Implement Milestone 3: execution core

.env.example

@@ -8,6 +8,16 @@ CORQTY_API_PORT=8080
 CORQTY_WEB_PORT=3000
 DATABASE_URL_OWNER=postgres://corqty_owner:corqty_owner_dev@postgres:5432/corqty
 DATABASE_URL_API=postgres://corqty_api:corqty_api_dev@postgres:5432/corqty
+DATABASE_URL_WORKER=postgres://corqty_worker:corqty_worker_dev@postgres:5432/corqty
+# Node runs that each worker container executes at once.
+CORQTY_WORKER_CAPACITY=4
+# "enabled" lets organization admins turn on the trusted shell executor (api and worker).
+# Shell commands run as the shared worker user and can reach the worker's database
+# credential and other organizations' jobs: enable it only on single-tenant or fully
+# trusted deployments.
+CORQTY_SHELL_EXECUTOR=disabled
+# Run inputs, node inputs and node outputs are limited to 1 MiB each, and logs to 10 MiB
+# per node run. These limits are fixed constants until Milestone 5.
 CORQTY_BIND_ADDRESS=0.0.0.0:8080
 CORQTY_PUBLIC_WEB_URL=http://localhost:3000
 CORQTY_SECURE_COOKIES=false

.github/workflows/ci.yml

@@ -7,7 +7,7 @@ on:
 jobs:
   verify:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 45
     services:
       postgres:
         image: postgres:18-alpine
@@ -53,10 +53,13 @@ jobs:
       - run: pnpm web:test
       - run: pnpm web:build
       - name: Start fresh Compose stack
-        run: docker compose --project-name corqty-ci up --build --wait
+        env:
+          CORQTY_WORKER_CAPACITY: "1"
+          CORQTY_SHELL_EXECUTOR: enabled
+        run: docker compose --project-name corqty-ci up --build --wait --scale worker=3
       - name: Run Compose smoke test
         shell: pwsh
-        run: ./scripts/smoke-foundation.ps1 -ProjectName corqty-ci
+        run: ./scripts/smoke-foundation.ps1 -ProjectName corqty-ci -ExpectedWorkers 3
       - name: Remove Compose stack
         if: always()
         run: docker compose --project-name corqty-ci down --volumes

Cargo.toml

@@ -3,9 +3,14 @@ resolver = "3"
 members = [
   "crates/api",
   "crates/domain",
+  "crates/executor-mock",
+  "crates/executor-shell",
   "crates/migrator",
   "crates/persistence",
+  "crates/plugin-host",
+  "crates/plugin-sdk",
   "crates/test-support",
+  "crates/worker",
 ]
 
 [workspace.package]
@@ -19,14 +24,18 @@ argon2 = "0.5"
 axum = { version = "0.8", features = ["macros"] }
 base64 = "0.22"
 chrono = { version = "0.4", features = ["serde"] }
+futures-util = "0.3"
 getrandom = "0.3"
 jsonschema = { version = "0.60.1", default-features = false }
+nix = { version = "0.31", default-features = false, features = ["signal"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.10"
 sqlx = { version = "0.8", features = ["chrono", "json", "migrate", "postgres", "runtime-tokio-rustls", "uuid"] }
+tempfile = "3"
 thiserror = "2"
-tokio = { version = "1", features = ["macros", "net", "rt-multi-thread", "signal"] }
+tokio = { version = "1", features = ["io-util", "macros", "net", "process", "rt-multi-thread", "signal", "sync", "time"] }
+tokio-util = "0.7"
 tower = { version = "0.5", features = ["util"] }
 tower-http = { version = "0.6", features = ["trace"] }
 tracing = "0.1"