Rename the import package app to fluksio

A wheel whose top-level module is `app` collides with anything else in a
user's venv, so the package that is about to be published takes the name
it is published under. Only the Python package moves; the repo, the
Docker WORKDIR and the compose project keep theirs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/fluksio/api/routes/workers.py

@@ -0,0 +1,165 @@
+"""Remote workers: how one attaches, and what is attached right now.
+
+A worker dials in rather than being dialled: the GPU box and the engine are
+usually on different networks, and only one of them can be reached. It presents
+a token minted here, says what it can do, and then answers calls on the socket
+it opened.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+from datetime import timedelta
+from typing import Any
+
+from fastapi import APIRouter, Depends, HTTPException, Request, WebSocket
+from fastapi.responses import PlainTextResponse
+from jwt.exceptions import InvalidTokenError
+from pydantic import BaseModel, Field
+
+from fluksio.api.deps import get_current_active_superuser, get_current_user
+from fluksio.core import security
+from fluksio.flow import worker_main
+from fluksio.flow.remote import PROTOCOL, RemoteWorker, RemoteWorkerHub
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix="/workers", tags=["workers"])
+
+#: Long, because a worker is a machine somebody set up once and left running.
+TOKEN_DAYS = 365
+
+
+class WorkerInfo(BaseModel):
+    name: str
+    labels: list[str] = Field(default_factory=list)
+    max_parallel: int = 1
+    in_flight: int = 0
+    attached_at: float = 0.0
+    last_seen: float = 0.0
+    python: str = ""
+    venv_digest: str = ""
+
+
+class TokenRequest(BaseModel):
+    name: str
+
+
+class TokenIssued(BaseModel):
+    name: str
+    token: str
+    expires_days: int = TOKEN_DAYS
+
+
+def _hub(app: Any) -> RemoteWorkerHub:
+    hub: RemoteWorkerHub | None = getattr(app.state, "worker_hub", None)
+    if hub is None:
+        raise HTTPException(status_code=503, detail="Remote workers are not available")
+    return hub
+
+
+@router.get(
+    "", response_model=list[WorkerInfo], dependencies=[Depends(get_current_user)]
+)
+def read_workers(request: Request) -> Any:
+    """What is attached, and how busy it is."""
+    return [
+        WorkerInfo(
+            name=worker.name,
+            labels=sorted(worker.labels),
+            max_parallel=worker.max_parallel,
+            in_flight=worker.in_flight,
+            attached_at=worker.attached_at,
+            last_seen=worker.last_seen,
+            python=str(worker.info.get("python") or ""),
+            venv_digest=str(worker.info.get("venv_digest") or ""),
+        )
+        for worker in _hub(request.app).workers()
+    ]
+
+
+@router.post(
+    "/tokens",
+    response_model=TokenIssued,
+    dependencies=[Depends(get_current_active_superuser)],
+)
+def issue_token(body: TokenRequest) -> Any:
+    """Mint the credential a worker presents when it dials in.
+
+    Shown once. It is signed with the same keypair the agent tokens use, so
+    rotating that key revokes every worker along with them.
+    """
+    token = security.create_worker_token(body.name, timedelta(days=TOKEN_DAYS))
+    return TokenIssued(name=body.name, token=token)
+
+
+@router.get(
+    "/runtime",
+    response_class=PlainTextResponse,
+    dependencies=[Depends(get_current_user)],
+)
+def read_runtime() -> str:
+    """The worker's own code, so a fresh host installs by fetching one file.
+
+    It is the same module the engine's local workers run — deliberately
+    standard library only, and with nothing of the app importable in it.
+    """
+    return worker_main.__file__ and open(worker_main.__file__).read()
+
+
+@router.websocket("/attach")
+async def attach(websocket: WebSocket, token: str = "") -> None:
+    """A worker's connection, for as long as it holds.
+
+    The token goes in the query string for the same reason the dashboard's
+    does: a websocket handshake carries no headers of its own.
+    """
+    try:
+        claims = security.decode_worker_token(token)
+    except InvalidTokenError:
+        await websocket.close(code=1008)
+        return
+
+    await websocket.accept()
+    try:
+        hello = await asyncio.wait_for(websocket.receive_json(), timeout=30)
+    except (TimeoutError, asyncio.TimeoutError, ValueError):
+        await websocket.close(code=1002)
+        return
+
+    if hello.get("op") != "hello" or int(hello.get("protocol", 0)) != PROTOCOL:
+        await websocket.send_json(
+            {"op": "refused", "reason": f"this engine speaks protocol {PROTOCOL}"}
+        )
+        await websocket.close(code=1002)
+        return
+
+    # The token names the worker; what it calls itself is a suggestion, so two
+    # hosts cannot fight over one identity by claiming the same name.
+    name = str(claims.get("sub") or hello.get("name") or "worker")
+    hub = _hub(websocket.app)
+    worker = RemoteWorker(
+        name=name,
+        labels=[str(label) for label in (hello.get("labels") or [])],
+        send=websocket.send_json,
+        loop=asyncio.get_running_loop(),
+        max_parallel=max(1, int(hello.get("max_parallel") or 1)),
+        info={
+            "python": hello.get("python"),
+            "venv_digest": hello.get("venv_digest"),
+        },
+    )
+    hub.attach(worker)
+    await websocket.send_json({"op": "welcome", "protocol": PROTOCOL, "name": name})
+
+    try:
+        while True:
+            message = await websocket.receive_json()
+            worker.deliver(message)
+    except Exception:
+        # Any way this ends is the same thing: the socket is gone, and whatever
+        # was waiting on it has to be told rather than left hanging.
+        logger.info("Worker '%s' disconnected", name)
+    finally:
+        hub.detach(name)