# SEAT-isolation runner image (A3 三身份, item 3) — MVP scaffold.
#
# By CONSTRUCTION this image has NO merge-capable GitHub credential and no way to
# reach GitHub write APIs from inside the seat:
#   * NO gh CLI, NO ssh client config, NO .netrc, NO git credential helper, NO
#     Actions runner token — none are installed or copied.
#   * runs as a non-root user.
#   * carries git (for the sanitizer's index-only apply) + procps (seat_preflight
#     enumerates processes to rule out an Actions runner) and the model CLI ONLY.
# The seat PRODUCES a patch to a dedicated FD/tmpfs file; a SEPARATE publisher
# broker process (outside this container) is the only thing that pushes / opens
# the draft PR. See README.md for the honest residual-surface note.
#
# NOTE: this is a scaffold. The `MODEL CLI` line is a placeholder the owner fills
# with the actual pinned model-CLI install; nothing here builds a real image in CI.

FROM python:3.12-slim AS seat-runner

# procps -> `ps` for seat_preflight process enumeration; git -> index-only apply.
# --no-install-recommends keeps the surface minimal. No gh / openssh-client / curl-with-netrc.
RUN apt-get update \
    && apt-get install --no-install-recommends -y git procps \
    && rm -rf /var/lib/apt/lists/*

# ---- MODEL CLI --------------------------------------------------------------
# The "model CLI" is a pure-stdlib convenience client (no anthropic SDK, smaller
# surface). It holds NO ANTHROPIC_API_KEY — the reverse gateway injects the real
# key server-side and is the seat's only egress. SEAT_MODEL_PROXY points at that
# gateway on the per-task --internal network. Do NOT add gh / ssh / any GitHub
# auth here, and NEVER bake ANTHROPIC_API_KEY into the image.
COPY deploy/seat-runner/seat_model_client.py /opt/seat-runner/seat_model_client.py
ENV SEAT_MODEL_PROXY=http://model-gateway:8080
# -----------------------------------------------------------------------------

# Non-root seat user; nologin shell; owns only the app dir.
RUN useradd --create-home --shell /usr/sbin/nologin seat

# Ship the fail-closed preflight + sanitizer mechanism (read-only at runtime).
WORKDIR /opt/seat-runner
COPY scripts/seat_preflight.py scripts/seat_patch_sanitizer.py \
     scripts/merge_discretion_gate.py scripts/vcos_autoloop.py ./scripts/
COPY deploy/seat-runner/entrypoint.sh ./entrypoint.sh
RUN chmod 0555 ./entrypoint.sh ./scripts/*.py

ENV PYTHONPATH=/opt/seat-runner/scripts \
    PATH=/usr/local/bin:/usr/bin:/bin \
    PYTHONDONTWRITEBYTECODE=1

USER seat
# The container is launched --read-only with a tmpfs /workspace (see launch.sh);
# the entrypoint is immutable (mode 0555) and must never push/merge.
ENTRYPOINT ["/opt/seat-runner/entrypoint.sh"]
