[TASK] Blueprint for compiling blueprints in docker

[drewstone]

Overview

Adding a spec below.

The Blueprint Agent interface will want to remotely host docker containers for compiling code.

[drewstone]

🧠 One-Shot Prompt: Build a Tangle Blueprint for Streaming Remote Rust Builds with P2P WebSocket Output

Design and implement a Tangle Blueprint that compiles full Rust projects submitted by users, and streams build logs and results over WebSocket to the original requestor. The build is executed in an isolated environment and should support full project structures (including workspaces).

The connection to the user is established via P2P session identity, allowing bidirectional communication for logs, result signaling, and future extensibility (e.g., test results, code audit feedback, etc.).

---

🏗️ Project Structure

rust-build-agent/
├── rust-build-agent-bin/
│   ├── src/
│   │   └── main.rs                     # BlueprintRunner, job router, P2P setup
│   └── Cargo.toml
├── rust-build-agent-lib/
│   ├── src/
│   │   ├── lib.rs
│   │   ├── context.rs
│   │   ├── jobs/
│   │   │   ├── compile_project.rs     # Main job handler
│   │   │   ├── test_project.rs        # (Optional) runs `cargo test`
│   │   │   └── lint_project.rs        # (Optional) runs `cargo clippy`
│   │   ├── network/
│   │   │   ├── websocket_dispatcher.rs
│   │   │   ├── peer_session.rs
│   │   │   └── identity.rs
│   │   └── utils/
│   │       ├── sandbox.rs             # Tempdir, process isolation, CPU/mem caps
│   │       ├── zip.rs                 # For unpacking project sources
│   │       └── stream.rs              # Line-by-line stdout streaming
│   └── tests/
│       └── compile_fixture.rs
├── contracts/
│   └── BuildAgentServiceManager.sol   # (Optional) enforces job input format/payment

---

🔩 Blueprint Job: compile_rust_project (JOB_ID_COMPILE)

Inputs (TangleArgs3)

TangleArgs3<
  String,         // zip_uri: HTTPS or IPFS URI to zipped Rust project
  String,         // session_id: UUID string tied to P2P/WebSocket stream
  Optional<String> // build_target (e.g. "release", "check", "clippy")
>

Execution

1. Download and unzip project archive

2. Validate it's a valid Rust crate or workspace

3. Spawn cargo build process in tempdir with resource caps

4. For each line of output from stderr/stdout, send WebSocket message to session ID

5. On success or error:

   • Emit final message { "status": "success" | "error", "duration_ms": 1345 }

   • Include truncated binary hash if successful (sha256sum target/release/*)

WebSocket Message Format

{
  "session_id": "abc123-session",
  "type": "log",
  "line": "Compiling xyz v0.1.0 (/app/xyz)"
}

Final message:

{
  "session_id": "abc123-session",
  "type": "end",
  "status": "success",
  "duration_ms": 1420,
  "binary_hash": "6a1e...f3"
}

---

🌐 WebSocket Transport via Peer Identity

• Each job includes a session_id linked to a P2P/WebSocket stream

• Operator uses RoundBasedNetworkAdapter or libp2p directly to forward messages to client

• Client must already have subscribed via browser/websocket relay infra to session_id

• Operator sends stream:

  • stdout and stderr as they happen

  • end event with final result

  • error event if build panics

---

🏃 Optional Additional Jobs

Job ID	Name	Description
1	test_project	Run cargo test, stream results
2	lint_project	Run cargo clippy or fmt
3	audit_project	Run cargo audit, report vulnerabilities
4	check_project	Run cargo check for syntax validation

Each job shares same pattern:

• Accept zip URI and session ID

• Stream output in real time

• Enforce build time/memory quota

---

🛡️ Isolation & Sandboxing

Use tokio::process::Command with:

• tempdir crate for file isolation

• Resource limits:

  • ulimit for memory and CPU

  • Optional firejail, nsjail, or Docker-lite env for extra security

• Auto-cleanup after job completes

---

🧪 Testing Strategy

Include integration test that:

• Submits a known valid zip_uri

• Spins up a mock WebSocket client for session_id

• Asserts:

  • stdout lines are streamed

  • Compilation completes

  • Final success event sent

• Include one test with failing crate (invalid Rust)

---

🧠 Completion Criteria

This blueprint is complete when:

• It downloads, unpacks, and compiles Rust code from a zip

• It streams logs live over session-specific P2P/WebSocket

• It sends a final event with success/failure and duration

• Optional jobs are structured and modular

• It is safe, isolated, concurrent, and resilient

Build time must be as fast as possible:

• Use release target only if requested

• Cache toolchains if sandbox allows

• Consider parallel job queue for multiple requests

This is a full remote Rust CI agent for the Tangle ecosystem.

[drewstone]

• Each instance is a docker container
• Code lives there and you can edit it remotely (Github codespaces, etc.)