codecortex-context-engine 0.1.0a1__tar.gz → 0.1.0a5__tar.gz

codecortex_context_engine-0.1.0a5/.gitattributes

@@ -0,0 +1,21 @@
+# Conformance fixtures must reach every checkout byte-for-byte.
+#
+# Without this, Git's autocrlf translation rewrites LF to CRLF on a Windows
+# checkout. That silently breaks two guarantees these fixtures exist to make:
+#
+#   * `tests/fixtures/upstream/` is vendored byte-identical to a pinned
+#     upstream revision, and its SHA-256 is recorded in a provenance manifest.
+#     A rewritten line ending makes the committed file no longer the upstream
+#     file, and the digest check that proves it correctly fails.
+#
+#   * `tests/fixtures/real_index/` holds indexes produced by real indexers from
+#     the source files beside them. Those indexes encode byte offsets computed
+#     over LF text, so rewriting the sources would desynchronise the index from
+#     the code it describes.
+#
+# `-text` disables all end-of-line conversion in both directions.
+tests/fixtures/upstream/** -text
+tests/fixtures/real_index/** -text
+
+# A serialized index is protobuf, not text, in any location.
+*.scip binary

codecortex_context_engine-0.1.0a5/.github/workflows/bootstrap-release.yml

@@ -0,0 +1,36 @@
+name: Bootstrap Release
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - .github/workflows/bootstrap-release.yml
+
+permissions:
+  contents: write
+  actions: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: true
+      - name: Create v0.1.0a5 release tag from validated main
+        shell: bash
+        run: |
+          set -euo pipefail
+          git config user.name "Behnam Jalali"
+          git config user.email "behnamjalalico@gmail.com"
+          if git rev-parse -q --verify refs/tags/v0.1.0a5 >/dev/null; then
+            echo "v0.1.0a5 already exists"
+          else
+            git tag -a v0.1.0a5 -m "CodeCortex Context Engine v0.1.0a5"
+            git push origin refs/tags/v0.1.0a5
+          fi
+      - name: Dispatch release workflow
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh workflow run release.yml --ref main -f tag=v0.1.0a5

codecortex_context_engine-0.1.0a5/.github/workflows/ci.yml

@@ -0,0 +1,134 @@
+name: CI
+
+on:
+  push:
+    branches: [main, stabilization-1-10]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[dev,web]"
+      - run: ruff check .
+      - run: mypy
+      - name: Tests
+        run: |
+          if [ "${{ matrix.python-version }}" = "3.13" ]; then
+            pytest -q --cov=codecortex --cov-report=xml --cov-report=term-missing --cov-fail-under=90
+          else
+            pytest -q
+          fi
+      - name: Upload coverage
+        if: matrix.python-version == '3.13' && !cancelled()
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          use_oidc: true
+          files: ./coverage.xml
+          fail_ci_if_error: false
+
+  invariants:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.13"
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[dev]"
+      - name: Correctness and fault invariants
+        run: >-
+          pytest -q
+          tests/test_invariant_suite.py
+          tests/test_incremental_graph.py
+          tests/test_state_concurrency.py
+          tests/test_mcp_hardening.py
+          tests/test_distributed_security_regressions.py
+          tests/test_distributed_v2.py
+          tests/test_unified_language_pipeline.py
+          tests/test_retrieval_v2.py
+          tests/test_evidence_fusion.py
+          tests/test_evidence_invariants.py
+          tests/test_evidence_acceptance.py
+          tests/test_evidence_security.py
+          tests/test_evidence_surfaces.py
+          tests/test_precision_intelligence.py
+          tests/test_precision_semantics.py
+          tests/test_precision_conformance.py
+          tests/test_real_index_conformance.py
+          tests/test_precision_generator.py
+          tests/test_dependency_intelligence.py
+          tests/test_dependency_contract.py
+          tests/test_structural_intelligence.py
+
+  platform-contracts:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.13"
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[dev,web]"
+      - run: python scripts/check_platform_architecture.py
+      - run: python scripts/check_platform_priorities.py
+      - run: pytest -q tests/test_platform_acceptance.py tests/test_platform_layout.py tests/test_platform_manifest.py tests/test_platform_milestones.py tests/test_platform_governance.py tests/test_platform_dod.py tests/test_api_versioning.py tests/test_api_security_hardening.py tests/test_sdk_client.py
+
+  windows-compat:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.11"
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[dev,web]"
+      - run: ruff check .
+      - run: pytest -q
+      - run: cortex --help
+      - run: cortex version
+
+  package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.13"
+      - run: python scripts/check_readme.py
+      - run: python -m pip install --upgrade pip build twine
+      - run: python -m build
+      - run: python -m twine check dist/*
+      - run: pip install dist/*.whl
+      - run: cortex --help
+      - run: cortex version
+      - run: cortex-remote --help

codecortex_context_engine-0.1.0a5/.github/workflows/dependency-docs-live.yml

@@ -0,0 +1,47 @@
+name: Dependency Docs Live Smoke
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "src/codecortex/dependencies/**"
+      - "tests/test_dependency_live_smoke.py"
+      - ".github/workflows/dependency-docs-live.yml"
+      - "README.md"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  live-documentation:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      CODECORTEX_DEPENDENCY_DOCS_API_KEY: ${{ secrets.CODECORTEX_DEPENDENCY_DOCS_API_KEY }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.13"
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[dev]"
+      - name: Check credential availability
+        id: credential
+        shell: bash
+        run: |
+          if [ -n "${CODECORTEX_DEPENDENCY_DOCS_API_KEY:-}" ]; then
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "available=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Run real documentation smoke tests
+        if: steps.credential.outputs.available == 'true'
+        run: pytest -q tests/test_dependency_live_smoke.py -rs
+      - name: Record credential-gated skip
+        if: steps.credential.outputs.available != 'true'
+        run: |
+          echo "SKIPPED — CODECORTEX_DEPENDENCY_DOCS_API_KEY unavailable" | tee -a "$GITHUB_STEP_SUMMARY"

{codecortex_context_engine-0.1.0a1 → codecortex_context_engine-0.1.0a5}/.github/workflows/live-agent-e2e.yml

@@ -12,6 +12,10 @@ jobs:
   live-agent:
     runs-on: ubuntu-latest
     timeout-minutes: 45
+    env:
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+      GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
     strategy:
       fail-fast: false
       matrix:
@@ -54,14 +58,23 @@ jobs:
         run: |
           ${{ matrix.configure }}
           command -v ${{ matrix.agent }} || true
+      - name: Check live credential availability
+        id: credential
+        shell: bash
+        env:
+          KEY_ENV: ${{ matrix.key_env }}
+        run: |
+          value="${!KEY_ENV:-}"
+          if [ -n "$value" ]; then
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "available=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Run live MCP tool-use check
-        if: ${{ matrix.key_env == 'OPENAI_API_KEY' && secrets.OPENAI_API_KEY != '' || matrix.key_env == 'ANTHROPIC_API_KEY' && secrets.ANTHROPIC_API_KEY != '' || matrix.key_env == 'GEMINI_API_KEY' && secrets.GEMINI_API_KEY != '' }}
+        if: steps.credential.outputs.available == 'true'
         env:
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
           CODECORTEX_SOURCE_ROOT: ${{ github.workspace }}
         run: python scripts/live_agent_e2e.py --agent "${{ matrix.agent }}" --command "${{ matrix.command }}"
       - name: Record credential-gated skip
-        if: ${{ !(matrix.key_env == 'OPENAI_API_KEY' && secrets.OPENAI_API_KEY != '' || matrix.key_env == 'ANTHROPIC_API_KEY' && secrets.ANTHROPIC_API_KEY != '' || matrix.key_env == 'GEMINI_API_KEY' && secrets.GEMINI_API_KEY != '') }}
+        if: steps.credential.outputs.available != 'true'
         run: echo "${{ matrix.agent }} installed/configured; live model call skipped because its API secret is not configured." >> "$GITHUB_STEP_SUMMARY"

codecortex_context_engine-0.1.0a5/.github/workflows/longitudinal-performance.yml

@@ -0,0 +1,62 @@
+name: Longitudinal Performance
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 4 * * 1"
+
+permissions:
+  contents: read
+
+env:
+  HISTORY_DB: .codecortex/performance/history.db
+
+jobs:
+  benchmark-history:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.13"
+          cache: pip
+      - name: Restore longitudinal database
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: .codecortex/performance
+          key: longitudinal-performance-${{ github.repository_id }}-${{ github.run_id }}
+          restore-keys: |
+            longitudinal-performance-${{ github.repository_id }}-
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[dev]"
+      - name: Run reproducible baseline scenario
+        run: >-
+          python scripts/run_production_benchmark.py
+          --scenario vanilla
+          --output benchmarks/production/results.json
+      - name: Append and export history
+        run: >-
+          python scripts/record_performance_history.py
+          --result benchmarks/production/results.json
+          --database "$HISTORY_DB"
+          --output benchmarks/production/performance-history.json
+          --suite production-vanilla
+          --commit "${GITHUB_SHA}"
+      - name: Publish public workflow artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: performance-history-${{ github.run_number }}
+          path: |
+            benchmarks/production/results.json
+            benchmarks/production/performance-history.json
+          if-no-files-found: error
+          retention-days: 90
+      - name: Publish run summary
+        shell: bash
+        run: |
+          echo "## CodeCortex longitudinal performance" >> "$GITHUB_STEP_SUMMARY"
+          echo "Commit: \`${GITHUB_SHA}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "Suite: \`production-vanilla\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "The complete accumulated history is attached as a public workflow artifact." >> "$GITHUB_STEP_SUMMARY"

{codecortex_context_engine-0.1.0a1 → codecortex_context_engine-0.1.0a5}/.github/workflows/release.yml

@@ -35,7 +35,7 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
       - run: python -m pip install --upgrade pip
-      - run: pip install -e ".[dev]"
+      - run: pip install -e ".[dev,web]"
       - run: python scripts/release_check.py --tag "${{ env.RELEASE_TAG }}"
       - run: ruff check .
       - run: pytest -q
@@ -106,10 +106,18 @@ jobs:
         with:
           name: release-assets
           path: dist
-      - name: Create immutable GitHub release
+      - name: Create or update GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release create "${{ env.RELEASE_TAG }}" dist/* --repo "${{ github.repository }}" --verify-tag --generate-notes --title "CodeCortex Context Engine ${{ env.RELEASE_TAG }}"
+        shell: bash
+        run: |
+          set -euo pipefail
+          if gh release view "${{ env.RELEASE_TAG }}" --repo "${{ github.repository }}" >/dev/null 2>&1; then
+            gh release upload "${{ env.RELEASE_TAG }}" dist/* --repo "${{ github.repository }}" --clobber
+            gh release edit "${{ env.RELEASE_TAG }}" --repo "${{ github.repository }}" --title "CodeCortex Context Engine ${{ env.RELEASE_TAG }}"
+          else
+            gh release create "${{ env.RELEASE_TAG }}" dist/* --repo "${{ github.repository }}" --verify-tag --generate-notes --title "CodeCortex Context Engine ${{ env.RELEASE_TAG }}"
+          fi
 
   publish-pypi:
     if: vars.PYPI_PUBLISH_ENABLED == 'true'

codecortex_context_engine-0.1.0a5/.github/workflows/structural-engine.yml

@@ -0,0 +1,61 @@
+name: Structural Engine
+
+# The structural engine is an optional extra. Core CI runs the structural tests
+# against an in-repository stub, so this workflow is the one place the real,
+# version-pinned binary is exercised. No credentials are required.
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - "src/codecortex/structural/**"
+      - "tests/test_structural_intelligence.py"
+      - "tests/fixtures/structural_engine.py"
+      - "pyproject.toml"
+      - ".github/workflows/structural-engine.yml"
+  pull_request:
+    paths:
+      - "src/codecortex/structural/**"
+      - "tests/test_structural_intelligence.py"
+      - "tests/fixtures/structural_engine.py"
+      - "pyproject.toml"
+      - ".github/workflows/structural-engine.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  structural-engine:
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.13"]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[dev,structural]"
+      - name: Confirm the pinned engine is installed
+        run: |
+          ast-grep --version
+          ast-grep --version | grep -qF "$(python -c 'from codecortex.structural.engine import TESTED_ENGINE_VERSION as v; print(v)')"
+      - name: Structural search, preview, and guarded apply
+        run: pytest -q tests/test_structural_intelligence.py tests/test_evidence_benchmark.py
+      - name: Real-binary conformance
+        run: pytest -q tests/test_structural_conformance.py
+      - name: Measured evidence benchmark
+        run: |
+          cortex evidence-benchmark --output benchmarks/evidence.json
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        if: always()
+        with:
+          name: evidence-benchmark-${{ matrix.python-version }}
+          path: benchmarks/evidence.json
+          if-no-files-found: warn

codecortex_context_engine-0.1.0a5/.github/workflows/web-console.yml

@@ -0,0 +1,27 @@
+name: Web Console
+on:
+  push:
+    branches: [main, platform-roadmap-1-47]
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  web:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: web/package.json
+      - run: npm install
+      - run: npm run typecheck
+      - run: npm run build
+      - run: npx playwright install --with-deps chromium
+      - run: npm run test:e2e

{codecortex_context_engine-0.1.0a1 → codecortex_context_engine-0.1.0a5}/.gitignore

@@ -1,11 +1,14 @@
 __pycache__/
 *.py[cod]
 .venv/
+.v/
 venv/
 .env
 .pytest_cache/
 .mypy_cache/
 .ruff_cache/
+.coverage
+coverage.xml
 dist/
 build/
 *.egg-info/

codecortex_context_engine-0.1.0a5/CHANGELOG.md

@@ -0,0 +1,43 @@
+# Changelog
+
+All notable changes to CodeCortex are documented here. The project follows semantic versioning while in alpha; breaking changes may occur before 1.0 and will be called out explicitly.
+
+## Unreleased
+
+### Added
+
+- Revision-pinned isolated graph, semantic-symbol/LSP, and context-optimization backends behind stable CodeCortex contracts.
+- Guarded language-server rename, replace-body, insert-before, and insert-after operations in CLI and MCP.
+- Warm backend MCP session pooling, health caching, failure recovery, and concurrent orchestration.
+- Native Tree-sitter parser provider with conservative fallback.
+- Expanded reproducible real-repository benchmark corpus and live coding-agent E2E harness.
+- Docker Core/Full integration CI.
+- CodeQL, dependency review, Bandit, dependency audit, SBOM generation, and security-boundary tests.
+- Production observability dashboard with traces, graph hotspots, architecture drift, benchmark history, latency, token savings, and PR-risk API.
+- Signed release pipeline with checksums, Sigstore bundles, GitHub provenance attestations, PyPI Trusted Publishing, and GHCR publishing.
+- Unified evidence model with categorical trust tiers, provenance, and a central ranking, deduplication, and conflict policy.
+- Precision code intelligence: exact definition, reference, implementation, and occurrence resolution from a compiler/indexer-grade index, with symbol-identity decomposition, staleness detection, incremental caching, and graph fusion.
+- Dependency intelligence: manifest and lockfile discovery across Python, Node, Rust, Go, JVM, and .NET, separating declared constraints from resolved versions, behind an optional documentation-provider contract.
+- Structural search and guarded structural rewrite with typed matches, captures, expiring previews, content-hash transactions, rollback, post-apply reindexing, and validation.
+- New MCP tools: `cortex_precise_definition`, `cortex_precise_references`, `cortex_precise_implementations`, `cortex_symbol_occurrences`, `cortex_precision_status`, `cortex_dependency_info`, `cortex_dependency_docs`, `cortex_dependency_context`, `cortex_structural_search`, `cortex_rewrite_preview`, and `cortex_rewrite_apply` (mutating surface only).
+- New CLI commands: `definition`, `references`, `implementations`, `precision-status`, `dependency`, `dependency-docs`, `structural-search`, `rewrite-preview`, `rewrite-apply`, and `evidence-benchmark`.
+- Measured heuristic-versus-evidence benchmark cases for duplicate symbol names, resolved dependency versions, and mechanical migrations; unmeasurable strategies are reported as skipped.
+- `docs/EVIDENCE_FUSION.md`, plus provenance records for the integrated protocol and optional dependencies under `docs/provenance/`.
+
+### Changed
+
+- Python distribution identity is now `codecortex-context-engine`; the public brand remains CodeCortex Context Engine and the recommended CLI remains `cortex`.
+- Optional backend processes remain isolated from the Core Python dependency environment and are pinned to exact compatible revisions.
+- Documentation now treats benchmark output as evidence only after reproducible execution; missing metrics are never synthesized.
+- Impact analysis weighs exact relationships above inferred ones and reports the evidence mix; `cortex doctor` reports the state of each optional evidence layer.
+- The context pipeline accepts ranked evidence and keeps the stronger record when two providers point at the same location.
+- The package now ships a `py.typed` marker, so `mypy --strict` runs against the distribution and is green across all source files; it is enforced in CI.
+
+### Security
+
+- Semantic edit paths are constrained to the repository root and reject path traversal, absolute escape, and symlink escape.
+- Security reporting now uses GitHub's private vulnerability-reporting flow.
+- Optional external engines run with an explicit argument vector, a resolved absolute executable, bounded runtime, and bounded output; no shell is ever used and nothing is downloaded implicitly.
+- Dependency documentation is disabled by default, transmits only a library name, resolved version, and question, and reads its API key solely from a configured environment variable; credentials are redacted from diagnostics and never persisted.
+- Structural rewrites require an unexpired preview, re-verify every file's content hash before writing, enforce file/match/byte limits, write atomically, and roll back on partial failure.
+- Structural matches and paths are constrained to the repository root, rejecting traversal, absolute escape, and symlink escape.

codecortex_context_engine-0.1.0a5/Dockerfile

@@ -0,0 +1,43 @@
+# syntax=docker/dockerfile:1.7
+FROM python:3.13-slim@sha256:7ce4b6dfe35e55397b7cda544f8a13f191b7ae28dc5aad71fe664dbc9bc2623f AS base
+ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PIP_DISABLE_PIP_VERSION_CHECK=1 CODECORTEX_BACKEND_HOME=/opt/codecortex/backends CODECORTEX_BACKENDS=builtin
+RUN apt-get update && apt-get install -y --no-install-recommends git build-essential ca-certificates && rm -rf /var/lib/apt/lists/* && python -m pip install --no-cache-dir uv
+WORKDIR /app
+COPY pyproject.toml README.md LICENSE NOTICE ./
+COPY src ./src
+RUN python -m pip install --no-cache-dir .
+
+FROM base AS core
+RUN useradd --create-home --uid 10001 cortex && mkdir -p /workspace /opt/codecortex/backends && chown -R cortex:cortex /workspace /opt/codecortex/backends
+USER cortex
+WORKDIR /workspace
+ENTRYPOINT ["cortex"]
+CMD ["--help"]
+
+FROM base AS full
+RUN python -m pip install --no-cache-dir ".[semantic,parsers]" && useradd --create-home --uid 10001 cortex && mkdir -p /workspace /opt/codecortex/backends && chown -R cortex:cortex /workspace /opt/codecortex/backends
+USER cortex
+WORKDIR /workspace
+ENTRYPOINT ["cortex"]
+CMD ["--help"]
+
+FROM base AS api
+RUN python -m pip install --no-cache-dir ".[web,parsers]" && useradd --create-home --uid 10001 cortex && mkdir -p /workspace /var/lib/codecortex /opt/codecortex/backends && chown -R cortex:cortex /workspace /var/lib/codecortex /opt/codecortex/backends
+USER cortex
+WORKDIR /workspace
+EXPOSE 7340
+ENTRYPOINT ["cortex-api"]
+CMD ["--host", "0.0.0.0", "--port", "7340", "--state-dir", "/var/lib/codecortex"]
+
+FROM node:22-alpine AS web-build
+WORKDIR /web
+COPY web/package.json ./
+RUN npm install
+COPY web ./
+RUN npm run build
+
+FROM nginx:1.27-alpine AS console
+COPY deploy/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=web-build /web/dist /usr/share/nginx/html
+EXPOSE 8080
+HEALTHCHECK --interval=15s --timeout=3s --retries=5 CMD wget -q -O /dev/null http://127.0.0.1:8080/ || exit 1