mess around with a rust agent version with just rev shell.

plugins/rust-lite-builder/README.md

@@ -0,0 +1,41 @@
+# Rust Lite Builder Plugin
+
+This trusted server-only plugin registers Rust Lite as an agent build provider.
+Select **Rust Lite** from the Builder's **Agent Type** field, choose targets, and
+start the build normally. Output, history, downloads, expiration, rate limits,
+RBAC, and artifact hooks remain owned by the Overlord server.
+
+The resulting client supports authenticated enrollment, TLS identity pinning,
+heartbeat, reconnect behavior, and interactive TTY console sessions. It
+intentionally contains no plugin loader or other remote command handlers.
+
+During compilation the Build page shows estimated overall/target percentages,
+completed Cargo crates, elapsed time, the current compile or link/LTO phase,
+and a rolling ETA. Cargo does not expose exact link progress, so percentages
+and ETA are estimates. Completed target durations are retained in plugin data
+to improve later estimates, and the persistent Cargo target directory makes
+subsequent builds substantially faster.
+
+The **Cargo Jobs** setting defaults to `0`, which leaves parallelism at Cargo's
+host-CPU default. Set a positive number only when the server needs an explicit
+resource cap. The plugin cache is separate from `Overlord-Lite/target`, so the
+first plugin build does not reuse artifacts from a manual source-tree build.
+
+The server host needs Rust 1.88 or newer. Native-host builds work with the
+standard Rust installation. Cross-target builds additionally require the target
+from `rustup target add <triple>` and a compatible linker/toolchain.
+
+The plugin locates `Overlord-Lite` beside the server runtime or under its
+`dist/` directory. Production package scripts copy that source automatically.
+
+Builder releases compile in the selected server URL, agent token, and signed
+build tag. Runtime `OVERLORD_SERVER`, `OVERLORD_AGENT_TOKEN`, and
+`OVERLORD_BUILD_TAG` variables can still override those defaults.
+
+Builds also embed the server's active TLS SPKI pins. This lets Lite clients
+trust the server's generated self-signed certificate without disabling
+certificate verification and protects later HTTPS plugin downloads too.
+
+All provider builds use Cargo's `--release` profile. That profile uses
+`opt-level = "z"`, full LTO, one codegen unit, symbol stripping, and
+`panic = "abort"`.