[Unit]
Description=Teleo KB apply worker — lands human-approved proposals into canonical
After=network.target docker.service
Wants=network.target

[Service]
Type=oneshot
User=teleo
Group=teleo
# Runs from the git-backed deploy-infra worktree (scripts/ is NOT rsynced into the
# live pipeline tree; the reviewed copy is invoked in place). Operator tool, not a
# hermes runtime component.
ExecStart=/opt/teleo-eval/pipeline/.venv/bin/python3 \
  /opt/teleo-eval/workspaces/deploy-infra/scripts/apply_worker.py
# Ships INERT: no --enable here, so each tick is report-only until an operator opts
# in. Flip on (after the first manual apply is proven) by dropping an EnvironmentFile
# with KB_APPLY_WORKER_ENABLED=1, KB_APPLY_WORKER_CONTRACT_VERSION=2|3,
# and KB_APPLY_RENDER_CMD=... -- no unit edit needed. Once the V3 database cutover
# is installed, a V2-configured tick skips retained historical V2 approvals without
# applying them; set version 3 before enabling new execution. Migrate or reject each
# retained V2 packet explicitly through review instead of deleting it from the queue.
EnvironmentFile=-/opt/teleo-eval/secrets/kb-apply-worker.env
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target