YoVinchen
f4ba5d5342
Some checks failed
verify / verify (push) Has been cancelled
The Stage 1 foundation now proves provider contracts with mocks and validates PostgreSQL/pgvector ingestion, approval binding, retrieval, reranking, and idempotency using only synthetic data. Live Bailian validation remains gated on rotating the exposed key. Constraint: The key shown in chat is compromised and cannot be used or committed Rejected: Mark Stage 1 complete from mock and offline results | real three-model smoke is still required Confidence: high Scope-risk: moderate Reversibility: clean Directive: Do not enable real-data ingestion until Stage 3 cloud approval and outbound manifest controls are enforced end to end Tested: make verify; 41 pytest tests; strict mypy; Ruff; Compose config; pinned image build; empty-volume migration; role denial; two idempotent 20-vector seeds; database restart persistence Not-tested: Live Bailian calls require a newly rotated key; React product UI is not implemented
34 lines
907 B
Docker
34 lines
907 B
Docker
# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
|
|
FROM ghcr.io/astral-sh/uv:0.11.3@sha256:90bbb3c16635e9627f49eec6539f956d70746c409209041800a0280b93152823 AS uv
|
|
|
|
FROM python:3.12-slim-bookworm@sha256:8a7e7cc04fd3e2bd787f7f24e22d5d119aa590d429b50c95dfe12b3abe52f48b AS runtime
|
|
|
|
ENV PYTHONUNBUFFERED=1 \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
UV_COMPILE_BYTECODE=1 \
|
|
UV_LINK_MODE=copy \
|
|
PATH="/app/.venv/bin:$PATH"
|
|
|
|
RUN groupadd --system --gid 10001 app \
|
|
&& useradd --system --uid 10001 --gid app --home-dir /app app
|
|
|
|
COPY --from=uv /uv /uvx /bin/
|
|
|
|
WORKDIR /app
|
|
|
|
COPY pyproject.toml uv.lock ./
|
|
RUN uv sync --frozen --no-dev --no-install-project
|
|
|
|
COPY alembic.ini ./
|
|
COPY migrations ./migrations
|
|
COPY app ./app
|
|
COPY README.md ./
|
|
|
|
RUN uv sync --frozen --no-dev \
|
|
&& chown -R app:app /app
|
|
|
|
USER app
|
|
EXPOSE 8000
|
|
|
|
CMD ["python", "-m", "app.main"]
|