poimen-workflows/Dockerfile

# Multi-stage build for Poimen Temporal Worker
# Stage 1: Builder - Compile Go binary and set up tools
FROM golang:1.25-alpine AS builder

WORKDIR /build

# Install system dependencies (ast-grep, git, build essentials)
RUN apk add --no-cache \
    git \
    curl \
    wget \
    ca-certificates \
    gcc \
    musl-dev \
    bash \
    && echo "[builder] System dependencies installed"

# Install ast-grep CLI tool
RUN curl -fsSL https://github.com/ast-grep/ast-grep/releases/download/0.24.0/sg-x86_64-unknown-linux-musl.tar.gz \
    | tar xzf - -C /usr/local/bin \
    && chmod +x /usr/local/bin/sg \
    && sg --version \
    && echo "[builder] ast-grep installed"

# Install Node.js for pi CLI and browser-use
RUN apk add --no-cache nodejs npm \
    && echo "[builder] Node.js installed"

# Install pi CLI globally
RUN npm install -g @earendil-works/pi-coding-agent --unsafe-perm \
    && pi --version \
    && echo "[builder] pi CLI installed"

# Install browser-use CLI for browser automation
RUN npm install -g browser-use --unsafe-perm \
    && browser-use --version \
    && echo "[builder] browser-use CLI installed"

# Set up pi home directory and skills
RUN mkdir -p ~/.pi/agent/skills ~/.pi/agent/agents \
    && echo "[builder] pi directories created"

# Stage 2: Download pi skills (caveman & andrej karpathy)
# Clone caveman skill from pi-agent repo
RUN cd /tmp && git clone https://github.com/earendil-works/pi-agent.git pi-repo \
    && mkdir -p ~/.pi/agent/skills/caveman \
    && cp -r pi-repo/examples/skills/caveman/* ~/.pi/agent/skills/caveman/ 2>/dev/null || true \
    && echo "[builder] caveman skill installed"

# Create andrej karpathy skill manually (reference/training patterns)
RUN mkdir -p ~/.pi/agent/skills/andrej-karpathy && cat > ~/.pi/agent/skills/andrej-karpathy/SKILL.md << 'EOF'
# Andrej Karpathy LLM & AI Principles Skill

Build neural networks and LLM systems with proven patterns from Andrej Karpathy.
Topics: attention mechanisms, transformer training, inference optimization, edge cases.

## Key Principles

### 1. Simplicity First
- Start with minimal implementation
- Add complexity only when justified
- Test each component independently
- Use debugging tools effectively

### 2. Neural Network Architecture
- Understand backward pass deeply
- Implement from scratch when possible
- Use visualization for debugging
- Profile before optimizing

### 3. LLM Training Patterns
- Quality data > quantity
- Curriculum learning for complex tasks
- Loss landscape visualization
- Checkpoint strategy matters

### 4. Inference Optimization
- Quantization without quality loss
- KV cache management
- Batch processing strategies
- Latency profiling

### 5. Failure Analysis
- Log intermediate activations
- Check gradient flow
- Validate data pipeline
- Test edge cases explicitly

## Usage in Poimen

Apply when:
- Designing workflow stages (like training curricula)
- Optimizing inference (planner/judge/implementer prompts)
- Debugging convergence issues (retry patterns)
- Scaling to production (quantization patterns)

## Resources
- github.com/karpathy/minGPT - Minimal GPT implementation
- youtube: "Neural Networks: Zero to Hero" series
- Papers: Attention Is All You Need, GPT series whitepapers
EOF
    && echo "[builder] andrej-karpathy skill created"

# Create browser-use skill for web testing & automation
RUN mkdir -p ~/.pi/agent/skills/browser-use && cat > ~/.pi/agent/skills/browser-use/SKILL.md << 'EOF'
# browser-use: Browser Automation Skill

Automate web browser interactions for testing, verification, and UI validation.
Topics: headless browser control, visual testing, form automation, screenshot capture.

## Key Capabilities

### 1. Browser Control
- Launch headless Chrome/Firefox
- Navigate to URLs
- Wait for elements/navigation
- Handle popups/dialogs

### 2. Interaction Patterns
- Click buttons/links
- Fill forms (text, dropdown, checkbox)
- Drag & drop
- Keyboard input

### 3. Verification & Capture
- Screenshot capture
- Element inspection
- Accessibility checks
- Network monitoring

### 4. Wait Strategies
- Wait for element visible
- Wait for navigation
- Wait for condition (custom JS)
- Timeout handling

### 5. Error Recovery
- Retry failed actions
- Handle stale elements
- Browser crash recovery
- Memory leak prevention

## Usage in Poimen Phases

### Phase T2 (Implementation)
- Test generated UI code in real browser
- Verify visual layout matches spec
- Validate form inputs work correctly

### Phase T3 (Verification)
- Visual regression testing
- Accessibility validation (ARIA, keyboard nav)
- Cross-browser verification

### Phase T6 (Integration)
- End-to-end workflow testing
- External service integration testing
- User journey verification

### Phase T9 (Release)
- Pre-release smoke tests
- Deployment verification
- Production canary testing

## Example Workflows

```bash
# Launch browser and take screenshot
browser-use screenshot "https://example.com" --file output.png

# Fill form and submit
browser-use interact "https://example.com" \
  --click "#submit-btn" \
  --type "#email" "[email protected]" \
  --type "#password" "secretpass" \
  --click ".submit"

# Wait for dynamic content and extract data
browser-use extract "https://example.com" \
  --wait ".dynamic-content" \
  --selector ".data-row" \
  --output json

# Accessibility audit
browser-use audit "https://example.com" \
  --check wcag2a \
  --report a11y-report.html
```

## Integration with Poimen

Pre-generated code can be tested:
```bash
# Generate code (T2)
implementer_output = "function handleClick() { ... }"

# Verify in browser (T3)
browser-use interact "http://localhost:3000" \
  --click ".test-button" \
  --screenshot result.png

# Compare with expected
verify_visual_match(result.png, expected.png)
```

## Performance Notes

- Startup: ~2-5s per browser
- Action latency: 100-500ms per interaction
- Screenshot: 500ms-2s (depends on page size)
- Keep browser alive for batch operations (pool management)

## Error Handling

- Transient: Network timeout → retry with backoff
- Permanent: Element not found → fail and log
- Flaky: Wait strategies → increase timeout gradually
- Memory: Reuse browser instances → kill after 10 uses

## Resources
- docs.browseruse.com - Official documentation
- github.com/browser-use/browser-use - Source code
- Chrome DevTools Protocol - Advanced browser control
EOF
    && echo "[builder] browser-use skill created"

# Copy Go source code
COPY . /build/

# Download Go dependencies
RUN go mod download \
    && echo "[builder] Go dependencies downloaded"

# Build worker binary
RUN CGO_ENABLED=1 GOOS=linux go build -o /build/worker ./cmd/worker \
    && echo "[builder] Worker binary built"

# Verify binary
RUN file /build/worker && ls -lh /build/worker

# Stage 3: Runtime - Minimal base image with runtime dependencies
FROM alpine:3.20

LABEL maintainer="Poimen Team"
LABEL description="Poimen Temporal Worker with memory service, ast-grep, and browser automation"

WORKDIR /app

# Install runtime dependencies (including Chromium for browser-use)
RUN apk add --no-cache \
    ca-certificates \
    git \
    bash \
    curl \
    jq \
    chromium \
    chromium-chromedriver \
    && echo "[runtime] Runtime dependencies installed"

# Install Node.js for pi CLI and browser-use
RUN apk add --no-cache nodejs npm \
    && echo "[runtime] Node.js installed"

# Install pi CLI in runtime image
RUN npm install -g @earendil-works/pi-coding-agent --unsafe-perm \
    && pi --version \
    && echo "[runtime] pi CLI installed"

# Install browser-use CLI in runtime image
RUN npm install -g browser-use --unsafe-perm \
    && browser-use --version \
    && echo "[runtime] browser-use CLI installed"

# Copy ast-grep binary from builder
COPY --from=builder /usr/local/bin/sg /usr/local/bin/sg
RUN chmod +x /usr/local/bin/sg && sg --version \
    && echo "[runtime] ast-grep copied"

# Copy pi skills from builder
COPY --from=builder /root/.pi /root/.pi
RUN ls -la /root/.pi/agent/skills/ \
    && echo "[runtime] pi skills configured"

# Copy worker binary from builder
COPY --from=builder /build/worker /app/worker
RUN chmod +x /app/worker && file /app/worker \
    && echo "[runtime] Worker binary copied"

# Create app directory structure
RUN mkdir -p /app/work /app/logs /app/screenshots \
    && chmod 755 /app/work /app/logs /app/screenshots \
    && echo "[runtime] App directories created"

# Health check endpoint
EXPOSE 8081

# Worker task queue listener
ENV TEMPORAL_NAMESPACE=poimen-harness \
    TEMPORAL_HOSTPORT=temporal-frontend.temporal:7233 \
    MEMORY_SERVICE_URL=http://memory-service.poimen:5000 \
    MEMORY_SERVICE_TOKEN= \
    ANTHROPIC_API_KEY= \
    PI_SKILLS_PATH=/root/.pi/agent/skills \
    AST_GREP_BIN=/usr/local/bin/sg \
    BROWSER_USE_BIN=/usr/local/bin/browser-use \
    CHROMIUM_BIN=/usr/bin/chromium-browser \
    SCREENSHOTS_DIR=/app/screenshots

# Entrypoint script with startup diagnostics
COPY --chmod=755 << 'EOF' /app/entrypoint.sh
#!/bin/bash
set -e

echo "[$(date)] ========== POIMEN WORKER STARTUP =========="
echo "[$(date)] Container: $HOSTNAME"
echo "[$(date)] Image: $(cat /etc/os-release | grep PRETTY_NAME | cut -d= -f2)"

# Verify CLI tools
echo "[$(date)] ✓ Checking CLI tools..."
echo "  - Go version: $(go version 2>/dev/null || echo 'N/A')"
echo "  - ast-grep: $(sg --version 2>&1 | head -1)"
echo "  - pi: $(pi --version 2>&1 | head -1)"
echo "  - browser-use: $(browser-use --version 2>&1 | head -1)"
echo "  - chromium: $(chromium-browser --version 2>&1 || echo 'Not found')"
echo "  - git: $(git --version)"
echo "  - node: $(node --version)"
echo "  - npm: $(npm --version)"

# Verify pi skills
echo "[$(date)] ✓ Checking pi skills..."
if [ -d "$PI_SKILLS_PATH" ]; then
    echo "  - Skills path: $PI_SKILLS_PATH"
    ls -1 "$PI_SKILLS_PATH" | sed 's/^/    ✓ /'
else
    echo "  - WARNING: Skills path not found: $PI_SKILLS_PATH"
fi

# Verify browser tools
echo "[$(date)] ✓ Checking browser automation tools..."
echo "  - Chromium binary: $CHROMIUM_BIN"
echo "  - Screenshots directory: $SCREENSHOTS_DIR"
if [ -d "$SCREENSHOTS_DIR" ]; then
    echo "  - Screenshots dir ready ($(du -sh $SCREENSHOTS_DIR 2>/dev/null | cut -f1 || echo '0B'))"
fi

# Check environment variables
echo "[$(date)] ✓ Configuration loaded:"
echo "  - TEMPORAL_NAMESPACE: $TEMPORAL_NAMESPACE"
echo "  - TEMPORAL_HOSTPORT: $TEMPORAL_HOSTPORT"
echo "  - MEMORY_SERVICE_URL: ${MEMORY_SERVICE_URL:-(not set)}"
echo "  - PI_SKILLS_PATH: $PI_SKILLS_PATH"
echo "  - CHROMIUM_BIN: $CHROMIUM_BIN"

# Verify memory service connectivity (optional, non-blocking)
if [ ! -z "$MEMORY_SERVICE_URL" ]; then
    echo "[$(date)] ✓ Testing memory service connectivity..."
    if curl -sf "$MEMORY_SERVICE_URL/health" > /dev/null 2>&1; then
        echo "  - Memory service: HEALTHY"
    else
        echo "  - Memory service: UNREACHABLE (will retry in worker)"
    fi
fi

# Test browser automation (optional, non-blocking)
echo "[$(date)] ✓ Testing browser automation..."
if command -v chromium-browser &> /dev/null && command -v browser-use &> /dev/null; then
    echo "  - Chromium available: YES"
    echo "  - browser-use available: YES"
    echo "  - Browser automation: READY"
else
    echo "  - Browser automation: WARNING - missing dependencies"
fi

echo "[$(date)] ========== STARTING WORKER =========="
exec /app/worker
EOF

RUN chmod +x /app/entrypoint.sh

# Run worker with diagnostics
ENTRYPOINT ["/app/entrypoint.sh"]

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:8081/health || exit 1