continuo-python-runtime 0.4.0__tar.gz → 0.5.0__tar.gz

{continuo_python_runtime-0.4.0 → continuo_python_runtime-0.5.0}/.github/workflows/ci.yml

@@ -6,7 +6,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
       - name: Sync
         run: uv sync --all-packages --all-groups
@@ -19,9 +19,9 @@ jobs:
       - name: Types (contract)
         run: uv run mypy contract/continuo_engine_contract
       - name: Types (postgres adapter)
-        run: uv run --package continuo-python-runtime-postgres mypy adapters/postgres/continuo_python_runtime_postgres
+        run: uv run --package continuo-postgres-adapter mypy adapters/postgres/continuo_postgres_adapter
       - name: Types (trino adapter)
-        run: uv run --package continuo-python-runtime-trino mypy adapters/trino/continuo_python_runtime_trino
+        run: uv run --package continuo-trino-adapter mypy adapters/trino/continuo_trino_adapter
       # `-m "not image"` deselects tests/test_image_smoke_validation.py, which
       # needs a built engine image and the env naming it. Those tests run in
       # images.yml's smoke jobs, where an image actually exists. `and not
@@ -41,7 +41,7 @@ jobs:
   integration-postgres:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
       - run: uv sync --all-packages --all-groups
       - name: Start postgres stack
@@ -55,7 +55,7 @@ jobs:
   integration-trino:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: astral-sh/setup-uv@v7
       - run: uv sync --all-packages --all-groups
       - name: Start trino stack

{continuo_python_runtime-0.4.0 → continuo_python_runtime-0.5.0}/.github/workflows/dco.yml

@@ -14,7 +14,7 @@ jobs:
   dco:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # The whole PR commit range has to be walkable, not just the merge commit.
           fetch-depth: 0

{continuo_python_runtime-0.4.0 → continuo_python_runtime-0.5.0}/.github/workflows/images.yml

@@ -20,12 +20,15 @@ jobs:
         engine: [postgres, trino]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+      - name: Build wheels into a wheelhouse
+        run: uv build --all-packages -o wheelhouse
       - name: Build ${{ matrix.engine }} image
-        run: docker build -f Dockerfile.${{ matrix.engine }} -t cpr-smoke-${{ matrix.engine }} .
+        run: docker build -f Dockerfile.${{ matrix.engine }} --build-arg WHEEL_SOURCE=wheelhouse -t cpr-smoke-${{ matrix.engine }} .
       - name: Save image
         run: docker save cpr-smoke-${{ matrix.engine }} -o /tmp/cpr-smoke-${{ matrix.engine }}.tar
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: cpr-smoke-${{ matrix.engine }}-image
           path: /tmp/cpr-smoke-${{ matrix.engine }}.tar
@@ -49,8 +52,8 @@ jobs:
           --health-timeout 5s
           --health-retries 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cpr-smoke-postgres-image
           path: /tmp
@@ -104,8 +107,8 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: cpr-smoke-trino-image
           path: /tmp
@@ -153,21 +156,31 @@ jobs:
         if: always()
         run: docker compose -f tests/smoke/trino-stack/docker-compose.yml down -v
 
-  # On tag push: build both engine images for linux/amd64 and linux/arm64 and
-  # push them to ghcr.io/<owner>/continuo-python-runtime-<engine>:<tag>. The
-  # engine belongs in the image NAME, not the tag: Continuo's Helm chart pins an
-  # image as `<name>:vX.Y.Z@sha256:<digest>`, so the tag must be the bare
+  # Runs on this same tag push, after the smoke jobs above pass. It builds both
+  # engine images for linux/amd64 and linux/arm64 installing the pinned
+  # versions FROM PyPI (WHEEL_SOURCE=pypi, the Dockerfile default), then
+  # pushes them to ghcr.io/<owner>/continuo-python-runtime-<engine>:<tag>. The
+  # engine belongs in the image NAME, not the tag: Continuo's Helm chart pins
+  # an image as `<name>:vX.Y.Z@sha256:<digest>`, so the tag must be the bare
   # version. Both platforms are required: domain repos build their own images
   # FROM these, and Continuo's e2e runs them in a kind cluster on aarch64
-  # developer machines as well as on amd64 CI runners, so a single-arch publish
-  # is unusable off amd64. The smoke jobs above stay single-arch — they load a
-  # `docker save` tarball, which has no multi-platform equivalent.
-  # continuo-engine-contract and the two engine adapters are installed from the
-  # build context (see Dockerfile.postgres / Dockerfile.trino) — nothing pending
-  # here.
+  # developer machines as well as on amd64 CI runners, so a single-arch
+  # publish is unusable off amd64. The smoke jobs above stay single-arch —
+  # they load a `docker save` tarball, which has no multi-platform
+  # equivalent.
+  #
+  # publish-pypi.yml runs in parallel on this same tag push, not before this
+  # job: there is no cross-workflow `needs:`, so this job cannot wait on that
+  # workflow directly. Instead the wait-until-installable step below polls
+  # PyPI until the pinned versions this tag just published are actually
+  # installable, which is what orders this build after publish-pypi.yml
+  # completes without a cross-workflow dependency.
+  # -test tags publish to TestPyPI only (see publish-pypi.yml), so this job
+  # skips them: there is no real-PyPI installable version to build an image
+  # from for those.
   publish:
-    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-test')
     needs: [smoke-postgres, smoke-trino]
+    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-test')
     strategy:
       matrix:
         engine: [postgres, trino]
@@ -176,8 +189,8 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-qemu-action@v3
+      - uses: actions/checkout@v7
+      - uses: docker/setup-qemu-action@v4
       - uses: docker/setup-buildx-action@v4
       - name: Log in to ghcr.io
         uses: docker/login-action@v4
@@ -185,6 +198,26 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+      # The pinned distributions declare Requires-Python >= 3.14, so the
+      # availability probe must resolve them under a 3.14 interpreter — the
+      # runner's default python is older and pip would reject them even after
+      # they are published, spinning out every retry. (The image build itself
+      # installs inside python:3.14-slim, so it is unaffected; this is only for
+      # the host-side probe below.)
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.14'
+      - name: Wait until the pinned versions are installable from PyPI
+        run: |
+          set -eu
+          req="image-requirements-${{ matrix.engine }}.txt"
+          for i in $(seq 1 30); do
+            if python -m pip download --dest /tmp/probe -r "$req" >/tmp/probe.log 2>&1; then
+              echo "installable"; exit 0
+            fi
+            echo "attempt $i: not yet on index; sleeping"; sleep 20
+          done
+          echo "pinned versions never became installable"; cat /tmp/probe.log; exit 1
       - name: Build and push ${{ matrix.engine }} image
         uses: docker/build-push-action@v7
         with:

continuo_python_runtime-0.5.0/.github/workflows/publish-pypi.yml

@@ -0,0 +1,99 @@
+name: publish-pypi
+
+# Publishes all four PyPI distributions this repo owns — continuo-python-runtime
+# (the harness), continuo-engine-contract (the port, result-block format, and
+# shared guards), and the two engine adapters (continuo-postgres-adapter,
+# continuo-trino-adapter) — via PyPI Trusted Publishing (OIDC, no stored
+# token). They publish together on a single v* tag, each at its own
+# pyproject version, so a tag that only bumps the runtime still carries an
+# unchanged adapter version along for the ride; skip-existing (below) makes
+# that a no-op rather than a duplicate-upload failure. A release-time guard
+# (scripts/check_version_bumps.py) refuses a tag that changed a package's
+# source without bumping its version, so skip-existing can never silently
+# ship stale adapter code under an unchanged version number.
+#
+# Tag glob note: `v*` is the repository's single release pattern — the same tag
+# that images.yml builds and pushes both engine images from, so one tag ships
+# the whole release. GitHub Actions tag globs anchor at character 1, so `v*`
+# claims every tag beginning with "v"; no other pattern may be introduced.
+# Tag `v<ver>-test<n>` publishes to TestPyPI; `v<ver>` publishes to real PyPI.
+# The GitHub environment name is what the PyPI "pending publisher" is
+# registered against — all four project names need one on each index.
+#
+# All four distributions are built into a single `dist/` and uploaded in one
+# publish call, so there is no ordering constraint between them. The runtime
+# wheel declares continuo-engine-contract as a dependency and resolves it from
+# the index at install time ([tool.uv.sources] is dev-only and is not embedded
+# in the wheel).
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions: {}
+
+jobs:
+  publish-packages:
+    if: startsWith(github.ref_name, 'v')
+    runs-on: ubuntu-latest
+    environment: ${{ contains(github.ref_name, '-test') && 'testpypi' || 'pypi' }}
+    permissions:
+      id-token: write # OIDC token for Trusted Publishing
+      contents: read # actions/checkout needs read access to the repo
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@v7
+      - name: Refuse a tag that changed a package without bumping its version
+        run: python scripts/check_version_bumps.py
+      - name: Test before publishing
+        # Gate all four published projects, including both adapter suites — an
+        # adapter regression must block its own immutable PyPI upload, and
+        # images.yml runs in parallel so its smoke failure cannot. Each suite is
+        # a SEPARATE pytest invocation: every workspace member's tests/ is its
+        # own `tests` package (with __init__.py + conftest.py), so running two
+        # of them in one process collides on the `tests.conftest` module name
+        # (see the [tool.pytest.ini_options] note in pyproject.toml). `not image
+        # and not integration` deselects the tests needing a built engine image
+        # or a live warehouse (images.yml / the smoke jobs cover those). The
+        # step's default `set -e` fails the gate if any invocation fails.
+        run: |
+          uv sync --all-packages --all-groups
+          uv run pytest tests contract/tests -m "not image and not integration" -q
+          uv run pytest adapters/postgres/tests -m "not image and not integration" -q
+          uv run pytest adapters/trino/tests -m "not image and not integration" -q
+      - name: Build the contract sdist + wheel
+        run: uv build --package continuo-engine-contract -o dist
+      - name: Build the runtime sdist + wheel
+        run: uv build -o dist
+      - name: Build the postgres adapter sdist + wheel
+        run: uv build --package continuo-postgres-adapter -o dist
+      - name: Build the trino adapter sdist + wheel
+        run: uv build --package continuo-trino-adapter -o dist
+      # Adapters change rarely, so most v* tags carry an unchanged adapter
+      # version alongside a bumped runtime/contract version. Without
+      # skip-existing, re-uploading that unchanged version 400s and fails the
+      # whole publish. Trade-off: a changed package published without a
+      # version bump is then silently skipped too — the
+      # check_version_bumps.py guard above is what catches that case, before
+      # this job's build/publish steps ever run.
+      - name: Publish to TestPyPI
+        if: contains(github.ref_name, '-test')
+        # Pinned to a commit SHA. release/v1 is a moving branch, and this job
+        # holds id-token: write for PyPI Trusted Publishing — a compromised
+        # revision could mint a token and publish under this project's name.
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          packages-dir: dist
+          skip-existing: true
+      - name: Publish to PyPI
+        if: ${{ !contains(github.ref_name, '-test') }}
+        # Pinned to a commit SHA. release/v1 is a moving branch, and this job
+        # holds id-token: write for PyPI Trusted Publishing — a compromised
+        # revision could mint a token and publish under this project's name.
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        with:
+          packages-dir: dist
+          skip-existing: true

{continuo_python_runtime-0.4.0 → continuo_python_runtime-0.5.0}/.github/workflows/release.yml

@@ -53,7 +53,7 @@ jobs:
       # other source of the repo's files. Its absence went unnoticed through
       # review because this job only triggers on push:tags, never on
       # pull_request, so no PR's CI ever actually executes it.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Wait for publish-pypi.yml and images.yml to finish on this commit
         run: |

{continuo_python_runtime-0.4.0 → continuo_python_runtime-0.5.0}/.github/workflows/security.yml

@@ -47,7 +47,7 @@ jobs:
       # range (below), and this repository is small enough (a few hundred KB,
       # well under a second to scan) that fetch-depth: 0 costs nothing on every
       # trigger rather than only on the schedule.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -96,7 +96,7 @@ jobs:
       - name: Upload SARIF to code scanning
         if: always()
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: sarif/
           category: gitleaks
@@ -106,7 +106,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Advisory: reports HIGH/CRITICAL and always exits 0. Base-image and
       # transitive CVEs are often unfixable upstream, so gating on them would
@@ -124,7 +124,7 @@ jobs:
       - name: Upload SARIF to code scanning
         if: always()
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: sarif/
           category: trivy-fs

{continuo_python_runtime-0.4.0 → continuo_python_runtime-0.5.0}/.gitignore

@@ -4,6 +4,7 @@ __pycache__/
 .venv/
 dist/
 .superpowers/
+docs/superpowers/
 .pytest_cache/
 .mypy_cache/
 .ruff_cache/

{continuo_python_runtime-0.4.0 → continuo_python_runtime-0.5.0}/CHANGELOG.md

@@ -5,6 +5,52 @@ follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-09-09
+
+### Added
+
+- `check_binds` validation op: EXPLAINs a dbt test's compiled SQL against the
+  candidate schema and creates nothing, so a test that names a dropped or
+  renamed column fails. Reads the SQL from `CANDIDATE_SQL_URI`, like
+  `build_from_sql`.
+
+### Changed
+
+- `continuo-postgres-adapter` and `continuo-trino-adapter` 0.2.0 → 0.2.1.
+
+## [0.4.1] - 2026-08-25
+
+### Added
+
+- Bring-your-own engine adapters: `continuo-postgres-adapter` and
+  `continuo-trino-adapter` are separate installable packages, so an install
+  can supply its own engine adapter independently of the runtime.
+- `scripts/check_version_bumps.py`: fails a release when a package's source
+  changed since the last tag but its version did not.
+
+### Changed
+
+- Deterministic python-node container builds: pinned per-engine
+  image-requirements and hashed template Dockerfiles.
+- `continuo-engine-contract` 0.7.2 → 0.7.3.
+
+## [0.4.0] - 2026-08-21
+
+### Added
+
+- `python-csv` node kind: a contract-only CSV loader (no user script) that
+  materializes the declared table from the contract's CSV URI, with a
+  validation header check.
+
+### Changed
+
+- `continuo-engine-contract` 0.7.1 → 0.7.2.
+
+### Fixed
+
+- `release.yml`'s github-release job now checks out the repository; without the
+  checkout it could not read the tag's files.
+
 ## [0.3.1] - 2026-08-21
 
 ### Added

continuo_python_runtime-0.5.0/CLAUDE.md

@@ -0,0 +1,37 @@
+# continuo-python-runtime
+
+The validation/execution runtime that continuo's executor runs as a Kubernetes
+Job. Python 3.12, uv workspace: the runtime (`continuo_python_runtime`), the
+engine contract (`contract/`), and the engine adapters (`adapters/postgres`,
+`adapters/trino`).
+
+## CHANGELOG is not optional
+
+Every user-facing change keeps `CHANGELOG.md` current. Two steps, both required:
+
+- **On every PR** that changes behavior, the CLI/op surface, a package version,
+  or a container: add a bullet under `## [Unreleased]` (Keep a Changelog style —
+  Added / Changed / Fixed / Removed). No entry, no merge.
+- **On every release**: rename `## [Unreleased]` to `## [X.Y.Z] - YYYY-MM-DD`,
+  add a fresh empty `## [Unreleased]` above it, and tag. `release.yml` reads the
+  section matching the pushed tag for the GitHub Release notes, so a release with
+  no matching section ships with generic auto-notes and the changelog silently
+  loses that version.
+
+If the changelog is missing a shipped version, backfill it from that tag's
+merged PRs before adding anything new.
+
+## Releasing
+
+A release is one `chore(release):` commit that bumps versions and updates the
+changelog, then a `vX.Y.Z` tag on it. Bump the version of every package whose
+source changed since the last tag — `scripts/check_version_bumps.py` fails the
+PyPI publish otherwise. The tag builds and publishes the `-postgres` / `-trino`
+images and the PyPI packages. See `CONTRIBUTING.md` for the full steps.
+
+## Conventions
+
+- Standard `logging` for diagnostics, never `print` — except the CLI's
+  sentinel-framed result blocks, which own stdout.
+- In-repo packages are pinned exactly, not with ranges (see `pyproject.toml`).
+- Commits are signed off (`git commit -s`); CI enforces the DCO.

{continuo_python_runtime-0.4.0 → continuo_python_runtime-0.5.0}/CONTRIBUTING.md

@@ -57,8 +57,8 @@ uv run ruff check .
 uv run ruff check contract
 uv run mypy continuo_python_runtime
 uv run mypy contract/continuo_engine_contract
-uv run --package continuo-python-runtime-postgres mypy adapters/postgres/continuo_python_runtime_postgres
-uv run --package continuo-python-runtime-trino mypy adapters/trino/continuo_python_runtime_trino
+uv run --package continuo-postgres-adapter mypy adapters/postgres/continuo_postgres_adapter
+uv run --package continuo-trino-adapter mypy adapters/trino/continuo_trino_adapter
 uv run pytest --cov=continuo_python_runtime -m "not image and not integration" -v
 uv run pytest tests/test_csv_readers_integration.py tests/test_validation_runner.py -m integration -v
 uv run pytest contract/tests -v

continuo_python_runtime-0.5.0/Dockerfile.postgres

@@ -0,0 +1,56 @@
+FROM python:3.14-slim
+# One dual-role image per engine — the python-node runtime harness (default
+# command `run`) and the blue/green validation runner (`validation-op`). It
+# installs the PUBLISHED, versioned libraries, never the repo source:
+#   WHEEL_SOURCE=pypi       (release) installs the pins from PyPI. PyPI versions
+#                           are immutable and the image is consumed
+#                           digest-pinned, so no hash lock is needed here.
+#   WHEEL_SOURCE=wheelhouse (CI/PR)   installs the same pins from ./wheelhouse
+#                           (built by CI) so an unreleased change is testable.
+# The wheelhouse holds only this repo's own first-party wheels (built via
+# `uv build --all-packages`); third-party dependencies always resolve from
+# PyPI in both branches, so the wheelhouse branch never passes --no-index to
+# the requirements install below.
+# The pinned versions live in image-requirements-postgres.txt, kept equal to the
+# repo's pyproject versions by tests/test_image_requirements_sync.py.
+#
+# The wheelhouse branch installs its three first-party wheels (contract,
+# runtime, adapter) by exact local file first, with --no-index --no-deps: a
+# plain `--find-links=/tmp/wheelhouse -r req.txt` is not enough, because pip
+# does not prefer a find-links wheel over an index match at the same
+# name+version, and continuo-python-runtime / continuo-engine-contract are
+# already published on PyPI under the version this repo's HEAD currently
+# carries (a routine dependency bump lands between releases without a version
+# bump). Left unpinned-by-file, pip silently installs the last PyPI release's
+# transitive pins instead of the wheel this build just produced, defeating
+# the point of testing an unreleased change. Installing the exact local files
+# first (no index contacted at all for this step) is unambiguous; the second
+# install then only has PyPI-only third-party deps left to resolve, and finds
+# the three first-party packages already satisfied.
+ARG WHEEL_SOURCE=pypi
+COPY image-requirements-postgres.txt /tmp/req.txt
+# Optional COPY: the bracket glob matches ./wheelhouse when it exists (the CI/PR
+# WHEEL_SOURCE=wheelhouse path builds it) and no-ops when it is absent, so a
+# release build or a plain `docker build -f Dockerfile.postgres .` needs no
+# pre-created directory. Only the wheelhouse branch below reads its contents.
+COPY wheelhous[e] /tmp/wheelhouse
+RUN set -eu; \
+    if [ "$WHEEL_SOURCE" = "wheelhouse" ]; then \
+      pip install --no-cache-dir --no-index --no-deps \
+        /tmp/wheelhouse/continuo_engine_contract-*.whl \
+        /tmp/wheelhouse/continuo_python_runtime-*.whl \
+        /tmp/wheelhouse/continuo_postgres_adapter-*.whl; \
+      pip install --no-cache-dir -r /tmp/req.txt; \
+    else \
+      pip install --no-cache-dir -r /tmp/req.txt; \
+    fi; \
+    rm -rf /tmp/req.txt /tmp/wheelhouse
+# PYTHONPATH is belt-and-braces: the harness also inserts APP_ROOT and the
+# node script's own directory at the front of sys.path before executing it.
+ENV CONTRACT_DIR=/app/contracts APP_ROOT=/app PYTHONPATH=/app
+WORKDIR /app
+# uid 65532 matches continuo's executor securityContext expectation.
+RUN useradd --uid 65532 --no-create-home --shell /usr/sbin/nologin nonroot
+USER 65532:65532
+ENTRYPOINT ["continuo-runtime"]
+CMD ["run"]

continuo_python_runtime-0.5.0/Dockerfile.trino

@@ -0,0 +1,56 @@
+FROM python:3.14-slim
+# One dual-role image per engine — the python-node runtime harness (default
+# command `run`) and the blue/green validation runner (`validation-op`). It
+# installs the PUBLISHED, versioned libraries, never the repo source:
+#   WHEEL_SOURCE=pypi       (release) installs the pins from PyPI. PyPI versions
+#                           are immutable and the image is consumed
+#                           digest-pinned, so no hash lock is needed here.
+#   WHEEL_SOURCE=wheelhouse (CI/PR)   installs the same pins from ./wheelhouse
+#                           (built by CI) so an unreleased change is testable.
+# The wheelhouse holds only this repo's own first-party wheels (built via
+# `uv build --all-packages`); third-party dependencies always resolve from
+# PyPI in both branches, so the wheelhouse branch never passes --no-index to
+# the requirements install below.
+# The pinned versions live in image-requirements-trino.txt, kept equal to the
+# repo's pyproject versions by tests/test_image_requirements_sync.py.
+#
+# The wheelhouse branch installs its three first-party wheels (contract,
+# runtime, adapter) by exact local file first, with --no-index --no-deps: a
+# plain `--find-links=/tmp/wheelhouse -r req.txt` is not enough, because pip
+# does not prefer a find-links wheel over an index match at the same
+# name+version, and continuo-python-runtime / continuo-engine-contract are
+# already published on PyPI under the version this repo's HEAD currently
+# carries (a routine dependency bump lands between releases without a version
+# bump). Left unpinned-by-file, pip silently installs the last PyPI release's
+# transitive pins instead of the wheel this build just produced, defeating
+# the point of testing an unreleased change. Installing the exact local files
+# first (no index contacted at all for this step) is unambiguous; the second
+# install then only has PyPI-only third-party deps left to resolve, and finds
+# the three first-party packages already satisfied.
+ARG WHEEL_SOURCE=pypi
+COPY image-requirements-trino.txt /tmp/req.txt
+# Optional COPY: the bracket glob matches ./wheelhouse when it exists (the CI/PR
+# WHEEL_SOURCE=wheelhouse path builds it) and no-ops when it is absent, so a
+# release build or a plain `docker build -f Dockerfile.trino .` needs no
+# pre-created directory. Only the wheelhouse branch below reads its contents.
+COPY wheelhous[e] /tmp/wheelhouse
+RUN set -eu; \
+    if [ "$WHEEL_SOURCE" = "wheelhouse" ]; then \
+      pip install --no-cache-dir --no-index --no-deps \
+        /tmp/wheelhouse/continuo_engine_contract-*.whl \
+        /tmp/wheelhouse/continuo_python_runtime-*.whl \
+        /tmp/wheelhouse/continuo_trino_adapter-*.whl; \
+      pip install --no-cache-dir -r /tmp/req.txt; \
+    else \
+      pip install --no-cache-dir -r /tmp/req.txt; \
+    fi; \
+    rm -rf /tmp/req.txt /tmp/wheelhouse
+# PYTHONPATH is belt-and-braces: the harness also inserts APP_ROOT and the
+# node script's own directory at the front of sys.path before executing it.
+ENV CONTRACT_DIR=/app/contracts APP_ROOT=/app PYTHONPATH=/app
+WORKDIR /app
+# uid 65532 matches continuo's executor securityContext expectation.
+RUN useradd --uid 65532 --no-create-home --shell /usr/sbin/nologin nonroot
+USER 65532:65532
+ENTRYPOINT ["continuo-runtime"]
+CMD ["run"]