fix(runtime): resolve F-08 harden deployment handoff

Author: Aitomates

.dockerignore

@@ -1,10 +1,13 @@
 .git
 .github
 .planning
+.env
+.coverage
 .venv
 __pycache__
 .pytest_cache
+.mypy_cache
 .ruff_cache
+*.py[cod]
 tests
 docs
-

Dockerfile

@@ -2,6 +2,7 @@ FROM python:3.12-slim AS runtime
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
     PORT=8080
 
 WORKDIR /app
@@ -10,12 +11,12 @@ RUN addgroup --system app && adduser --system --ingroup app app
 
 COPY pyproject.toml README.md ./
 COPY src ./src
-RUN pip install --no-cache-dir .
+RUN pip install --no-cache-dir --no-compile .
 
 USER app
 EXPOSE 8080
+STOPSIGNAL SIGTERM
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
   CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health/live', timeout=2)"
 
 CMD ["uvicorn", "cas_reference_product.app:app", "--host", "0.0.0.0", "--port", "8080"]
-

deployment/cas-platform.interface.yaml

@@ -23,8 +23,3 @@ spec:
       - FOUNDRY_AGENT_NAME
     deploymentInjected:
       - APPLICATIONINSIGHTS_CONNECTION_STRING
-  outputsConsumed:
-    - workloadPrincipalId
-    - applicationInsightsId
-    - logAnalyticsWorkspaceId
-

docs/architecture.md

@@ -22,7 +22,12 @@ The Foundry call is isolated behind the `WorkflowAgentService` protocol. This ke
 
 ## Deployment Interface
 
-`deployment/cas-platform.interface.yaml` records the contract: Linux AMD64 image, port 8080, internal ingress by default, system-assigned identity, probes, non-secret identifiers, and platform outputs. It does not deploy resources.
+`deployment/cas-platform.interface.yaml` records the application contract: Linux AMD64 image, port
+8080, internal ingress by default, system-assigned identity, probes, and configuration inputs. It does
+not deploy resources.
+
+The application consumes only the environment values listed in that interface. Platform resource IDs
+and principal IDs remain deployment-orchestration outputs and are not application configuration.
 
 ## Observability Boundaries
 

docs/operations.md

@@ -9,6 +9,13 @@
 
 Submit `examples/prompt-envelope.json` to `POST /api/v1/workflows`. Liveness is `/health/live`; readiness is `/health/ready`.
 
+For a hardened local container run:
+
+```powershell
+docker run --rm --read-only --tmpfs /tmp --cap-drop ALL --security-opt no-new-privileges `
+  -p 8080:8080 cas-reference-product:local
+```
+
 ## Foundry Mode
 
 Set `ENVIRONMENT` to `dev`, `test`, or `prod`; set `WORKFLOW_BACKEND=foundry`; provide the non-secret `FOUNDRY_PROJECT_ENDPOINT` and `FOUNDRY_AGENT_NAME`. The Azure-hosted workload uses its system-assigned managed identity. Do not configure API keys or client secrets.
@@ -23,3 +30,7 @@ are disabled; explicit spans do not record prompt or output content.
 ## Platform Handoff
 
 Build a Linux AMD64 image and pass its immutable image reference to the `containerImage` parameter of `cas-platform`. Review `deployment/cas-platform.interface.yaml` before platform changes. This repository intentionally contains no Azure deployment command.
+
+The Docker build context excludes local `.env` files and development artifacts. The application does
+not consume platform resource IDs; deployment orchestration retains those outputs for RBAC and
+operations workflows.

tests/test_runtime_contracts.py

@@ -0,0 +1,27 @@
+from pathlib import Path
+
+ROOT = Path(__file__).parents[1]
+
+
+def test_docker_build_context_excludes_local_configuration() -> None:
+    ignored = (ROOT / ".dockerignore").read_text(encoding="utf-8").splitlines()
+
+    assert ".env" in ignored
+    assert ".coverage" in ignored
+    assert ".venv" in ignored
+
+
+def test_container_runs_non_root_with_graceful_stop() -> None:
+    dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
+
+    assert "\nUSER app\n" in dockerfile
+    assert "\nSTOPSIGNAL SIGTERM\n" in dockerfile
+    assert "--no-cache-dir --no-compile" in dockerfile
+
+
+def test_platform_interface_lists_only_application_inputs() -> None:
+    interface = (ROOT / "deployment" / "cas-platform.interface.yaml").read_text(encoding="utf-8")
+
+    assert "outputsConsumed" not in interface
+    assert "APPLICATIONINSIGHTS_CONNECTION_STRING" in interface
+    assert "targetPort: 8080" in interface