core-framework 3.2.0__tar.gz → 3.3.0__tar.gz

core_framework-3.3.0/.cursor/rules/alembic-migrations.mdc

@@ -0,0 +1,61 @@
+---
+description: Alembic migrations — revision id format and index DDL conventions
+globs: alembic/**/alembic/versions/*.py
+alwaysApply: false
+---
+
+# Alembic migrations
+
+## Revision IDs
+
+`alembic_version.version_num` is a **32-character** string. Revision ids must stay well under that limit.
+
+### New revisions (required)
+
+- Set `revision` to a **12-character lowercase hex** string (Alembic default), e.g. `a56bc6b7f799`.
+- Generate with `python -c "import secrets; print(secrets.token_hex(6))"` or `alembic revision`.
+- Put the human-readable slug in the **filename** and the module docstring `Revision ID:` line only if you mirror the hex id there — **do not** use descriptive slugs as `revision`.
+
+```python
+# ✅ Preferred
+"""replace deleted post status with tombstone statuses
+
+Revision ID: 120bf6be81eb
+Revises: a56bc6b7f799
+"""
+
+revision: str = "120bf6be81eb"
+```
+
+```python
+# ❌ Avoid — long, wastes version_num budget, inconsistent with recent migrations
+revision: str = "post_tombstone_status_model"
+```
+
+### Exceptions
+
+- Collapsed **`v1_*_init`** baseline revisions keep their stable names (`v1_post_init`, etc.) — do not rename shipped baselines.
+- **Legacy descriptive slug** revision ids (e.g. `post_add_post_mentions`, `user_add_date_of_birth`) stay as-is. Do not rewrite or collapse history just to convert them to hex. Do not re-flag them on B11 unless a deliberate baseline collapse is in progress.
+
+### Do not rename shipped revision ids
+
+If a revision may already be applied in any environment, **do not** change its `revision` string. Add a forward migration instead.
+
+## Index DDL
+
+### New index migrations (required)
+
+In **`upgrade()`**, create indexes with **`IF NOT EXISTS`** so migrations succeed when an index was already applied manually in production:
+
+```python
+op.execute("""
+    create index if not exists idx_example_created_at
+    on example_table (created_at);
+""")
+```
+
+Use **`drop index if exists`** in **`downgrade()`**.
+
+### Do not retrofit index DDL
+
+Do **not** edit shipped migrations only to add `if not exists` — those revisions may already be applied. New forward migrations follow this rule; legacy `create index` without `if not exists` stays as-is.

core_framework-3.3.0/.cursor/rules/domain-imports.mdc

@@ -0,0 +1,44 @@
+---
+description: Enforce importing from domain __init__.py in API/application layers
+globs:
+  - core_framework/api/**/*.py
+  - core_framework/application/**/*.py
+---
+
+# Domain imports
+
+When importing from **`core_framework/domains/*`** in API or application code:
+
+## Allowed
+
+- Public symbols from domain **`__init__.py`** (models, enums, constants, outcomes).
+- Services from **`dependencies.py`** (e.g. **`user_service`**).
+
+## Prohibited
+
+- Typed or base **domain exceptions** in API/application — use **`application.shared.exceptions`**. Full policy: **`error-boundary.mdc`**.
+- Direct imports from internal modules (`models`, `enums`, `repository`, `service`, `exceptions`).
+
+```python
+# ✅
+from core_framework.domains.user import Profile, UserRole
+from core_framework.domains.user.dependencies import user_service
+
+# ❌
+from core_framework.domains.post import PostUpdateNotFoundException
+from core_framework.domains.user.models import Profile
+```
+
+## Export policy
+
+Export from **`__init__.py`** only what outer layers need. Typed exceptions stay internal; export **only** **`BaseXxxException`** per domain for inheritance typing — not for per-domain HTTP handlers. **`DomainValidationError`** lives in **`domains/exceptions.py`** (core handler wiring only).
+
+To see what a domain exports, check its **`__init__.py`** **`__all__`**.
+
+## After a domain call
+
+1. Return **`None`** or empty when the use case allows.
+2. Raise an **application** exception when HTTP must signal failure.
+3. Extend the domain service API to absorb typed exceptions internally.
+
+Application code never imports repositories. Exception boundary: **`error-boundary.mdc`**.

core_framework-3.3.0/.cursor/rules/error-boundary.mdc

@@ -0,0 +1,56 @@
+---
+description: HTTP error boundaries — application vs domain exceptions, handlers, anti-enumeration
+globs:
+  - core_framework/core/exception_handlers/**/*.py
+  - core_framework/application/**/*.py
+  - core_framework/api/**/router.py
+  - core_framework/api/**/schemas.py
+  - core_framework/domains/**/exceptions.py
+---
+
+# Error boundary
+
+Platform contract: **`docs/platform/client-error-visibility.md`**. Domain imports: **`domain-imports.mdc`**.
+
+## Layers
+
+| Layer | Outward errors | HTTP |
+|-------|----------------|------|
+| **Application** | **`application.shared.exceptions`**, **`InvalidPageTokenError`** | Handlers map type → status + catalog **`detail`** |
+| **API** | Pydantic; **`HTTPException`** for transport-local guards | **422** field errors; router-chosen status + **`detail`** |
+| **Domain typed** | Internal — not imported by API/application | No typed handlers |
+| **Domain `BaseXxxException`** | Handler catch-all only | **500** if leaked |
+
+## Application and domain
+
+- Application **must not** import or raise typed domain exceptions. Signal via **`None`**, empty collections, or **`application.shared.exceptions`**.
+- Typed domain exceptions inherit domain **`BaseXxxException`** → **`BaseDomainException`**. Export **only** **`BaseXxxException`** from domain **`__init__.py`**, not typed subclasses.
+- **`DomainValidationError`** → dedicated **400** handler + **`GENERIC_BAD_REQUEST_DETAIL`**; do not put internal reason in HTTP **`detail`**.
+- Leaked typed domain exception → **`BaseDomainException`** handler → **500** + **`GENERIC_INTERNAL_SERVER_ERROR_DETAIL`**.
+
+## Handler registration
+
+- Use **`register_exception_handler`** from **`core_framework.core.exception_handlers.common`** — not raw **`app.add_exception_handler`** elsewhere.
+- Register handlers in **`core_framework/core/exception_handlers/setup.py`** and **`application.py`**: application types (specific before any base), **`InvalidPageTokenError`**, cashews **`RateLimitError`** (**429**), **`DomainValidationError`**, one **`BaseDomainException`** leak handler, then **`Exception`** unmapped.
+- No per-domain handler modules for typed exceptions. Handlers translate only — no business logic or repository calls.
+- Do not log **error** for expected application 4xx; **`DomainValidationError`** at **warning**/**info**.
+
+## Catalog constants
+
+**`GENERIC_BAD_REQUEST_DETAIL`** (400), **`GENERIC_NOT_FOUND_DETAIL`** (404), **`GENERIC_FORBIDDEN_DETAIL`** (403), **`GENERIC_CONFLICT_DETAIL`** (409), ingest 413/415, **`GENERIC_TOO_MANY_REQUESTS_DETAIL`** (429), **`GENERIC_SERVICE_UNAVAILABLE_DETAIL`** (503), **`GENERIC_INTERNAL_SERVER_ERROR_DETAIL`** (500).
+
+## Anti-enumeration (public routes)
+
+- Read-by-id: missing / hidden / withheld → same status + **`GENERIC_NOT_FOUND_DETAIL`** where flow docs align.
+- Idempotent writes on unknown ids → **204** without leaking existence. Empty list pages are OK.
+- Admin/internal routes may differ when documented. Intentional existence-check endpoints are separate product surface.
+
+## Validation order
+
+User-fixable input shape → API schemas (**422**) or router **`HTTPException`**. Use-case outcomes → application exceptions + handlers. Domain backstops → **`DomainValidationError`** → generic **400** (never domain text in **`detail`**).
+
+## Logging
+
+Do not **`logger.error`** at every domain **`raise`**.
+
+Apply to new handlers and touched raise sites unless the task scopes repo-wide migration.

core_framework-3.3.0/.cursor/rules/repository-schema-isolation.mdc

@@ -0,0 +1,87 @@
+---
+description: Domain repositories must not query other domains' Postgres schemas
+globs:
+  - core_framework/domains/**/repository.py
+alwaysApply: false
+---
+
+# Repository schema isolation
+
+Each domain repository may only read/write tables in **its own** Postgres schema.
+
+Canonical rule: `docs/platform/layers-and-boundaries.md` — *no cross-domain schema reads, writes, joins, or foreign keys*.
+
+## Schema qualification
+
+Repositories receive unquoted `schema` from `runtime.settings.postgres_schemas` in `dependencies.py` (keyword-only `__init__` arg). In `__init__`:
+
+- `self.schema` — config schema name (e.g. `post`)
+- `self.schema_sql` — `quote_postgres_identifier(schema)` for SQL interpolation
+
+Use `{self.schema_sql}.table` in f-string SQL — not hard-coded `"post".` literals.
+
+## Allowed in a repository
+
+- SQL qualified with that domain's schema only (e.g. `{self.schema_sql}.posts` in `PostRepository`).
+- **Within-schema** policy gates (e.g. `insert_post_like` checks `{self.schema_sql}.posts.status = active`).
+- **Lookup mirrors** in the same schema (`user_blocks_lookup`, `user_restrictions_lookup`, `user_followers_lookup`) — synced by application flows; mirrors are not authoritative.
+
+## Forbidden in a repository
+
+- `FROM` / `JOIN` / `EXISTS` / `INSERT … SELECT` against another domain's schema.
+- Importing another domain's `service`, `repository`, or models to enforce policy.
+
+```python
+# ❌ moderation/repository.py — cross-domain EXISTS (illustrative schema literals)
+insert into {moderation_schema_sql}.post_reports (...)
+select $1, $2, $3, $4
+where exists (
+    select 1 from {post_schema_sql}.posts
+    where id = $2 and status = 'active'
+)
+
+# ❌ notification/repository.py — cross-domain mute gate
+insert into {notification_schema_sql}.notification_mutes (...)
+select ...
+where exists (select 1 from {comment_schema_sql}.comments where ...)
+```
+
+## Alembic migrations (different convention)
+
+Do **not** apply repository schema-qualification rules to `alembic/**/versions/*.py`.
+
+Each domain Alembic tree sets `search_path` to that domain's schema in `env.py`. Migration SQL uses **unqualified** table and type names (`posts`, `post_reports`, `create type post_status …`) — not `"post".posts`.
+
+**Exception — PL/pgSQL trigger / function bodies:** Runtime `search_path` for functions is not the migration session’s path, so audit trigger bodies may **hard-code** that domain’s schema qualifier (e.g. `"user".user_change_history`, `moderation.restriction_history`). That is required and accepted. Keep `[postgres_schemas]` values aligned with those literals; do not treat this as a B11 isolation violation.
+
+Cross-domain rules still apply to migrations:
+
+- No `REFERENCES` / FKs to tables in another domain's schema.
+- No DDL that reads or writes another domain's objects.
+
+Stay within the migration tree's domain; one schema per Alembic env.
+
+## Where cross-domain policy belongs
+
+**Application layer** (or domain service orchestration via dependencies, never cross-schema SQL):
+
+```python
+# ✅ application/posts/authenticated_service.py
+post = await post_deps.post_service.retrieve_post_with_metadata_by_id_if_exists(post_id=post_id)
+if post is None or post.status != PostStatus.ACTIVE:
+    return False
+return await moderation_deps.moderation_service.add_post_report(...)
+```
+
+Before adding a repository write that depends on another domain's row state:
+
+1. Can the owning domain gate it within its schema? → do that (likes, views, stats dirty).
+2. Otherwise → gate in `application/**/*_service.py` via the owning domain's service API.
+
+## Self-check (repositories only)
+
+In `domains/<name>/repository.py`:
+
+- Every table/type qualifier in SQL must use `{self.schema_sql}.…` (that domain's schema only).
+- Do not hard-code `"user".`, `"post".`, etc. — use `self.schema` / `self.schema_sql` from config.
+- Mirror lookup tables (`user_blocks_lookup`, etc.) still live under `{self.schema_sql}` when they belong to that domain's schema.

core_framework-3.3.0/.cursor/skills/code-review/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: code-review
+description: Review code for quality, architecture compliance, and best practices. Use when the user asks for a code review, audit, or review.
+---
+
+# Code Review
+
+## Output format (required)
+
+**Actionable findings only:**
+
+- Bugs, wrong behavior, improvements, optimizations, doc/code contradictions, parallel implementation drift (sibling flows that diverge without documented reason).
+- Prioritize by severity with file context and fix direction.
+- **Do not** praise, summarize strengths, or pad with checklist pass narratives.
+- One-line scope is fine. If nothing is wrong, say so in one sentence.
+
+Do **not** flag documented accepted trade-offs in **`docs/platform/architecture-decisions.md`** unless the implementation violates them.
+
+## Workflow
+
+1. Read **`docs/platform/layers-and-boundaries.md`**, **`conventions.md`**, and **`architecture-decisions.md`** for the reviewed scope.
+1. Apply **scoped rules** (`.cursor/rules/*.mdc`) matching files under review — especially **`error-boundary`**, **`domain-imports`**, **`api-layer`**, **`application-layer`**, **`strong-reads`**.
+1. Report findings only — no filler.
+
+## Quick checks
+
+- Application services: no HTTP types, no domain exceptions, no Pydantic return types, one-line docstrings.
+- API: thin routers, validation in schemas, orchestration in application — **fastapi** skill (`.agents/skills/fastapi/`) + **`api-layer`** / **`api-validation`** / **`error-boundary`** rules.
+- Domain: imports only via **`__init__.py`** / **`dependencies`** from outer layers; no caller-context names (**`domain-caller-context`**).
+- Read-after-write refetches use **`*_strong`** where applicable.
+- **Python modernity (constitution):** prefer current 3.14 syntax in reviewed code — PEP 695 type params over module-level `TypeVar`/`ParamSpec`; no unnecessary `from __future__ import annotations`; builtins / `X | Y` over legacy `typing` aliases; `asyncio.TaskGroup` over `gather`.
+
+## Parallel drift
+
+Flag sibling modules with the same job but different structure (async layout, cleanup order, error/idempotency contracts) when docs do not explain the difference. Do **not** flag differences called out as intentional in design/flow docs or in **`docs/reviews/slices.md`** B7 **Do not flag** (for example root vs reply create-idempotency replay placement in **`docs/design/create-idempotency-design.md`**).

core_framework-3.3.0/.github/workflows/dev-ci-cd.yaml

@@ -0,0 +1,358 @@
+name: Development CI/CD
+
+on:
+  push:
+    branches:
+      - master
+
+concurrency:
+  group: core-framework-development
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  package-smoke:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          version: "0.7.9"
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version-file: ".python-version"
+
+      - name: Build wheel and verify install
+        run: |
+          set -euo pipefail
+          rm -rf dist
+          uv build
+          python -m venv /tmp/wheel-smoke
+          /tmp/wheel-smoke/bin/pip install --upgrade pip
+          WHL=$(echo dist/*.whl)
+          /tmp/wheel-smoke/bin/pip install "${WHL}"
+          /tmp/wheel-smoke/bin/python -c "
+          import core_framework
+          from core_framework.api.router import router
+          from core_framework.api.dependencies import (
+              OptionalUserID,
+              RequiredFirebaseUser,
+              RequiredUserID,
+              check_admin_role,
+              check_not_banned,
+              require_client_ip,
+          )
+          from core_framework.api.schemas import BasePatchRequest
+          from core_framework.api.users.shared.schemas import UserID, Username, UserReference
+          from core_framework.application.analytics.read_service import retrieve_analytics_kind_totals_for_range
+          from core_framework.application.analytics.registry import register_activity_source
+          from core_framework.application.bootstrap import configure_application_dependencies, configure_core_framework_runtime
+          from core_framework.application.email import (
+              ACCOUNT_DELETION_SCHEDULED_KIND,
+              enqueue_transactional_email,
+              register_email_content,
+          )
+          from core_framework.application.events.event_service import register_event_handler
+          from core_framework.application.events.models import Event
+          from core_framework.application.events.utm_capture_kinds import register_utm_capture_kind
+          from core_framework.application.shared.enums import EventType
+          from core_framework.application.shared.worker_jobs import enqueue_from_worker, enqueue_job
+          from core_framework.bundled_alembic import alembic_ini_path, bundled_alembic_root, iter_alembic_ini_paths
+          from core_framework.core import (
+              clear_all_rate_limit_counters,
+              clear_rate_limit_counters,
+              configure_core_runtime,
+              rate_limit,
+              seed_rate_limit_counters,
+          )
+          from core_framework.core.cache import close_cashews_backend, init_cashews_backend
+          from core_framework.core.database import Postgres
+          from core_framework.core.exception_handlers import setup_exception_handlers
+          from core_framework.core.exception_handlers.common import (
+              GENERIC_BAD_REQUEST_DETAIL,
+              register_exception_handler,
+          )
+          from core_framework.core.firebase import init_firebase
+          from core_framework.core.http_client import HttpClient
+          from core_framework.core.logging import setup_logging
+          from core_framework.core.middleware import setup_middleware
+          from core_framework.core.observability import (
+              configure_observability_providers,
+              instrument_arq_jobs,
+              setup_observability,
+              setup_worker_observability,
+              shutdown_observability,
+              with_arq_job_telemetry,
+          )
+          from core_framework.core.pagination import (
+              OffsetQueryParams,
+              PaginationResponse,
+              paginate_cursor,
+              paginate_offset,
+          )
+          from core_framework.core.runtime import CoreRuntime, build_core_runtime, unconfigured_dependency
+          from core_framework.core.settings import PostgresSchemasConfig, RetentionConfig, Settings, load_default_settings
+          from core_framework.domains.analytics import ActivityCount, ActivitySourcePort
+          from core_framework.domains.exceptions import BaseDomainException, DomainValidationError
+          from core_framework.domains.media import (
+              ATTACHMENT_INGEST_MAX_BYTES,
+              AVATAR_INGEST_MAX_BYTES,
+              BANNER_INGEST_MAX_BYTES,
+          )
+          import core_framework.domains.user.dependencies as user_deps
+          from core_framework.domains.utils import require_non_blank, require_non_blank_kwargs, require_positive_int
+          from core_framework.main import init_app
+          from core_framework.worker.main import (
+              CORE_FRAMEWORK_QUEUE_NAME,
+              WorkerSettings,
+              build_worker_settings_kwargs,
+              create_worker_settings_for_shared_runtime,
+          )
+          from core_framework.worker.schedules import build_schedules
+          from core_framework.worker.tasks import tasks
+          from core_framework.worker.worker_context import WorkerJobContext, WorkerStartupContext
+          assert router is not None
+          assert init_app is not None
+          assert Settings is not None
+          assert load_default_settings is not None
+          assert PostgresSchemasConfig is not None
+          assert RetentionConfig is not None
+          assert RequiredUserID is not None
+          assert OptionalUserID is not None
+          assert RequiredFirebaseUser is not None
+          assert check_not_banned is not None
+          assert check_admin_role is not None
+          assert require_client_ip is not None
+          assert BasePatchRequest is not None
+          assert UserReference is not None
+          assert UserID is not None
+          assert Username is not None
+          assert register_activity_source is not None
+          assert retrieve_analytics_kind_totals_for_range is not None
+          assert register_event_handler is not None
+          assert register_utm_capture_kind is not None
+          assert Event is not None
+          assert EventType is not None
+          assert register_email_content is not None
+          assert enqueue_transactional_email is not None
+          assert ACCOUNT_DELETION_SCHEDULED_KIND
+          assert configure_application_dependencies is not None
+          assert configure_core_framework_runtime is not None
+          assert configure_core_runtime is not None
+          assert CoreRuntime is not None
+          assert build_core_runtime is not None
+          assert unconfigured_dependency is not None
+          assert ActivitySourcePort is not None
+          assert ActivityCount is not None
+          assert AVATAR_INGEST_MAX_BYTES > 0
+          assert BANNER_INGEST_MAX_BYTES > 0
+          assert ATTACHMENT_INGEST_MAX_BYTES > 0
+          assert user_deps is not None
+          assert BaseDomainException is not None
+          assert DomainValidationError is not None
+          assert require_non_blank is not None
+          assert require_non_blank_kwargs is not None
+          assert require_positive_int is not None
+          assert Postgres is not None
+          assert HttpClient is not None
+          assert register_exception_handler is not None
+          assert GENERIC_BAD_REQUEST_DETAIL
+          assert setup_logging is not None
+          assert setup_middleware is not None
+          assert setup_exception_handlers is not None
+          assert setup_observability is not None
+          assert setup_worker_observability is not None
+          assert configure_observability_providers is not None
+          assert instrument_arq_jobs is not None
+          assert with_arq_job_telemetry is not None
+          assert shutdown_observability is not None
+          assert rate_limit is not None
+          assert clear_rate_limit_counters is not None
+          assert clear_all_rate_limit_counters is not None
+          assert seed_rate_limit_counters is not None
+          assert OffsetQueryParams is not None
+          assert PaginationResponse is not None
+          assert paginate_offset is not None
+          assert paginate_cursor is not None
+          assert init_cashews_backend is not None
+          assert close_cashews_backend is not None
+          assert init_firebase is not None
+          assert enqueue_job is not None
+          assert enqueue_from_worker is not None
+          assert WorkerSettings is not None
+          assert CORE_FRAMEWORK_QUEUE_NAME
+          assert build_worker_settings_kwargs is not None
+          assert create_worker_settings_for_shared_runtime is not None
+          assert build_schedules is not None
+          assert tasks
+          assert WorkerJobContext is not None
+          assert WorkerStartupContext is not None
+          assert bundled_alembic_root().is_dir()
+          assert (bundled_alembic_root() / 'user' / 'alembic.ini').is_file()
+          assert alembic_ini_path('user').is_file()
+          assert len(iter_alembic_ini_paths()) >= 1
+          "
+          /tmp/wheel-smoke/bin/pip install "${WHL}[testing]"
+          /tmp/wheel-smoke/bin/python -c "
+          from core_framework.testing import TestConfig, create_firebase_user_token
+          from core_framework.testing.media import (
+              attachment_upload_files,
+              avatar_upload_files,
+              banner_upload_files,
+              minimal_png_bytes,
+              reconfigure_media_for_testing,
+          )
+          assert TestConfig is not None
+          assert create_firebase_user_token is not None
+          assert reconfigure_media_for_testing is not None
+          assert minimal_png_bytes is not None
+          assert avatar_upload_files is not None
+          assert banner_upload_files is not None
+          assert attachment_upload_files is not None
+          "
+          test -x /tmp/wheel-smoke/bin/cf-alembic
+
+  app-docker:
+    needs: [package-smoke]
+    runs-on: ubuntu-latest
+    environment: development
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Docker Meta
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: ${{ vars.DOCKERHUB_USERNAME }}/core-framework
+          flavor: latest=true
+
+      - name: Login to DockerHub
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build and Push
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: ./deploy/app/dockerfile
+          target: api
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+
+  worker-docker:
+    needs: [package-smoke]
+    runs-on: ubuntu-latest
+    environment: development
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Docker Meta
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: ${{ vars.DOCKERHUB_USERNAME }}/core-framework-worker
+          flavor: latest=true
+
+      - name: Login to DockerHub
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build and Push
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: ./deploy/app/dockerfile
+          target: worker
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+
+  deploy:
+    needs: [app-docker, worker-docker]
+    permissions:
+      contents: read
+    uses: ./.github/workflows/_deploy.yml
+    with:
+      env_name: development
+      dockerhub_username: ${{ vars.DOCKERHUB_USERNAME }}
+    secrets:
+      SECRET_KEY: ${{ secrets.SECRET_KEY }}
+      WRITE_POSTGRES_PASSWORD: ${{ secrets.WRITE_POSTGRES_PASSWORD }}
+      READ_POSTGRES_PASSWORD: ${{ secrets.READ_POSTGRES_PASSWORD }}
+      FIREBASE_CONFIG: ${{ secrets.FIREBASE_CONFIG }}
+      IMAGE_SERVER_SSH_PRIVATE_KEY: ${{ secrets.IMAGE_SERVER_SSH_PRIVATE_KEY }}
+      IMAGE_SERVER_KNOWN_HOSTS: ${{ secrets.IMAGE_SERVER_KNOWN_HOSTS }}
+      DEPLOY_SERVER_SSH_KEY: ${{ secrets.DEPLOY_SERVER_SSH_KEY }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+
+  post-deploy-e2e:
+    needs: [deploy]
+    runs-on: ubuntu-latest
+    environment: development
+    continue-on-error: true
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          version: "0.7.9"
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version-file: ".python-version"
+
+      - name: Install the project
+        run: uv sync --locked --all-extras --dev
+
+      - name: Post-deploy E2E
+        run: uv run pytest tests/e2e
+        env:
+          E2E_API_BASE_URL: ${{ vars.E2E_API_BASE_URL }}
+          E2E_FIREBASE_API_KEY: ${{ secrets.E2E_FIREBASE_API_KEY }}
+          E2E_USER_EMAIL: ${{ vars.E2E_USER_EMAIL }}
+          E2E_USER_PASSWORD: ${{ secrets.E2E_USER_PASSWORD }}
+          E2E_ADMIN_EMAIL: ${{ vars.E2E_ADMIN_EMAIL }}
+          E2E_ADMIN_PASSWORD: ${{ secrets.E2E_ADMIN_PASSWORD }}
+          E2E_MEDIA_BASE_URL: ${{ vars.E2E_MEDIA_BASE_URL }}
+          E2E_ALLOWED_ORIGIN: ${{ vars.E2E_ALLOWED_ORIGIN }}
+          E2E_WORKER_POLL_TIMEOUT_SEC: ${{ vars.E2E_WORKER_POLL_TIMEOUT_SEC }}