Dockerfile.a2a

# vigil/Dockerfile.a2a — Vigil A2A orchestrator image (Path B)
FROM python:3.11-slim

WORKDIR /app

# System deps (Z3, JAX, presidio compile native pieces on install).
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential gcc git curl && rm -rf /var/lib/apt/lists/*

# Install from monorepo root pyproject so shared+vigil deps resolve once.
COPY pyproject.toml /app/
COPY shared/ /app/shared/
COPY vigil/ /app/vigil/

RUN pip install --no-cache-dir -e .

EXPOSE 8081

# Liveness — matches vigil/vigil_orchestrator/main.py:/healthz JSON contract.
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD curl -fsS http://127.0.0.1:8081/healthz || exit 1

# HARD RULE — see docs/VIGIL_ORCH_MASTER.md §4 (session-cache invariant).
# Multi-worker breaks the in-process JSONRPC dispatcher install seam used by
# V-CODE-410. CI greps Dockerfiles for `--workers", "1"` and fails otherwise.
CMD ["uvicorn", "vigil.vigil_orchestrator.main:app", "--host", "0.0.0.0", "--port", "8081", "--workers", "1"]