request accepts: github is labeled|opened|synchronize|reopened|review_submitted|closed, gitlab is open|update|reopen|approved|close, forgejo is label_updated|opened|synchronized|reopened|closed, azure is created|updated (no close word). The close word rides alone: it cannot be mixed with other actions in one entry. An azure label or comment trigger must also set `repository` (a work item belongs to a project, not a repository), and an azure pull_request trigger may not carry labels[] at all. A github review_submitted trigger may also set reviewState[] (approved|changes_requested|commented) to narrow which verdicts fire; omitted, all three do. For webhook triggers the repo and the task come from the triggering issue/PR event \u2014 set only the match + flow \u2014 and they run under the deployment default model. `backend` (optional, any kind) names WHERE the job's container is built, chosen from the names this deployment blesses in PI_BACKENDS; omitted, the job runs on the deployment default. A name this deployment does not bless is refused here, and refused again before the job spends.",
     executionMode: "sequential",
     parameters: typebox_exports.Object({
       kind: typebox_exports.String(),
@@ -42582,9 +42940,20 @@ function registerTools(pi) {
       once: typebox_exports.Optional(typebox_exports.Boolean()),
       model: typebox_exports.Optional(typebox_exports.String()),
       provider: typebox_exports.Optional(typebox_exports.String()),
-      maxTurns: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 }))
+      maxTurns: typebox_exports.Optional(typebox_exports.Integer({ minimum: 1 })),
+      // #227. WHICH venue this trigger's container is built in. A NAME chosen from what PI_BACKENDS
+      // blessed, never a configuration -- `DES-PER-TRIGGER-JOB-IMAGE` predicted this exact arrival: "If a
+      // future tool ever takes an image parameter, the allowlist arrives with that tool, and this row is
+      // the reason it must." The allowlist is checked in execute, below, because a schema enum would be
+      // frozen at registration while PI_BACKENDS is read per call.
+      backend: typebox_exports.Optional(typebox_exports.String())
     }),
     async execute(_id, params, _signal, _onUpdate, ctx) {
+      const blessed = blessedBackends(process.env);
+      if (params.backend !== void 0) {
+        if (blessed.length === 0) throw new Error("this deployment blesses no backends, so run.backend cannot be set (see PI_BACKENDS)");
+        if (!blessed.includes(params.backend)) throw new Error(`backend '${params.backend}' is not blessed by this deployment (PI_BACKENDS: ${blessed.join(", ")})`);
+      }
       const entry = buildTriggerEntry(params.kind, params);
       if (!entry) throw new Error(`unknown trigger kind '${params.kind}' (cron|label|comment|pull_request|issue)`);
       const result = await confirmedWrite(
@@ -42603,9 +42972,9 @@ ${JSON.stringify(entry)}` },
   pi.registerTool({
     name: "dispatch_trigger_edit",
     label: "pi-dispatch edit trigger",
-    description: "Changes which flow a trigger runs (by array index from dispatch_triggers) and applies it live. The operator MUST approve a confirm dialog showing flow before->after; with no interactive operator it is refused.",
+    description: "Changes which flow a trigger runs (by array index from dispatch_triggers) and applies it live, and optionally which `backend` (venue) its container is built in, chosen from the names PI_BACKENDS blesses. The operator MUST approve a confirm dialog showing the before->after; with no interactive operator it is refused.",
     executionMode: "sequential",
-    parameters: typebox_exports.Object({ index: typebox_exports.Integer({ minimum: 0 }), flow: typebox_exports.String() }),
+    parameters: typebox_exports.Object({ index: typebox_exports.Integer({ minimum: 0 }), flow: typebox_exports.String(), backend: typebox_exports.Optional(typebox_exports.String()) }),
     async execute(_id, params, _signal, _onUpdate, ctx) {
       const paths = resolvePaths(process.env);
       const list = triggerList(paths);
@@ -42613,16 +42982,25 @@ ${JSON.stringify(entry)}` },
       if (!cur) throw new Error(`no trigger at index ${params.index} (have ${list.length})`);
       const flow = params.flow.trim();
       if (!flow) throw new Error("flow must be non-empty");
+      const backend = optStr(params.backend);
+      if (backend !== void 0) {
+        const blessed = blessedBackends(process.env);
+        if (blessed.length === 0) throw new Error("this deployment blesses no backends, so run.backend cannot be set (see PI_BACKENDS)");
+        if (!blessed.includes(backend)) throw new Error(`backend '${backend}' is not blessed by this deployment (PI_BACKENDS: ${blessed.join(", ")})`);
+      }
+      const venue = backend === void 0 ? "" : `, backend: ${cur.backend ?? "-"} -> ${backend}`;
       const result = await confirmedWrite(
         ctx,
-        { title: `Edit trigger #${params.index + 1}`, message: `trigger #${params.index + 1} (${cur.type}) flow: ${cur.flow ?? "-"} -> ${flow}` },
+        { title: `Edit trigger #${params.index + 1}`, message: `trigger #${params.index + 1} (${cur.type}) flow: ${cur.flow ?? "-"} -> ${flow}${venue}` },
         () => {
           const res = writeTriggers({
             triggersPath: paths.triggersPath,
-            mutate: (raw) => raw.map((tr, i) => i === params.index ? { ...tr, run: { ...tr.run, flow } } : tr)
+            // `backend` is merged only when the caller sent one, so an edit that changes just the flow
+            // leaves the entry byte-identical in every other key -- including a venue it already had.
+            mutate: (raw) => raw.map((tr, i) => i === params.index ? { ...tr, run: { ...tr.run, flow, ...backend !== void 0 && { backend } } } : tr)
           });
           if (res.invalid) throw new Error(`rejected: ${res.invalid}`);
-          return { applied: true, index: params.index, flow };
+          return { applied: true, index: params.index, flow, ...backend !== void 0 && { backend } };
         }
       );
       return toolText(JSON.stringify(result));
@@ -42919,6 +43297,13 @@ function triggerList(paths) {
   const t = readTriggers({ triggersPath: paths.triggersPath });
   return Array.isArray(t?.triggers) ? t.triggers : [];
 }
+function blessedBackends(env) {
+  try {
+    return parseBackendList(env.PI_BACKENDS);
+  } catch {
+    return [];
+  }
+}
 function buildTriggerEntry(kind, f) {
   if (kind === "cron") {
     const run = { kind: "local", folder: f.folder, flow: f.flow, task: f.task };
@@ -42928,11 +43313,14 @@ function buildTriggerEntry(kind, f) {
     if (model) run.model = model;
     if (provider) run.provider = provider;
     if (maxTurns !== void 0) run.maxTurns = maxTurns;
+    const backend2 = optStr(f.backend);
+    if (backend2) run.backend = backend2;
     return { on: { type: "cron", id: f.id, pattern: f.pattern }, run };
   }
   const forge = optStr(f.forge) ?? "github";
   const repository = optStr(f.repository);
-  const forgeRun = (rest) => ({ kind: forge, ...rest, ...repository ? { repository } : {} });
+  const backend = optStr(f.backend);
+  const forgeRun = (rest) => ({ kind: forge, ...rest, ...repository ? { repository } : {}, ...backend ? { backend } : {} });
   if (kind === "label") return { on: { type: "label", any: asWords(f.labels ?? f.any) }, run: forgeRun({ flow: f.flow }) };
   if (kind === "comment") return { on: { type: "comment", phrase: f.phrase }, run: forgeRun({ flow: f.flow }) };
   if (kind === "pull_request") {
@@ -42942,7 +43330,7 @@ function buildTriggerEntry(kind, f) {
     const prNumber = optInt(f.number);
     if (prNumber !== void 0) on.number = prNumber;
     if (typeof f.once === "boolean") on.once = f.once;
-    return { on, run: { kind: forge, flow: f.flow } };
+    return { on, run: { kind: forge, flow: f.flow, ...backend ? { backend } : {} } };
   }
   if (kind === "issue") {
     const action = asWords(f.action);
@@ -42950,7 +43338,7 @@ function buildTriggerEntry(kind, f) {
     const number = optInt(f.number);
     if (number !== void 0) on.number = number;
     if (typeof f.once === "boolean") on.once = f.once;
-    return { on, run: { kind: forge, flow: f.flow } };
+    return { on, run: { kind: forge, flow: f.flow, ...backend ? { backend } : {} } };
   }
   return null;
 }
@@ -43809,6 +44197,7 @@ var init_index = __esm({
     init_read_model();
     init_graph_model();
     init_insights_html();
+    init_backends();
     init_open_browser();
     init_budget();
     init_deployment_pointer();
@@ -43865,6 +44254,7 @@ export {
   SUPPORTED_PI_VERSION,
   USED_API,
   _setPiVersionAdvisoryForTests,
+  blessedBackends,
   buildTriggerEntry,
   computePiVersionAdvisory,
   admin as default,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edgehero/pi-dispatch-admin",
-  "version": "1.8.0",
+  "version": "1.10.0",
   "description": "Operator console (a pi extension) + skill for pi-dispatch: run the pi coding agent as a self-hosted service. A /dispatch TUI for the queue, spend caps, run history, editable GitHub, GitLab, Forgejo and Azure DevOps triggers (cron/label/comment/PR/MR/work item), and scheduled pause windows — plus AI-operable, human-confirmed controls. Runs against a live pi-dispatch deployment.",
   "keywords": [
     "pi-package",