build(docker): add core application image

docker/core-entrypoint.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+set -eu
+
+case "${1:-server}" in
+  server)
+    shift || true
+    exec node /app/backend/dist/server.js "$@"
+    ;;
+  doctor)
+    shift
+    exec tht doctor "$@"
+    ;;
+  preprocess)
+    shift
+    exec tht preprocess "$@"
+    ;;
+  tht)
+    shift
+    exec tht "$@"
+    ;;
+  *)
+    exec tht "$@"
+    ;;
+esac

docker/core.Dockerfile

@@ -0,0 +1,64 @@
+# syntax=docker/dockerfile:1
+FROM node:22.19.0-bookworm-slim AS node-runtime
+
+RUN npm install --global --ignore-scripts --no-audit --no-fund \
+      @earendil-works/pi-coding-agent@0.80.3 \
+    && pi --version
+
+FROM node:22.19.0-bookworm-slim AS backend-build
+WORKDIR /src/backend
+COPY backend/package.json backend/package-lock.json ./
+RUN npm ci --no-audit --no-fund
+COPY backend/ ./
+RUN npm run build \
+    && npm prune --omit=dev
+
+FROM node:22.19.0-bookworm-slim AS gate-deps
+WORKDIR /src/harness
+COPY harness/package.json harness/package-lock.json ./
+RUN npm ci --no-audit --no-fund
+
+FROM python:3.12-slim-bookworm AS runtime
+
+RUN apt-get update \
+    && apt-get install --yes --no-install-recommends ca-certificates curl \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --create-home --uid 10001 thoth \
+    && mkdir -p /app/backend /app/docker/smoke /data/settings \
+    && chown -R thoth:thoth /data
+
+COPY --from=node-runtime /usr/local/bin/node /usr/local/bin/node
+COPY --from=node-runtime /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -s /usr/local/lib/node_modules/@earendil-works/pi-coding-agent/dist/cli.js /usr/local/bin/pi \
+    && node --version \
+    && pi --version
+
+WORKDIR /app
+COPY harness/ /app/harness/
+COPY --from=gate-deps /src/harness/node_modules /app/harness/node_modules
+RUN python -m venv /opt/venv \
+    && /opt/venv/bin/pip install --no-cache-dir /app/harness
+
+COPY --from=backend-build /src/backend/dist /app/backend/dist
+COPY --from=backend-build /src/backend/node_modules /app/backend/node_modules
+COPY docker/core-entrypoint.sh /app/docker/core-entrypoint.sh
+COPY docker/smoke/core-smoke.sh /app/docker/smoke/core-smoke.sh
+RUN chmod 0555 /app/docker/core-entrypoint.sh /app/docker/smoke/core-smoke.sh \
+    && test ! -e /app/harness/.env \
+    && test ! -d /app/harness/workspaces
+
+ENV PATH="/opt/venv/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \
+    HOST=0.0.0.0 \
+    PORT=8787 \
+    THT_HARNESS_DIR=/app/harness \
+    THT_BIN=/opt/venv/bin/tht \
+    PI_BIN=/usr/local/bin/pi \
+    THT_DATA_ROOT=/data \
+    SETTINGS_FILE=/data/settings/settings.json \
+    HOME=/home/thoth
+
+WORKDIR /app/harness
+EXPOSE 8787
+USER 10001:10001
+ENTRYPOINT ["/app/docker/core-entrypoint.sh"]
+CMD ["server"]

docker/smoke/core-smoke.sh

@@ -0,0 +1,36 @@
+#!/bin/sh
+set -eu
+
+test "$(id -u)" != "0"
+
+node_version="$(node --version)"
+python_version="$(python --version 2>&1)"
+case "$node_version" in
+  v22.19.*|v22.2[0-9].*|v2[3-9].*|v[3-9][0-9].*) ;;
+  *) echo "Node 22.19+ required, found $node_version" >&2; exit 1 ;;
+esac
+case "$python_version" in
+  "Python 3.1"[1-9].*|"Python 3."[2-9][0-9].*) ;;
+  *) echo "Python 3.11+ required, found $python_version" >&2; exit 1 ;;
+esac
+
+tht --help >/dev/null
+pi --version >/dev/null
+
+/app/docker/core-entrypoint.sh server &
+server_pid=$!
+trap 'kill "$server_pid" 2>/dev/null || true; wait "$server_pid" 2>/dev/null || true' EXIT INT TERM
+
+attempt=0
+until curl --fail --silent --show-error http://127.0.0.1:8787/health >/dev/null; do
+  attempt=$((attempt + 1))
+  if [ "$attempt" -ge 30 ]; then
+    echo "backend health check did not become ready" >&2
+    exit 1
+  fi
+  sleep 1
+done
+
+echo "$node_version"
+echo "$python_version"
+echo "core smoke: ok"