# check=skip=FromPlatformFlagConstDisallowed
# ^ The --platform=linux/amd64 pins below are DELIBERATE (Exoscale SKS
#   nodes are amd64). BuildKit lints a constant --platform as a smell;
#   here it is the fix. Silenced so a real warning is not lost in noise.
# Shorashim Korban Processor — Python offering protocol
# Construction spec §1.1: Python 3.12.2
# Processes korbanot (model outputs) through the offering protocol
#
# PLATFORM PIN: see Dockerfile.vav_pipeline for the rationale.
# Exoscale SKS = amd64; arm64 images cannot exec on the cluster.
#
# AZAZEL CO-RESIDENT:
# Per BUILD_AZAZEL.md, azazel_processor (the disposal channel) is
# imported by korban_processor.external_offering and runs in the
# same Python process. It is NOT a separate container — the two-goat
# architecture (Vayikra 16:8) requires equal-capacity disposal in
# the SAME pool. Both sources are baked into this image.

FROM --platform=linux/amd64 python:3.12.2-slim AS build

WORKDIR /app


# Copy korban_processor
COPY korban_processor/pyproject.toml ./
COPY korban_processor/src/ src/
COPY korban_processor/test/ test/

# Copy azazel_processor source — imported by korban_processor.external_offering
COPY azazel_processor/src/azazel_processor/ src/azazel_processor/

# Install dependencies FROM THE LOCK FILE (Construction §1.1).
# Until 2026-10-04 this line named three packages by hand and let pip
# choose every transitive one on the day of the build; and an unpinned
# `pip install poetry-core` rode along into the image. The lock's main
# group is rendered to hashed requirements and installed exactly:
# --require-hashes refuses anything the lock did not record, --no-deps
# refuses anything the lock did not list.
COPY korban_processor/poetry.lock ./
COPY scripts/lock_to_requirements.py /tmp/lock_to_requirements.py
RUN python /tmp/lock_to_requirements.py poetry.lock > /tmp/requirements.txt && \
    pip install --no-cache-dir --require-hashes --no-deps -r /tmp/requirements.txt && \
    pip check

# === RUNTIME STAGE ===
FROM --platform=linux/amd64 python:3.12.2-slim

RUN useradd --create-home --shell /bin/bash shorashim
USER shorashim

WORKDIR /home/shorashim/korban_processor

COPY --from=build --chown=shorashim:shorashim /app/ ./
COPY --from=build /usr/local/lib/python3.12/site-packages/ /usr/local/lib/python3.12/site-packages/

# PYTHONPATH puts korban_processor first; azazel_processor is a
# sibling package under the same src/ tree (see build stage above).
ENV PYTHONPATH=/home/shorashim/korban_processor/src

# L1 Torah filesystem — baked into the image
COPY --chown=shorashim:shorashim l1/ /mnt/torah/

ENV L1_MOUNT_POINT=/mnt/torah

# The korban processor is invoked by the vav_pipeline
# In Phase 5, it will also expose an HTTP endpoint for external model integration
CMD ["python", "-m", "korban_processor"]