Private version-neutral qualification candidate, not release approval. Preserve existing placement precedence, unify endpoint consumers, add DATA lifetime admission and optional persistent runtime environment under the common launcher. Real container QA and exact independent review remain required before publication.
Fold the base/app split back into a single Dockerfile. The base tag was
never published, so a plain `docker build -t ouroboros-web .` failed on
every fresh machine, and a runtime `UV_PROJECT_ENVIRONMENT` let an agent's
`uv sync` in a task workspace rewrite the runtime venv. What the split was
for stays: the Playwright browsers pinned to the locked version are
installed from an ephemeral uvx tool environment into `/ms-playwright`
above `COPY pyproject.toml uv.lock` (every release rewrites the lock), and
the BuildKit cache mounts keep the uv and apt caches out of the layers
(4.82 GB -> 4.12 GB). The tag-only docker lanes stop forcing
`PLAYWRIGHT_BROWSERS_PATH=0`, which pointed at an empty package tree and
made them download browsers mid-test; the portable path-length test reads
the shipped browser path. The Russian Trusted CA files leave the image:
the next commit gives deployments an owner-side setting instead.
Docs: ARCHITECTURE §8 Docker, README.
Validate lock freshness, preserve the pip runtime capability and N-1 updater bridge, synchronize the uv root version during releases, and align install documentation and regression tests.
Branch `ouroboros` was seeded from an `.app` bundle snapshot
(`6700358 Initial commit from app bundle`), not from `main`, so the
release pipeline (build scripts, PyInstaller spec, launcher runtime,
vendored Python framework, CI workflow) never landed on this branch.
Import those files verbatim from `origin/main` (76bf13c) so a tagged
push can trigger the existing tag-driven release pipeline.
Imported verbatim from `origin/main`:
- .github/workflows/ci.yml Three-tier CI (push -> quick
tests, stable/tag -> full matrix,
v* tag -> build + GitHub Release
with `prerelease: contains(...,
-rc|-alpha|-beta)`).
- build.sh / build_linux.sh / PyInstaller + Playwright Chromium
build_windows.ps1 / Dockerfile bundling for each target (the four
files `tests/test_build_scripts.py`
assertively requires).
- Ouroboros.spec PyInstaller entry spec.
- entitlements.plist macOS codesign entitlements.
- launcher.py Native launcher that bootstraps
the embedded python-standalone
interpreter and runs the agent as
a subprocess.
- scripts/download_python_standalone.sh / .ps1 / pyi_rth_pythonnet.py
- Python, Python.framework/ Vendored macOS launcher-side
Python 3.10 framework.
- certifi/, jsonschema/, Marker + data files consumed by
jsonschema_specifications/ the runtime-loaded agent deps.
Adapted for Phase 1-6:
- Ouroboros.spec datas now contains ('skills', 'skills') so the
bundled Phase 5 weather reference skill under `skills/weather/`
actually ships inside the .app / .exe / tarball. Without this the
Skills page on a packaged build would show "no skills discovered"
even with the bundled reference in source. Docstring updated to
document the new bundled payload.
Verification:
- `pytest tests/test_build_scripts.py tests/test_release_sync.py`
passes locally (47 asserts; all Playwright + PyInstaller ordering
invariants + release-sync carrier logic hold after the import).
- `python -c "import ast; ast.parse(open('Ouroboros.spec').read())"`
parses.
Not imported from main (intentional):
- `.pytest-tmp-run`, pytest-cache dirs, and other transient files.
- No existing file was overwritten by the checkout; the import is
purely additive on top of the Phase 1-6 tree.
