The lab toolchain is a recipe with one knob

Forty students, one compilers course, and a toolchain that must be identical on every machine except when the assignment says otherwise.

The instructor saves a recipe named cc-lab on the course template: app clang, source nix, kind cli, pick first, allowed_overrides ["version"]. Every student container is a copy of that template, so every container carries the recipe.

The lab command POSTs /api/v1/run/recipes/cc-lab/run with no overrides and gets back one shell_command from the pinned source. Week nine needs clang 17: the lab command sends overrides {version: "17"} and gets clang 17. A student who sends overrides {source: "pkgx"} gets 400, invalid overrides, because source is not on the list.

The service never runs the command; the student's terminal does, and the student can read exactly what it was.

The toolchain is a recipe with one knob, and the instructor chose the knob.