feat: production-ready implementation with Basilica integration

- config.rs: typed env-var configuration with startup banner
- sandbox.rs: resource-limited process execution (ulimit, nice, timeouts, output truncation)
- metrics.rs: Prometheus-compatible /metrics endpoint
- cleanup.rs: session directory reaping, process group kill
- basilica.rs: auto-enroll public metadata on startup
- session.rs: eval steps tracking, session stats, TTL reaper
- task.rs: workspace.yaml + checks.txt parsing, archive validation
- executor.rs: full eval pipeline (download → clone → install → agent → tests)
- handlers.rs: /health, /status, /metrics, /evaluate, /evaluations endpoints
- main.rs: graceful shutdown, concurrency limiter, background reapers
- Dockerfile: multi-stage with Python, Node, Go, Rust toolchains
- CI: lint (fmt+clippy) + build + test + Docker push
- README: Mermaid diagrams, API reference, deployment guide

28 tests, 0 warnings, 0 clippy issues.

Author: echobt

.github/workflows/ci.yml

@@ -12,46 +12,55 @@ env:
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
-  build-and-test:
+  lint:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@nightly
+        with:
+          components: rustfmt, clippy
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-lint-${{ hashFiles('**/Cargo.lock') }}
+      - run: cargo +nightly fmt --check
+      - run: cargo +nightly clippy -- -D warnings
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo
-        uses: actions/cache@v4
+  build-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
             target
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-
       - name: Build
         run: cargo build --release
-
       - name: Test
         run: cargo test
 
   docker:
-    needs: build-and-test
+    needs: [lint, build-and-test]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
     steps:
       - uses: actions/checkout@v4
-
       - name: Log in to GHCR
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Build and push
         uses: docker/build-push-action@v5
         with:

Cargo.lock

@@ -55,5 +55,11 @@ tempfile = "3"
 parking_lot = "0.12"
 dashmap = "6"
 
+# Process / system
+libc = "0.2"
+
+# URL encoding
+urlencoding = "2"
+
 [dev-dependencies]
 tokio-test = "0.4"

Cargo.toml

@@ -1,35 +1,36 @@
-# Build stage
 FROM rust:1.83-bookworm AS builder
 WORKDIR /build
-COPY Cargo.toml Cargo.lock* ./
-COPY src/ src/
+COPY Cargo.toml Cargo.lock ./
+COPY src ./src
 RUN cargo build --release
 
-# Runtime stage
 FROM debian:bookworm-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates git curl wget \
+    ca-certificates git curl wget procps \
     python3 python3-pip python3-venv \
     nodejs npm \
     build-essential pkg-config libssl-dev \
     && rm -rf /var/lib/apt/lists/*
 
-# Install common test tools
-RUN python3 -m pip install --break-system-packages pytest pytest-cov \
-    && npm install -g tsx jest vitest
+RUN python3 -m pip install --break-system-packages \
+    pytest pytest-cov pytest-xdist unittest2 nose2 tox
+
+RUN npm install -g tsx jest vitest mocha
 
-# Install Go
 RUN curl -fsSL https://go.dev/dl/go1.22.5.linux-amd64.tar.gz | tar -C /usr/local -xz
-ENV PATH="/usr/local/go/bin:${PATH}"
 
-COPY --from=builder /build/target/release/term-executor /usr/local/bin/term-executor
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
 
-RUN mkdir -p /tmp/sessions
+ENV PATH="/usr/local/go/bin:/root/.cargo/bin:${PATH}"
 
-ENV PORT=8080
-ENV RUST_LOG=info,term_executor=debug
+COPY --from=builder /build/target/release/term-executor /usr/local/bin/
+
+RUN mkdir -p /tmp/sessions
 
 EXPOSE 8080
 
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD curl -f http://localhost:8080/health || exit 1
+
 CMD ["term-executor"]