Dynamic-runner pricing is app-asserted (untrusted images can under-report)

[rickstaa]

Problem

Dynamic-runner pricing is app-asserted. The app reports its own price via register_runner(price_per_unit=…) and the orchestrator only checks it is > 0 (normalizeHeartbeat in go-livepeer) — it does not own or verify the price.

You can see this in hello-world/docker-compose.onchain.yml: the price is passed as an app argument and forwarded to register_runner.

This is fine today because images are operator-deployed/trusted, but it breaks down for untrusted workloads — an untrusted image could under-report its price. Static registration avoids it entirely (the operator sets price_info in runners.json directly, the app can't influence it).

Context

• SDK / register_runner price plumbing: Live Runner + Scope support livepeer-python-gateway#20 (branch ja/live-runner)
• Documented as a caveat in go-livepeer doc/live-runner.md (Registration → pricing [!CAUTION])
• Open discussion with @j0sh on which side owns the price (app vs orchestrator)

Directions to evaluate

• SDK auto-reads price from env (e.g. PRICE_PER_UNIT) instead of the app passing it → pricing becomes deployment/operator config, out of app code.
• Orchestrator override — go-livepeer sets the price and ignores the runner-reported value; likely needed anyway once we move to GPU-based pricing (price per GPU type, workloads auto-run at that rate).

TODO

Decide pricing authority for dynamic runners and make the orchestrator authoritative (or otherwise enforce it) before untrusted workloads are supported.

[linear-code]

ENG-165

[j0sh]

Images should be trusted. Do not run untrusted images.