With a standalone Francis runtime the actor data lives in the runtime's
store, which Pocket ID cannot reach: the Francis protocol has no backup
or restore operation, and a restore refuses to run while any host is
connected, so a CLI that joined the cluster would block its own restore.
Rather than refusing outright, both commands now cover everything Pocket
ID does own and say plainly what they leave out, pointing at the
runtime's own backup and restore commands for the rest. The export writes
no francis.bin entry, which the import side already tolerates, and the
import refuses an archive that carries one, since restoring only its
Pocket ID half would leave the runtime holding another deployment's actor
state. The import also skips the exclusive-access lease, which lives in
the actor tables of a database this deployment does not use, and warns
that the replicas have to be stopped by hand.
Pocket ID can now authenticate to a standalone runtime with a JWT as well
as a pre-shared key: FRANCIS_HOST_JWT carries the token inline, while
FRANCIS_HOST_JWT_FILE keeps a path that Francis re-reads on every
connection, so a rotated token (a Kubernetes projected service account
token, say) is picked up without a restart. Exactly one bootstrap method
must be configured, which the config validates up front.
The one-time-access-token command works against a standalone runtime
again. It has no actor host of its own, so it joins the cluster as a
client-only host for just long enough to write the token: that hosts no
actor, so the runtime never places one on it, and it disconnects before
the command returns.
FRANCIS_HOST decides where the Francis actor runtime lives. When it is
empty or set to "embedded" (the default) nothing changes: Pocket ID starts
the runtime inside its own process, backed by its own database. Any other
value is the address, or a comma-separated list of addresses, of a
standalone Francis runtime; Pocket ID then connects to it as a remote actor
host and starts no embedded runtime.
Connecting to a standalone runtime also needs FRANCIS_HOST_PSK, the host
bootstrap pre-shared key the runtime is configured with, and optionally
FRANCIS_CA, the PEM-encoded cluster CA to pin before the first connection.
Without a pinned CA Francis trusts the certificate it is served on first
use, and warns about it.
The actor host is now held as the topology-agnostic francis host.Host
interface, since the concrete type depends on the configuration. The
commands that reach the actor data through Pocket ID's own database
(export, import, and one-time-access-token) fail with an explicit error
when a standalone runtime owns that data instead, rather than silently
operating on the wrong store.
