FROM python:3.11-slim AS dependencies

ENV PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    NEEDLE_TELEMETRY=0 \
    DO_NOT_TRACK=1 \
    NEEDLE_INFERENCE_CONCURRENCY=1 \
    NEEDLE_MAX_QUEUE_SIZE=16 \
    NEEDLE_BODY_CONCURRENCY=16 \
    NEEDLE_CONTEXT_BUDGET=2048 \
    NEEDLE_STATE_BYTES=4194304

# Official Python slim already includes CA roots; verify them rather than
# adding a redundant network-dependent apt layer. Never disable TLS validation.
RUN python -c "import ssl; assert ssl.create_default_context().cert_store_stats()['x509_ca'] > 0"

WORKDIR /srv

COPY requirements.txt /srv/requirements.txt
# Optional cloud proxy CA bundle is mounted only for this build step. It is
# never baked into the image and verification remains enabled.
RUN --mount=type=secret,id=cloud_ca \
    if [ -f /run/secrets/cloud_ca ]; then \
      export PIP_CERT=/run/secrets/cloud_ca SSL_CERT_FILE=/run/secrets/cloud_ca; \
    fi; \
    pip install --no-cache-dir -r requirements.txt

# Local CPU regression target, independent of model download availability.
FROM dependencies AS tests
COPY requirements-dev.txt /srv/requirements-dev.txt
RUN --mount=type=secret,id=cloud_ca \
    if [ -f /run/secrets/cloud_ca ]; then export PIP_CERT=/run/secrets/cloud_ca; fi; \
    pip install --no-cache-dir -r requirements-dev.txt
COPY gateway.py models.py registry.py laya.py context_adapter.py decision_policy.py request_limits.py intent_guard.py payload_transport.py native_schema.py headroom_evaluation.py /srv/
COPY tests /srv/tests
COPY benchmarks/intent/development.json /srv/benchmarks/intent/development.json
COPY benchmarks/coverage/development.json /srv/benchmarks/coverage/development.json
COPY pytest.ini /srv/pytest.ini
ENV NEEDLE3_LIB_PATH=/nonexistent/needle3.so HF_HUB_OFFLINE=1
CMD ["python", "-m", "pytest", "-q", "tests"]

FROM dependencies AS runtime

# Bake the Needle 3 engine library and base needle3.cact weights into the
# image at Needle's own default cache-directory convention
# (~/.cache/cactus-needle/v3/<engine-version>/), so `needle.Needle(...)`
# resolves both locally with no network call at container start/restart.
#
# We deliberately do NOT pass an explicit weights= path to Needle() at
# runtime (see gateway.py): cactus-needle==3.0.1 treats any explicit
# `weights=` as a tuned checkpoint and permanently disables the calibrated
# confidence head, which this service's routing policy depends on. Baking
# into the default cache dir keeps both "no network at runtime" and a
# calibrated confidence score. The Dockerfile stays root/HOME=/root for
# the whole build and the running container so this cache path is the
# same one Needle looks up at request time.
RUN --mount=type=secret,id=cloud_ca \
    if [ -f /run/secrets/cloud_ca ]; then \
      export SSL_CERT_FILE=/run/secrets/cloud_ca REQUESTS_CA_BUNDLE=/run/secrets/cloud_ca; \
    fi; \
    NEEDLE_CACHE_DIR="$(python -c 'from needle.agent import fetch; print(fetch.cache_dir(3))')" \
    && mkdir -p "$NEEDLE_CACHE_DIR" \
    && needle fetch --generation 3 \
    && needle download needle3 --generation 3 --out "$NEEDLE_CACHE_DIR"

# HF_HUB_OFFLINE=1 makes a missing/misconfigured cache fail fast at
# startup instead of silently reaching the network.
ENV HF_HUB_OFFLINE=1

# Keep the exact official base assets used for the baseline comparison. An
# upstream asset change fails the build rather than silently changing Needle.
COPY needle-assets.sha256 /srv/needle-assets.sha256
RUN NEEDLE_CACHE_DIR="$(python -c 'from needle.agent import fetch; print(fetch.cache_dir(3))')" \
    && cd "$NEEDLE_CACHE_DIR" \
    && sha256sum --check /srv/needle-assets.sha256

COPY gateway.py models.py registry.py laya.py context_adapter.py decision_policy.py request_limits.py intent_guard.py payload_transport.py native_schema.py start.sh /srv/
RUN chmod +x /srv/start.sh

EXPOSE 7860

ENTRYPOINT ["/srv/start.sh"]