argus-forge 0.1.1__tar.gz

argus_forge-0.1.1/.copier-answers.yml

@@ -0,0 +1,21 @@
+# Managed by Copier — do not edit by hand.
+# Run `copier update` in this repo to pull template changes.
+_commit: 281bd55
+_src_path: /home/smk/argus-pkg-template
+author: smk762
+cli_name: argus-forge
+description: 'Training bridge: turn curated dataset exports into ready-to-run LoRA
+    training configs (kohya_ss / OneTrainer / diffusers)'
+dockerfile: Dockerfile
+github_owner: smk762
+has_cli: true
+has_server: true
+image_name: argus-forge
+package_name: argus_forge
+post_test: uv run --no-sync argus-forge schema --check
+project_name: argus-forge
+python_min: '3.11'
+ruff_pin: 0.15.16
+test_extras: dev,server,cli
+version_build_arg: false
+

argus_forge-0.1.1/.dockerignore

@@ -0,0 +1,38 @@
+# Keep the build context small and hermetic. VCS metadata is intentionally
+# excluded — the Dockerfile passes the version in via SETUPTOOLS_SCM_PRETEND_VERSION
+# (the VERSION build-arg), so hatch-vcs never needs to read git history.
+#
+# NOTE: .dockerignore is NOT .gitignore. Patterns are matched against the whole
+# path with Go filepath.Match and there is no implicit recursion — a bare
+# `__pycache__` excludes only ./__pycache__, so anything that can appear at
+# depth needs an explicit `**/`.
+.git
+.venv
+venv
+.pytest_cache
+.ruff_cache
+.mypy_cache
+**/__pycache__
+**/*.pyc
+.env
+**/.env
+dist
+build
+**/*.egg-info
+**/node_modules
+.claude
+
+# The dataset volume docker-compose.yaml mounts by default
+# (${FORGE_OUTPUT_PATH:-./out}). Curated exports land here, so without this a
+# `docker compose up` followed by a rebuild bakes the whole image tree into a
+# layer — the opposite of the hygiene this file exists for.
+out
+
+# Not needed at runtime: the package is installed into site-packages, and the
+# source tree is only here for `uv pip install .`.
+tests
+schema
+.github
+Makefile
+docker-compose.yaml
+.copier-answers.yml

argus_forge-0.1.1/.env.example

@@ -0,0 +1,32 @@
+# ── Server ───────────────────────────────────────────────────────────
+# Host port for the argus-forge FastAPI server (peer to lens :8100,
+# curator :8101, quarry :8102).
+FORGE_PORT=8103
+
+# Host directory holding the curator's exports. Mounted at /data/out, which is
+# the containment root for every request path: forge refuses an export_dir that
+# does not resolve under it.
+FORGE_OUTPUT_PATH=./out
+
+# ── Demo-safe mode ───────────────────────────────────────────────────
+# 1 = render configs but never train and never write: POST /run is refused with
+# 403 and POST /config is forced to dry-run. Defaults to 1, because the image
+# ships no trainer and the port is published on 0.0.0.0 — a run is real code
+# execution on the host. Set to 0 only on a trusted host with a trainer mounted.
+ARGUS_FORGE_READONLY=1
+
+# ── Browser access ───────────────────────────────────────────────────
+# Comma-separated origins allowed to call the API, *in addition to* the
+# localhost:3000 studio frontend the image's --cors already allows.
+# FORGE_CORS_ORIGINS=https://studio.example.com
+
+# ── Container <-> host paths ─────────────────────────────────────────
+# Rewrite the container paths forge renders into the host paths the trainer
+# will actually open, as container=host (comma-separated for several).
+# Needed when forge runs in this container but the trainer runs on the host.
+# FORGE_PATH_MAP=/data/out=/home/me/argus/out
+
+# ── Version ──────────────────────────────────────────────────────────
+# Stamped into the image and reported by /health. Leave unset for local builds;
+# release images get the tag from CI.
+# FORGE_VERSION=0.1.0

argus_forge-0.1.1/.github/workflows/ci.yml

@@ -0,0 +1,20 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ci:
+    uses: smk762/argus-ci/.github/workflows/python-ci.yml@v1
+    with:
+      ruff-version: "0.15.16"
+      test-extras: "dev,server,cli"
+      post-test: "uv run --no-sync argus-forge schema --check"
+

argus_forge-0.1.1/.github/workflows/release.yml

@@ -0,0 +1,125 @@
+name: Release to PyPI
+
+# Top-level (non-reusable) on purpose: PyPI trusted publishing cannot run inside
+# a reusable workflow. Keep this file in sync across the suite via `copier update`.
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+      - run: uv build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  test-install:
+    runs-on: ubuntu-latest
+    needs: build
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12"]
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+      - name: Install wheel and smoke-test import
+        run: |
+          uv venv --python ${{ matrix.python-version }}
+          uv pip install dist/*.whl
+          uv run --no-sync python -c "import argus_forge; print(f'argus-forge {argus_forge.__version__} OK')"
+
+  publish-testpypi:
+    runs-on: ubuntu-latest
+    needs: test-install
+    environment: testpypi
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  publish-pypi:
+    runs-on: ubuntu-latest
+    # Ordered *after* the TestPyPI rehearsal so its outcome is visible first, but
+    # deliberately not gated on it. A TestPyPI-only fault — a missing trusted
+    # publisher, an index outage — must not silently withhold the real release:
+    # that failure mode shipped argus-proof images for two tags with no wheel on
+    # PyPI, and nothing surfaced it because publish-image is independent.
+    # Only the build + install gate is required; a TestPyPI failure still marks
+    # the whole run failed, so the problem stays loud.
+    needs: [test-install, publish-testpypi]
+    if: "!cancelled() && needs.test-install.result == 'success'"
+    environment: pypi
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+
+  publish-image:
+    runs-on: ubuntu-latest
+    needs: test-install
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/argus-forge
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            # Only a final release moves `latest`. The trigger is `v*`, so
+            # without this guard a `v0.2.0-rc1` tag would silently repoint every
+            # `:latest` user (README quickstart, compose) onto a candidate.
+            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}
+      # The base image has no git, so the version is passed in via build-arg
+      # (SETUPTOOLS_SCM_PRETEND_VERSION) rather than read from .git history.
+      # Derived from the tag itself, not from steps.meta.outputs.version: the
+      # `v*` trigger is broader than semver, and for a non-semver tag both
+      # type=semver entries drop out and that output falls back to the literal
+      # string "latest" — which is not a PEP 440 version and fails the build.
+      - id: version
+        run: echo "value=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          build-args: |
+            VERSION=${{ steps.version.outputs.value }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

argus_forge-0.1.1/.gitignore

@@ -0,0 +1,14 @@
+.venv/
+__pycache__/
+*.pyc
+dist/
+build/
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+# hatch-vcs writes this at build time (version derived from git tags)
+src/argus_forge/_version.py
+# Default dataset volume for docker-compose (${FORGE_OUTPUT_PATH:-./out}) —
+# curated exports, never source.
+/out/
+.env

argus_forge-0.1.1/CHANGELOG.md

@@ -0,0 +1,248 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Removed
+
+- **BREAKING: `argus_forge.jobs` is gone**; the job registry now lives at
+  `argus_forge.server.jobs` (issue #17). `from argus_forge.jobs import Job,
+  JobRegistry` — the import a 0.1.0 consumer would have written — raises
+  `ModuleNotFoundError`. There is no compatibility shim: the module is an
+  in-process implementation detail of the HTTP layer, not part of the wire
+  contract, and 0.1.0 shipped days ago. Update the import path.
+
+### Changed
+
+- **A `/stream` viewer is now a cursor into the job's shared event buffer**
+  rather than a queue of its own (issue #21). The registry retained the same
+  2000-event window *twice* — once in `Job._events`, once per viewer — so N
+  stalled readers pinned N copies of it (~1 MB each) on top of the shared tail.
+  Total retention is now `MAX_BUFFERED_EVENTS` objects regardless of how many
+  viewers are attached; a viewer costs a sequence number and an `asyncio.Event`.
+  - Drop-oldest for a lagging viewer is now a *consequence* of the one shared
+    bound: a cursor that falls behind the window resumes at the oldest retained
+    event. `MAX_SUBSCRIBER_LAG` is gone, and with it the second eviction policy
+    and the backlog/live split in `subscribe()` — a cursor cannot straddle a
+    seam, so "no event dropped or duplicated across it" is structural rather
+    than an invariant a comment had to assert. One behaviour did narrow: a
+    viewer *stalled part-way through its replay* used to be immune to eviction
+    (the replay was a private list copy) and had a second 2000-event channel
+    behind it, so its worst-case tolerance was ~4000 events; it is now the one
+    2000-event window. A viewer that has caught up is unaffected.
+  - `_publish` still never waits on a viewer, so one stalled `/stream` reader
+    cannot apply backpressure to the trainer's stdout. The wire format is
+    unchanged: `GET /run/{id}/stream` emits byte-for-byte what it did.
+  - The `start` event is still retained out-of-band, but keyed on the sequence
+    number it occupied rather than on it being the head of the buffer, and it is
+    injected the moment a cursor is found to be past it. So a viewer whose
+    cursor is *clamped over* `start` — not only one that joined after it rolled
+    off — still learns command/cwd, and a viewer can never be handed it twice.
+  - The registry only ever existed to serve the HTTP layer, so it now lives
+    beside it at `argus_forge.server.jobs`. The fan-out is plain stdlib asyncio
+    again — the `anyio` dependency it briefly took on (and the explicit
+    `anyio>=4` on the `server` extra) is gone, as is the end-of-stream sentinel
+    and its unverifiable `assert isinstance(...)` that `python -O` compiled out.
+    `argus_forge.server` resolves its FastAPI entry points lazily, so the
+    registry imports without dragging in fastapi/starlette/argus-cortex.
+
+### Fixed
+
+- `subscribe()` no longer registers a cursor on a run that has **already
+  finished**. `_finalize` is idempotent, so the sweep that drops half-open
+  `/stream` readers has run for the last time by then and could never drop it —
+  a client that reconnects to a finished run and stalls mid-replay would pin its
+  cursor for as long as the registry retained the job (`MAX_FINISHED_JOBS`).
+  Nothing can publish to such a viewer anyway, so it registers nothing.
+- `MAX_BUFFERED_EVENTS` is validated as `>= 1` at import, replacing the guard
+  that went with `MAX_SUBSCRIBER_LAG`. A zero-length window is a worse mis-tune
+  under a cursor than under a queue: the deque keeps nothing while `_published`
+  runs away from it, so a clamped cursor indexes off the end and `/stream`
+  raises `IndexError` mid-response instead of merely returning an empty body.
+
+### Fixed
+
+- `Job.cancel()` no longer returns early when another cancel is in flight; it
+  waits for it. `JobRegistry.shutdown()` could otherwise report every trainer
+  reaped while a request-side cancel was still inside `runner._terminate`'s
+  SIGTERM→SIGKILL grace, and the loop closing under it left the trainer running
+  detached.
+- `Job.cancel()` no longer swallows a cancellation aimed at *itself*. The blanket
+  `suppress(asyncio.CancelledError)` around `await task` caught the caller's own
+  cancel too, so a shutdown cut short by uvicorn's `timeout_graceful_shutdown`
+  reported success.
+- `subscribe()` finds the retained `start` event by identity on the head of the
+  buffer rather than `in`, which ran `RunEvent.__eq__` across the whole
+  2000-event window — ~2 ms of event-loop time per reconnect, and only on long
+  runs, which is exactly when reconnects happen.
+
+## [0.1.0] - 2026-07-21
+
+First tagged release — the version that publishes `ghcr.io/smk762/argus-forge`
+(issue #15) and can join the suite demo.
+
+### Security
+
+- **Server endpoints now enforce path containment.** `POST /inspect`,
+  `/config` and `/run` require the request's `export_dir` to name a directory
+  under the configured export root (`--export-root`,
+  `ARGUS_FORGE_EXPORT_ROOT`; `FORGE_EXPORT_PATH` is a legacy alias), refusing
+  traversal escapes and refusing outright when the root is unset. Previously
+  any caller could name any absolute path and have a `forge/` tree written into
+  it. Request paths are canonically root-relative; absolute paths are tolerated
+  only when already inside the root (the studio UI echoes back the `export_dir`
+  forge reported). The **CLI stays unconstrained** by design.
+  - Containment is decided on the fully symlink-resolved path, so a symlink out
+    of the root is refused rather than followed — but the path handed to the
+    emitters keeps the caller's spelling, since
+    `manifest.resolve_export_dir` owns that policy and `path_map` prefixes are
+    matched against it. A symlinked root (`/data/out -> /mnt/big/out`) keeps
+    rewriting correctly.
+  - The check runs on the *absolutised* candidate — exactly the path returned
+    and then opened — so "checked" and "used" are always the same file.
+    Resolving the raw candidate instead validated a different one, because
+    `os.path.abspath` cancels `..` lexically while `resolve()` cancels it
+    against the symlink's target: with an in-root `d -> <root>/x/y`, the request
+    `d/../../evil` resolved inside the root (so it passed) yet abspath'd to
+    `<root>/../evil`, and that escaped path was what every endpoint went on to
+    read, write and execute.
+  - The export root itself is not a valid `export_dir`: a blank or `"."` field
+    would otherwise merge every sibling export into one dataset and write a
+    `forge/` tree at the top of the shared volume.
+  - A malformed path is a 400, not an unhandled 500 traceback — including a
+    symlink loop, which `pathlib` reports as `RuntimeError` rather than an
+    `OSError`.
+- **Manifest `abs_path` caption sources are fenced too.** `collect_captions`
+  copies sidecars from beside the *source* images, and `abs_path` is manifest-
+  supplied — as untrusted on a server as the request itself. Without the fence
+  any readable `.txt` on the host was copied into the shared dataset volume and,
+  for trainers that inline captions, echoed back in the `/config` response.
+  Refused sources are reported as a warning. The CLI stays unconstrained.
+- **`--cors` no longer means `allow_origins=["*"]` with credentials**, which
+  made Starlette reflect any origin back and defeated the allow-list entirely.
+  It now allows the localhost dev frontend; `--cors-origin` /
+  `FORGE_CORS_ORIGINS` **add** further origins rather than replacing it, and
+  `--cors-any` is a credential-less wildcard. A literal `"*"` in the allow-list
+  takes the same credential-less path instead of silently becoming origin
+  reflection. Allow-list entries are normalised, so a trailing slash or stray
+  whitespace no longer produces a list that can never match.
+- **Unsafe methods are gated on `Origin`** via the suite's shared
+  `WriteGuard` (`argus_cortex.server`). CORS is not a write boundary: a
+  cross-origin POST with a CORS-safelisted content type gets no preflight, so
+  any page a user visits could drive an unauthenticated LAN server into forging
+  configs or starting a run. Origin absent (curl, CLI, server-to-server), same
+  host:port, or allow-listed passes; anything else is 403. The wildcard grants
+  anonymous reads to everyone while origins the operator named explicitly keep
+  their write grant — the pairing a public demo needs, since every forge
+  endpoint that does anything is a POST.
+- **`PATH` joins the refused `/run` env keys.** The command is the bare name
+  `bash`, so a caller-supplied `PATH` pointing at a directory holding its own
+  `./bash` replaced the forged script entirely — the deny-list's stated purpose
+  ("refuses the env vars that would let a request redirect *what* runs") did not
+  hold without it.
+- `/health` reports `export_root` alongside `training`, and answers even when
+  the configured root cannot be resolved, so a liveness probe never 500s on a
+  misconfigured or hung volume. It reports the root only when it is actually
+  usable: `resolve()` is non-strict, so an unmounted volume (the image run
+  without `-v`, the commonest misconfiguration) used to answer "ok" with a root
+  while every request 400'd on "not a directory". The value is the
+  un-dereferenced spelling `/inspect` also returns, since `path_map` prefixes
+  are matched against it.
+
+### Added
+
+- Manifest-aware LoRA config forging for `kohya` / `onetrainer` / `diffusers`,
+  with hyperparameters seeded from the same selection-insight heuristics the
+  argus-curator `/curate` UI shows.
+- `argus-forge` CLI: `inspect`, `config`, `trainers`, `schema`, `serve`, `run`.
+- FastAPI micro-server on `:8103` (`server` extra): `/health`, `/trainers`,
+  `/inspect`, `/config`, `/run`, `/runs`, `/run/{id}`, `/run/{id}/stream`,
+  `/run/{id}/cancel`.
+- `run` verb: shells out to the forged `train.sh` and streams NDJSON progress
+  (#12), on a job registry so runs outlive the connection (#14).
+- **Demo-safe mode** (#16): `serve --no-run` / `ARGUS_FORGE_READONLY=1` renders
+  configs but never trains and never writes — every `/run` route is refused
+  with 403 (as middleware, so the refusal precedes body validation and covers
+  routes added later), and `POST /config` is forced to `dry_run`. `GET /health`
+  reports `training: enabled|disabled` so a frontend can disable its train
+  affordance up front instead of discovering the refusal by clicking. Required
+  for the public demo, whose host is GPU-less by design (argus-halo#7).
+- Container image published to GHCR on `v*` tags (#15), plus a
+  `docker-compose.yaml` for local runs. **The image itself** defaults to
+  demo-safe mode (`ENV ARGUS_FORGE_READONLY=1`), not just the compose stack: it
+  ships no trainer, and it publishes the port on 0.0.0.0 where a run is real
+  code execution and an unauthenticated `/config` would overwrite the curator's
+  `metadata.jsonl`, so a bare `docker run` has to be as locked down as
+  `docker compose up`.
+- `argus-cortex[server]>=0.2.0` is a `server`-extra dependency, for the suite's
+  shared write-guard and env-flag helpers.
+- `caption_source_root`: the containment root for manifest `abs_path` caption
+  sources. A keyword argument to `forge_config`, deliberately **not** a field on
+  `ForgeRequest` — a security boundary a request could name is one it could
+  widen to `/`. The server passes its export root; the CLI passes `None`
+  (unconstrained — it is the operator's own shell).
+
+### Changed
+
+- The image now takes its version from the `VERSION` build-arg
+  (`SETUPTOOLS_SCM_PRETEND_VERSION`) instead of reading git history, matching
+  argus-curator and argus-quarry. This drops the `git` dependency from the
+  image and lets `.git` leave the build context. The variable is scoped to the
+  install step rather than being an `ENV`, so it neither pollutes the cache key
+  of later layers nor persists into the runtime container.
+- The image is multi-stage and defaults `ARGUS_FORGE_EXPORT_ROOT=/data/out`:
+  `uv` (~64 MB) and the source tree no longer ship, and the published image
+  works from `docker run -v ...:/data/out` alone instead of starting healthy
+  and refusing every request. 534 MB → **211 MB**.
+- `ARGUS_FORGE_READONLY` is read by `create_app` rather than only by the `serve`
+  command, so every ASGI entry point honours it. Being a *protection* flag it
+  fails **safe**: an unrecognised value (`=y`, `=enabled`) warns and keeps the
+  guard on, where `env_flag`'s enable-a-feature default of "off" would have
+  silently enabled training and `/config` writes on a host that is
+  unauthenticated and public by assumption. Still never fatal — under compose's
+  `restart: unless-stopped` a hard exit is a crash loop. Only an explicit
+  `0`/`false`/`no`/`off` allows runs.
+- Added `.dockerignore`. The build context previously carried `.venv` (60 MB),
+  `.git`, and the pytest/ruff caches straight into the image layer. Patterns
+  use `**/` where needed — `.dockerignore` has no implicit recursion — and the
+  compose dataset volume (`./out`) is excluded.
+
+### Fixed
+
+- Install `git` in the Docker image so hatch-vcs could detect the version
+  (#11) — since superseded by the build-arg above.
+- kohya nested subsets, basename-collision caption guard, path remapping, CORS
+  docs, emitter parity CI (#6).
+- manifest 2.0: accept the new version and resolve rows via `exported_path` (#9).
+- Run lifecycle: terminal, bounded, and cancel-safe; a cancel emits a distinct
+  `cancelled` event rather than reading as a failure (#14).
+- Containment and `/health` no longer run blocking `stat`/`realpath` syscalls on
+  the asyncio event loop: the root is resolved once at startup and per-request
+  checks happen inside the existing `asyncio.to_thread` hop, so a slow or hung
+  export volume cannot stall in-flight `/run/{id}/stream` progress streams.
+- `serve`'s startup warnings resolve the same env fallbacks `create_app` does,
+  so `FORGE_CORS_ORIGINS` no longer produces a "CORS is disabled" warning about
+  a server that has CORS enabled.
+- A manifest row whose `abs_path` is empty (or `/`) no longer 500s `POST
+  /config`. Only `exported_path` is validated, so `abs_path` can name no file at
+  all, and `Path("").with_suffix(...)` raised straight through the catch-all. A
+  row with no readable source path simply has no sidecar to collect.
+- Demo-safe `POST /config` now says in `warnings` that it was forced to a dry
+  run, so a caller that asked for a real write learns it did not happen from the
+  body rather than by noticing every file's `path` is null.
+- `--cors-origin` / `FORGE_CORS_ORIGINS` no longer drop the localhost:3000
+  defaults when a bare `--cors` was not also passed. They *add* to the dev
+  frontend (as the README says) rather than replacing it, for the write-guard
+  trust list as well as the CORS allow-list — naming a production origin must
+  not cost you the studio frontend you were already developing against.
+- The release workflow derives the image version from the tag itself rather
+  than `docker/metadata-action`'s `version` output, which falls back to the
+  literal string `latest` for a non-semver `v*` tag; and `latest` is no longer
+  repointed by a prerelease tag.
+
+[Unreleased]: https://github.com/smk762/argus-forge/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/smk762/argus-forge/releases/tag/v0.1.0

argus_forge-0.1.1/Dockerfile

@@ -0,0 +1,54 @@
+# syntax=docker/dockerfile:1
+FROM python:3.11-slim AS builder
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+
+WORKDIR /app
+
+# The base image has no `git`, so hatch-vcs can't derive the version from
+# history — hand it in via the VERSION build arg (the release tag, sans "v").
+# Defaults to 0.0.0+local so a locally built image is distinguishable on
+# /health from a real release rather than claiming to be a plain 0.0.0.
+ARG VERSION=0.0.0+local
+
+COPY . /app
+
+# The version is exported for this RUN only. As an `ENV` it would join the cache
+# key of every layer below it (so a release build, whose VERSION always differs,
+# could never reuse one) and would persist into the runtime image, where the
+# unscoped name would stamp itself onto any setuptools-scm package installed
+# later. hatch-vcs does not read the scoped SETUPTOOLS_SCM_PRETEND_VERSION_FOR_*
+# form, so the unscoped one is the only option — confining it to this
+# instruction is what keeps the blast radius to this install.
+# The cache mount keeps wheel downloads across builds even when this layer runs.
+RUN --mount=type=cache,target=/root/.cache/uv \
+    SETUPTOOLS_SCM_PRETEND_VERSION="${VERSION}" \
+    uv pip install --system ".[server,cli]"
+
+FROM python:3.11-slim
+
+# Only the installed package and its console script — uv (~64 MB of the old
+# single-stage image) is a build tool and never runs here.
+COPY --from=builder /usr/local/lib/python3.11/site-packages /usr/local/lib/python3.11/site-packages
+COPY --from=builder /usr/local/bin/argus-forge /usr/local/bin/argus-forge
+
+# Both docker-compose.yaml and the README's `docker run -v ...:/data/out` use
+# this path. Without a default the published image starts, answers /health with
+# "ok", and then refuses every functional request for want of a root — a
+# healthy-looking service the frontend cannot use.
+ENV ARGUS_FORGE_EXPORT_ROOT=/data/out
+
+# Demo-safe by default: /config renders but never writes, and every /run route is
+# refused with 403. This image ships no trainer — no torch, no sd-scripts — so a
+# run could only ever fail, and the port is published on 0.0.0.0 where a run is
+# real code execution on the host (see runner.py's trust note) and an
+# unauthenticated /config would overwrite the curator's metadata.jsonl. The
+# default therefore has to be the safe one: `docker run` of this image is as
+# locked down as `docker compose up`, and .env.example's "Defaults to 1" is true
+# of the image itself rather than only of the compose file. Set to 0 on a trusted
+# host once a trainer is mounted. See README "Demo-safe mode".
+ENV ARGUS_FORGE_READONLY=1
+
+EXPOSE 8103
+
+CMD ["argus-forge", "serve", "--port", "8103", "--cors"]

argus_forge-0.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 smk762
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

argus_forge-0.1.1/Makefile

@@ -0,0 +1,27 @@
+UV ?= uv
+
+.PHONY: help install lint format test build clean
+
+help:  ## Show this help
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-12s\033[0m %s\n", $$1, $$2}'
+
+install:  ## Create venv and install with test extras
+	$(UV) venv
+	$(UV) pip install -e ".[dev,server,cli]"
+
+lint:  ## Ruff check + format check
+	$(UV)x ruff@0.15.16 check src/ tests/
+	$(UV)x ruff@0.15.16 format --check src/ tests/
+
+format:  ## Ruff autoformat + autofix
+	$(UV)x ruff@0.15.16 format src/ tests/
+	$(UV)x ruff@0.15.16 check --fix src/ tests/
+
+test:  ## Run the test suite
+	$(UV) run --no-sync pytest --tb=short -q
+
+build:  ## Build sdist + wheel
+	$(UV) build
+
+clean:  ## Remove build + cache artifacts
+	rm -rf dist build .venv *.egg-info .pytest_cache .ruff_cache src/argus_forge/_version.py