feat: Scheduled Execution with Cron and Retry Handling

tests/test_docker_artifacts.py

@@ -3,6 +3,8 @@ from __future__ import annotations
 import re
 from pathlib import Path
 
+import pytest
+
 REPO_ROOT = Path(__file__).resolve().parents[1]
 
 
@@ -48,11 +50,34 @@ def test_dockerfile_does_not_copy_env_or_data() -> None:
 
 def test_compose_mounts_data_and_env_readonly() -> None:
     compose = (REPO_ROOT / "docker-compose.yml").read_text()
-    assert "./.env:/.env:ro" in compose
+    assert "env_file:" in compose
+    assert "- .env" in compose
     assert "./data:/app/data" in compose
     assert "build:" in compose
 
 
+def test_dockerfile_runs_entrypoint_as_root() -> None:
+    dockerfile = (REPO_ROOT / "Dockerfile").read_text()
+    lines = [line.strip() for line in dockerfile.splitlines()]
+    entrypoint_idx = next(
+        (i for i, line in enumerate(lines) if line.upper().startswith("ENTRYPOINT")),
+        None,
+    )
+    assert entrypoint_idx is not None, "Dockerfile must declare ENTRYPOINT"
+    for line in lines[entrypoint_idx:]:
+        if line.upper().startswith("USER "):
+            pytest.fail(
+                "Dockerfile must not switch USER after ENTRYPOINT — entrypoint.sh "
+                "needs root to install /etc/cron.d/tenbackward and exec cron -f"
+            )
+
+
+def test_run_bot_wrapper_drops_privileges() -> None:
+    wrapper = (REPO_ROOT / "run-bot.sh").read_text()
+    assert "setpriv" in wrapper or "su -s" in wrapper
+    assert "tenbackward" in wrapper
+
+
 def test_cron_template_has_env_header() -> None:
     cron = (REPO_ROOT / "crontab" / "tenbackward.cron").read_text()
     assert "SHELL=/bin/bash" in cron