no0dles
## What to build Let tasks **and** services declare an optional `resources` block (`cpus`, `memory`), enforced on both container runtimes. **Enforcement-only** for this release. On Docker, translate to host-config CPU (NanoCpus) and memory limits; on Kubernetes, translate to container `resources.requests` and `resources.limits` (request set equal to limit — no split requests/limits form for now). Units follow Kubernetes conventions: CPU as cores or millicores (`2`, `500m`), memory as `Mi`/`Gi`. A local (non-container) task with `resources` must not fail — enforcement is best-effort/none and the value serves only as a scheduling hint (`dry-run`/`explain` should note non-enforcement). Invalid values (unparseable units, requests > limits) are rejected at validation time. `cpus` over host/cluster capacity → warn-and-run, never clamp (on k8s an over-capacity request leaves the pod Pending — k8s's own behavior, surfaced by the existing running-state wait). No `resources` declared → byte-identical behavior to today (additive). Resources do **not** participate in cache identity (ADR-0002). **Out of scope:** Layer-2 resource-aware local scheduling (CPU-budget admission) is deferred — `--concurrency` is unchanged. Do not implement it in this slice. References: `specs/task-resources/spec.md` (US1, US2, FR-001–005, 007, 008; US3/FR-006 explicitly deferred); `docs/adr/0002`. ## Acceptance criteria - [ ] A Docker task with `resources` produces a container whose CPU (NanoCpus) and memory limits match the declaration (SC-001). - [ ] A k8s task/service with `resources` produces a container spec with matching `requests`/`limits` (request = limit) (SC-002). - [ ] The same `resources` block applies to services on both runtimes (US2). - [ ] Units follow k8s conventions (`2`/`500m`, `Mi`/`Gi`); invalid values and requests > limits are rejected at validation time. - [ ] A local non-container task with `resources` does not fail; the value is treated as a hint only. - [ ] `cpus` over capacity warns and runs (no clamp). - [ ] Resources do not enter cache identity (the task id is unchanged by setting them). - [ ] Layer-2 resource-aware scheduling is NOT implemented; `--concurrency` behavior is unchanged. - [ ] A build file with no `resources` behaves identically to the prior version (SC-004). ## Blocked by - None - can start immediately.