FROM python:3.11.9-slim-bookworm@sha256:8fb099199b9f2d70342674bd9dbccd3ed03a258f26bbd1d556822c6dfc60c317 AS runtime

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PYTHONPATH=/app/src

WORKDIR /app
COPY --chown=65532:65532 src/ /app/src/
COPY --chown=65532:65532 contract/ /app/contract/

# Numeric non-root identity avoids requiring an /etc/passwd entry and the
# runtime writes no files, allowing deployment with a read-only rootfs.
USER 65532:65532
ENTRYPOINT ["python", "-m", "decision_model.handoff_cli"]

# Validation contains deterministic synthetic fixtures and stdlib-only package
# tests. It is not the production image and contains no licensed market data.
FROM runtime AS validation
COPY --chown=65532:65532 fixtures/ /app/fixtures/
COPY --chown=65532:65532 verify_handoff.py /app/verify_handoff.py
COPY --chown=65532:65532 tests/test_package_runtime.py /app/tests/test_package_runtime.py
COPY --chown=65532:65532 tests/test_architecture_contract.py /app/tests/test_architecture_contract.py
COPY --chown=65532:65532 tests/test_handoff_v0.py /app/tests/test_handoff_v0.py
COPY --chown=65532:65532 tests/measure_package_runtime.py /app/tests/measure_package_runtime.py

FROM runtime AS production
