PR: refactor #12: decouple actus to drive telos only

.dockerignore

@@ -0,0 +1,26 @@
+# Local dev-only nested telos checkout; never part of the build context.
+# This directory holds a 1GB+ clone of the separate telos repository and
+# would otherwise be uploaded with every build.
+agents
+
+# Rust build output
+target
+
+# VCS and IDE noise
+.git
+.DS_Store
+*.swp
+
+# Secrets and local environments
+.env
+.env.local
+.env.*.local
+
+# Python caches
+__pycache__
+*.pyc
+
+# Not needed inside the image
+docs
+script
+.github

.github/workflows/ci.yml

@@ -18,18 +18,27 @@ jobs:
 
       - uses: docker/setup-buildx-action@v4
 
-      - name: Build image
+      - name: Build the test image
         run: |
           docker buildx build --load \
+            --target test \
             --cache-from type=gha,scope=shared-actus \
             --cache-to type=gha,mode=min,scope=shared-actus \
             -t actus:ci \
             -f Dockerfile .
 
       - name: Run tests
         run: |
+          # Mock-only policy: the agent is a stub (/bin/true) and the chat
+          # round trip is skipped (ci-skip key plus the LLM_CHAT gate), so
+          # CI never spends LLM tokens. The suite compiles and runs the Rust
+          # unit and integration tests (tests/*.rs) and exercises the HTTP
+          # endpoints; live runs require LLM_CHAT=1 and a real key locally.
+          # Contract E2E against the fake backend runs in the telos CI
+          # workflow.
           docker run --rm \
-            -e ZED_BIN=/bin/true \
+            -e TELOS_BIN=/bin/true \
             -e LLM_API_KEY=ci-skip \
             --entrypoint ./run.sh \
             actus:ci --test
+

.github/workflows/publish-actus-image.yml

@@ -1,14 +1,13 @@
 name: Publish actus Docker Image
 
+# Publishing is release-gated: actus is pre-1.0 and has shipped no release
+# yet, so ordinary main commits push nothing. Pushing a `v*` tag cuts a
+# versioned image (and refreshes `latest`); a manual dispatch publishes a
+# `:dev` snapshot for preflight without touching `latest`.
 on:
-  push:
-    branches: ["main"]
-    paths:
-      - "Dockerfile"
-      - "Cargo.*"
-      - "src/**"
-      - ".github/workflows/publish-actus-image.yml"
   workflow_dispatch:
+  push:
+    tags: ["v*"]
 
 concurrency:
   group: "actus-image"
@@ -19,7 +18,7 @@ env:
   IMAGE_NAME: ssccsorg/actus
 
 permissions:
-  contents: write
+  contents: read
   packages: write
 
 jobs:
@@ -38,12 +37,25 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
+      - name: Derive image tags
+        id: meta
+        run: |
+          if [ "${{ github.event_name }}" = "push" ]; then
+            # Version tag (for example v0.1.0): tag the image with the
+            # version and refresh latest.
+            echo "tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }},${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >>"$GITHUB_OUTPUT"
+          else
+            # Manual dispatch: a dev snapshot that never touches latest.
+            echo "tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:dev" >>"$GITHUB_OUTPUT"
+          fi
+
       - name: Build and push Docker image
         uses: docker/build-push-action@v7
         with:
           context: .
           file: Dockerfile
-          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          target: runtime
+          tags: ${{ steps.meta.outputs.tags }}
           push: true
           cache-from: type=gha,scope=shared-actus
           cache-to: type=gha,mode=min,scope=shared-actus

.gitignore

@@ -9,7 +9,6 @@ node_modules/
 # Python (LightRAG)
 __pycache__/
 
-# Helix fork clone (managed by build.sh)
 *.py[cod]
 *.pyo
 *.egg-info/
@@ -55,5 +54,8 @@ result/
 
 logs
 
-# Pre-compiled binaries (Helix remote_server, etc.)
+# Pre-compiled binaries
 .bin/
+
+# Nested telos agent repo (separate private repository)
+/agents/

Cargo.toml

@@ -2,8 +2,9 @@
 name = "actus"
 version = "0.1.0"
 edition = "2021"
-license = "BUSL-1.1"
+license = "Apache-2.0"
 description = "Agent execution runtime across a shared knowledge space"
+publish = false
 
 [dependencies]
 tokio = { version = "1", features = ["full"] }
@@ -17,13 +18,12 @@ uuid = { version = "1", features = ["v4"] }
 chrono = { version = "0.4", features = ["serde"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json"] }
+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json", "stream"] }
 anyhow = "1.0.102"
 tempfile = "3.27.0"
 dirs = "6.0.0"
 clap = { version = "4", features = ["derive"] }
 async-stream = "0.3.6"
-tokio-stream = "0.1.18"
 walkdir = "2.5.0"
 ignore = "0.4.23"
 mime_guess = "2.0.5"

Dockerfile

@@ -1,39 +1,63 @@
-# ── Zed builder (prebuilt binary from external pipeline) ──────────────
-
-FROM ubuntu:24.04 AS zed-builder
-
-RUN apt-get update && apt-get install -y build-essential curl git \
+# ── Actus ─────────────────────────────────────────────────────────────
+#
+# Targets:
+#   toolchain  system deps + Rust, the source tree, and a warm cargo
+#              registry (cargo fetch is cached until Cargo.lock changes).
+#   release    FROM toolchain: compiles the release binary.
+#   test       FROM toolchain: adds python3, curl, and git for the
+#              run.sh --test suite. The suite compiles and runs the Rust
+#              tests (src unit tests plus the tests/*.rs integration
+#              tests) and exercises the HTTP endpoints against a live
+#              server, so pull requests never pay for a release build.
+#   runtime    default target: the slim image published to ghcr. Holds
+#              only the actus binary plus git (the /v1/git/* endpoints
+#              spawn the git CLI). TLS comes from the bundled rustls/ring
+#              stack; ca-certificates provides the root store.
+#
+# Actus delegates agent execution to the telos process, which is never
+# bundled into any of these images; it is located via TELOS_BIN or the
+# agent config, keeping the Apache-2.0 actus image free of GPL telos.
+
+FROM ubuntu:24.04 AS toolchain
+
+RUN apt-get update && apt-get install -y \
+        build-essential \
+        curl \
     && rm -rf /var/lib/apt/lists/* \
-    && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+    && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+        | sh -s -- -y
 
 ENV PATH="/root/.cargo/bin:${PATH}"
 WORKDIR /workspace
-COPY helix/build.sh helix/patch/ ./helix/
-RUN mkdir -p helix/.bin && bash helix/build.sh --build-only --release
 
-# ── Actus base ────────────────────────────────────────────────────────
+# Warm the registry before the sources are copied so the dependency
+# download layer is only invalidated when Cargo.lock changes.
+COPY Cargo.toml Cargo.lock ./
+RUN cargo fetch --locked
 
-FROM ubuntu:24.04 AS base
+COPY src/ src/
+COPY tests/ tests/
+COPY run.sh runner.py terminal.py ./
 
-RUN apt-get update && apt-get install -y build-essential curl git python3 \
-    && rm -rf /var/lib/apt/lists/* \
-    && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+FROM toolchain AS release
 
-ENV PATH="/root/.cargo/bin:${PATH}"
-WORKDIR /workspace
-COPY Cargo.toml Cargo.lock* ./
-COPY src/ src/
-COPY *.py run.sh ./
-RUN cargo build --release
+RUN cargo build --release --locked
+
+FROM toolchain AS test
 
-ENTRYPOINT ["./target/release/actus"]
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        python3 \
+        curl \
+        git \
+    && rm -rf /var/lib/apt/lists/*
 
-# ── Full integration ─────────────────────────────────────────────────
+FROM ubuntu:24.04 AS runtime
 
-FROM base AS full
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        git \
+        ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
 
-COPY --from=zed-builder /workspace/helix/.bin/ helix/.bin/
-COPY NOTICE.md /
+COPY --from=release /workspace/target/release/actus /usr/local/bin/actus
 
-# Default: lean binary only
-FROM base
+ENTRYPOINT ["/usr/local/bin/actus"]