From 81df000654bc36225124c5c52bba6c9814231ac4 Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Fri, 17 Jul 2026 02:59:29 +0200
Subject: [PATCH] =?UTF-8?q?feat:=20=E5=A3=B0=E6=98=8E=20SelfMedia=20Tempor?=
 =?UTF-8?q?al=20=E8=BF=90=E8=A1=8C=E6=8B=93=E6=89=91?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 config/selfmedia.yaml                      | 64 ++++++++++++++++++++++
 scripts/src/selfmedia-delivery-renderer.ts |  4 +-
 2 files changed, 66 insertions(+), 2 deletions(-)

diff --git a/config/selfmedia.yaml b/config/selfmedia.yaml
index 9e22d8a9..cd69ee6b 100644
--- a/config/selfmedia.yaml
+++ b/config/selfmedia.yaml
@@ -104,6 +104,25 @@ delivery:
             - scripts/selfmedia-cli.ts
             - server
             - foreground
+            - --runtime
+          worker:
+            name: selfmedia-worker
+            replicas: 1
+            command:
+              - /usr/bin/tini
+              - --
+              - node
+              - --import
+              - tsx
+              - scripts/temporal-worker.ts
+              - --runtime
+            resources:
+              requests:
+                cpu: 250m
+                memory: 768Mi
+              limits:
+                cpu: "4"
+                memory: 6Gi
           service:
             name: selfmedia
             type: ClusterIP
@@ -145,6 +164,51 @@ delivery:
             toolCache:
               mountPath: /app/.tools/cache
               sizeLimit: 1Gi
+        temporal:
+          namespace: selfmedia
+          taskQueue: selfmedia-pipeline
+          image: temporalio/temporal:1.8.0@sha256:2c344b4a39b4489fc6944db095f628f0c30659836faf11780a4dc435599e80e3
+          replicas: 1
+          command:
+            - temporal
+            - server
+            - start-dev
+            - --headless
+            - --ip
+            - 0.0.0.0
+            - --port
+            - "7233"
+            - --namespace
+            - selfmedia
+            - --db-filename
+            - /var/lib/temporal/temporal.db
+          service:
+            name: selfmedia-temporal
+            port: 7233
+          persistence:
+            claimName: selfmedia-temporal
+            storageClassName: local-path
+            accessModes:
+              - ReadWriteOnce
+            size: 5Gi
+            mountPath: /var/lib/temporal
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+            fsGroup: 1000
+            runAsNonRoot: true
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            seccompProfile: RuntimeDefault
+            dropCapabilities:
+              - ALL
         publicExposure:
           enabled: true
           mode: hostPort-http-edge
diff --git a/scripts/src/selfmedia-delivery-renderer.ts b/scripts/src/selfmedia-delivery-renderer.ts
index 8321f912..ecaea885 100644
--- a/scripts/src/selfmedia-delivery-renderer.ts
+++ b/scripts/src/selfmedia-delivery-renderer.ts
@@ -404,8 +404,8 @@ function validateRuntimeRender(sourceWorktree: string, effectiveDeployment: Reco
     for (const marker of forbidden) {
       if (output.includes(marker)) throw new Error(`selfmedia service renderer output contains forbidden ${marker.trim()}`);
     }
-    if ((output.match(/kind: PersistentVolumeClaim/gu) ?? []).length !== 2) throw new Error("selfmedia service renderer must produce exactly two PVCs");
-    if ((output.match(/kind: NetworkPolicy/gu) ?? []).length < 3) throw new Error("selfmedia service renderer must produce at least three NetworkPolicies");
+    if ((output.match(/kind: PersistentVolumeClaim/gu) ?? []).length !== 3) throw new Error("selfmedia service renderer must produce exactly three PVCs");
+    if ((output.match(/kind: NetworkPolicy/gu) ?? []).length < 5) throw new Error("selfmedia service renderer must produce at least five NetworkPolicies");
   } finally {
     rmSync(temporary, { recursive: true, force: true });
   }