[Unit]
Description=Teleo KB apply worker — lands human-approved proposals into canonical
After=network.target docker.service
Wants=network.target

[Service]
Type=oneshot
User=teleo
Group=teleo
# Runs from the git-backed deploy-infra worktree (scripts/ is NOT rsynced into the
# live pipeline tree; the reviewed copy is invoked in place). Operator tool, not a
# hermes runtime component.
ExecStart=/opt/teleo-eval/pipeline/.venv/bin/python3 \
  /opt/teleo-eval/workspaces/deploy-infra/scripts/apply_worker.py
# Ships INERT: no --enable here, so each tick is report-only until an operator opts
# in. Flip on (after the first manual apply is proven) by dropping an EnvironmentFile
# with KB_APPLY_WORKER_ENABLED=1 and KB_APPLY_RENDER_CMD=... — no unit edit needed.
EnvironmentFile=-/opt/teleo-eval/secrets/kb-apply-worker.env
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target