From abfab6117c6eb9cb3e3d143625771bbdaf804660 Mon Sep 17 00:00:00 2001
From: Raul Montoya Cardenas <montoyaraul34@gmail.com>
Date: Wed, 1 Jul 2026 16:53:15 -0500
Subject: [PATCH 01/18] Enhance CI workflow with caching and stale issue
 actions

Added caching and stale issue management to the workflow.
---
 .github/workflows/rust.yml | 164 +++++++++++++++++++++++++++++++++++++
 1 file changed, 164 insertions(+)
 create mode 100644 .github/workflows/rust.yml

diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
new file mode 100644
index 0000000..4e35d4d
--- /dev/null
+++ b/.github/workflows/rust.yml
@@ -0,0 +1,164 @@
+name: Rust
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+    - name: Build
+      run: cargo build --verbose
+    - name: Run tests
+      run: cargo test --verbose
+      
+name: Cache
+  uses: actions/cache@v5.1.0
+  with:
+    # A list of files, directories, and wildcard patterns to cache and restore
+    path: 
+    # An explicit key for restoring and saving the cache
+    key: 
+    # An ordered multiline string listing the prefix-matched keys, that are used for restoring stale cache if no cache hit occurred for key. Note `cache-hit` returns false in this case.
+    restore-keys: # optional
+    # The chunk size used to split up large files during upload, in bytes
+    upload-chunk-size: # optional
+    # An optional boolean when enabled, allows windows runners to save or restore caches that can be restored or saved respectively on other platforms
+    enableCrossOsArchive: # optional, default is false
+    # Fail the workflow if cache entry is not found
+    fail-on-cache-miss: # optional, default is false
+    # Check if a cache entry exists for the given input(s) (key, restore-keys) without downloading the cache
+    lookup-only: # optional, default is false
+    # Run the post step to save the cache even if another step before fails
+    save-always: # optional, default is false
+
+name: Download a Build Artifact
+  uses: actions/download-artifact@v3.1.0
+  with:
+    # Artifact name
+    name: # optional
+    # Destination path
+    path: # optional
+
+name: Close Stale Issues
+  uses: actions/stale@v10.3.0
+  with:
+    # Token for the repository. Can be passed in using `{{ secrets.GITHUB_TOKEN }}`.
+    repo-token: # optional, default is ${{ github.token }}
+    # The message to post on the issue when tagging it. If none provided, will not mark issues stale.
+    stale-issue-message: # optional
+    # The message to post on the pull request when tagging it. If none provided, will not mark pull requests stale.
+    stale-pr-message: # optional
+    # The message to post on the issue when closing it. If none provided, will not comment when closing an issue.
+    close-issue-message: # optional
+    # The message to post on the pull request when closing it. If none provided, will not comment when closing a pull requests.
+    close-pr-message: # optional
+    # The number of days old an issue or a pull request can be before marking it stale. Set to -1 to never mark issues or pull requests as stale automatically.
+    days-before-stale: # optional, default is 60
+    # The number of days old an issue can be before marking it stale. Set to -1 to never mark issues as stale automatically. Override "days-before-stale" option regarding only the issues.
+    days-before-issue-stale: # optional
+    # The number of days old a pull request can be before marking it stale. Set to -1 to never mark pull requests as stale automatically. Override "days-before-stale" option regarding only the pull requests.
+    days-before-pr-stale: # optional
+    # The number of days to wait to close an issue or a pull request after it being marked stale. Set to -1 to never close stale issues or pull requests.
+    days-before-close: # optional, default is 7
+    # The number of days to wait to close an issue after it being marked stale. Set to -1 to never close stale issues. Override "days-before-close" option regarding only the issues.
+    days-before-issue-close: # optional
+    # The number of days to wait to close a pull request after it being marked stale. Set to -1 to never close stale pull requests. Override "days-before-close" option regarding only the pull requests.
+    days-before-pr-close: # optional
+    # The label to apply when an issue is stale.
+    stale-issue-label: # optional, default is Stale
+    # The label to apply when an issue is closed.
+    close-issue-label: # optional
+    # The labels that mean an issue is exempt from being marked stale. Separate multiple labels with commas (eg. "label1,label2").
+    exempt-issue-labels: # optional, default is 
+    # The reason to use when closing an issue.
+    close-issue-reason: # optional, default is not_planned
+    # The label to apply when a pull request is stale.
+    stale-pr-label: # optional, default is Stale
+    # The label to apply when a pull request is closed.
+    close-pr-label: # optional
+    # The labels that mean a pull request is exempt from being marked as stale. Separate multiple labels with commas (eg. "label1,label2").
+    exempt-pr-labels: # optional, default is 
+    # The milestones that mean an issue or a pull request is exempt from being marked as stale. Separate multiple milestones with commas (eg. "milestone1,milestone2").
+    exempt-milestones: # optional, default is 
+    # The milestones that mean an issue is exempt from being marked as stale. Separate multiple milestones with commas (eg. "milestone1,milestone2"). Override "exempt-milestones" option regarding only the issues.
+    exempt-issue-milestones: # optional, default is 
+    # The milestones that mean a pull request is exempt from being marked as stale. Separate multiple milestones with commas (eg. "milestone1,milestone2"). Override "exempt-milestones" option regarding only the pull requests.
+    exempt-pr-milestones: # optional, default is 
+    # Exempt all issues and pull requests with milestones from being marked as stale. Default to false.
+    exempt-all-milestones: # optional, default is false
+    # Exempt all issues with milestones from being marked as stale. Override "exempt-all-milestones" option regarding only the issues.
+    exempt-all-issue-milestones: # optional, default is 
+    # Exempt all pull requests with milestones from being marked as stale. Override "exempt-all-milestones" option regarding only the pull requests.
+    exempt-all-pr-milestones: # optional, default is 
+    # Only issues or pull requests with all of these labels are checked if stale. Defaults to `` (disabled) and can be a comma-separated list of labels.
+    only-labels: # optional, default is 
+    # Only issues or pull requests with at least one of these labels are checked if stale. Defaults to `` (disabled) and can be a comma-separated list of labels.
+    any-of-labels: # optional, default is 
+    # Only issues with at least one of these labels are checked if stale. Defaults to `` (disabled) and can be a comma-separated list of labels. Override "any-of-labels" option regarding only the issues.
+    any-of-issue-labels: # optional, default is 
+    # Only pull requests with at least one of these labels are checked if stale. Defaults to `` (disabled) and can be a comma-separated list of labels. Override "any-of-labels" option regarding only the pull requests.
+    any-of-pr-labels: # optional, default is 
+    # Only issues with all of these labels are checked if stale. Defaults to `[]` (disabled) and can be a comma-separated list of labels. Override "only-labels" option regarding only the issues.
+    only-issue-labels: # optional, default is 
+    # Only pull requests with all of these labels are checked if stale. Defaults to `[]` (disabled) and can be a comma-separated list of labels. Override "only-labels" option regarding only the pull requests.
+    only-pr-labels: # optional, default is 
+    # The maximum number of operations per run, used to control rate limiting (GitHub API CRUD related).
+    operations-per-run: # optional, default is 30
+    # Remove stale labels from issues and pull requests when they are updated or commented on.
+    remove-stale-when-updated: # optional, default is true
+    # Remove stale labels from issues when they are updated or commented on. Override "remove-stale-when-updated" option regarding only the issues.
+    remove-issue-stale-when-updated: # optional, default is 
+    # Remove stale labels from pull requests when they are updated or commented on. Override "remove-stale-when-updated" option regarding only the pull requests.
+    remove-pr-stale-when-updated: # optional, default is 
+    # Run the processor in debug mode without actually performing any operations on live issues.
+    debug-only: # optional, default is false
+    # The order to get issues or pull requests. Defaults to false, which is descending.
+    ascending: # optional, default is false
+    # What to sort results by. Valid options are `created`, `updated`, and `comments`. Defaults to `created`.
+    sort-by: # optional, default is created
+    # Delete the git branch after closing a stale pull request.
+    delete-branch: # optional, default is false
+    # The date used to skip the stale action on issue/pull request created before it (ISO 8601 or RFC 2822).
+    start-date: # optional, default is 
+    # The assignees which exempt an issue or a pull request from being marked as stale. Separate multiple assignees with commas (eg. "user1,user2").
+    exempt-assignees: # optional, default is 
+    # The assignees which exempt an issue from being marked as stale. Separate multiple assignees with commas (eg. "user1,user2"). Override "exempt-assignees" option regarding only the issues.
+    exempt-issue-assignees: # optional, default is 
+    # The assignees which exempt a pull request from being marked as stale. Separate multiple assignees with commas (eg. "user1,user2"). Override "exempt-assignees" option regarding only the pull requests.
+    exempt-pr-assignees: # optional, default is 
+    # Exempt all issues and pull requests with assignees from being marked as stale. Default to false.
+    exempt-all-assignees: # optional, default is false
+    # Exempt all issues with assignees from being marked as stale. Override "exempt-all-assignees" option regarding only the issues.
+    exempt-all-issue-assignees: # optional, default is 
+    # Exempt all pull requests with assignees from being marked as stale. Override "exempt-all-assignees" option regarding only the pull requests.
+    exempt-all-pr-assignees: # optional, default is 
+    # Exempt draft pull requests from being marked as stale. Default to false.
+    exempt-draft-pr: # optional, default is false
+    # Display some statistics at the end regarding the stale workflow (only when the logs are enabled).
+    enable-statistics: # optional, default is true
+    # A comma delimited list of labels to add when an issue or pull request becomes unstale.
+    labels-to-add-when-unstale: # optional, default is 
+    # A comma delimited list of labels to remove when an issue or pull request becomes stale.
+    labels-to-remove-when-stale: # optional, default is 
+    # A comma delimited list of labels to remove when an issue or pull request becomes unstale.
+    labels-to-remove-when-unstale: # optional, default is 
+    # Any update (update/comment) can reset the stale idle time on the issues and pull requests.
+    ignore-updates: # optional, default is false
+    # Any update (update/comment) can reset the stale idle time on the issues. Override "ignore-updates" option regarding only the issues.
+    ignore-issue-updates: # optional, default is 
+    # Any update (update/comment) can reset the stale idle time on the pull requests. Override "ignore-updates" option regarding only the pull requests.
+    ignore-pr-updates: # optional, default is 
+    # Only the issues or the pull requests with an assignee will be marked as stale automatically.
+    include-only-assigned: # optional, default is false
+    # Only issues with a matching type are processed as stale/closed. Defaults to `[]` (disabled) and can be a comma-separated list of issue types.
+    only-issue-types: # optional, default is 

From 86fdf17cfdd514c99f6fad5b83f0c0d017ce8484 Mon Sep 17 00:00:00 2001
From: Bot <montoyaraul34@gmail.com>
Date: Sat, 4 Jul 2026 00:09:00 -0500
Subject: [PATCH 02/18] ci: harden GitHub Actions per #11 (Codecov
 https://about.codecov.io/language/rust/, schedule, concurrency, rust-cache,
 llvm-cov upload, separate ymls ready; remove junk rust.yml; fmt cleanup for
 green checks; README dev/CI section)

- Implements key ACs from #11 (and reviews: Codecov, no gpu test, separate yml pref)
- Aligns local to remote + enhancements from corinth patterns (one-way inspiration, no dep)
- Prepares for #8/#9 cross refs and other CI issues
- Addresses local divergence (junk rust.yml gone)

Refs #11, #8, #9
---
 .github/codecov.yml        |  24 ++++++
 .github/workflows/ci.yml   |  75 +++++++++++++++++
 .github/workflows/rust.yml | 164 -------------------------------------
 README.md                  |  45 +++++++++-
 src/gguf/cursor.rs         |   6 +-
 src/gguf/layout.rs         |  24 ++++--
 src/gguf/tensor.rs         |  10 +--
 src/lib.rs                 |   4 +-
 src/moe/extract.rs         |  16 ++--
 9 files changed, 174 insertions(+), 194 deletions(-)
 create mode 100644 .github/codecov.yml
 create mode 100644 .github/workflows/ci.yml
 delete mode 100644 .github/workflows/rust.yml

diff --git a/.github/codecov.yml b/.github/codecov.yml
new file mode 100644
index 0000000..1b38302
--- /dev/null
+++ b/.github/codecov.yml
@@ -0,0 +1,24 @@
+# Minimal Codecov config for Rust (per https://about.codecov.io/language/rust/ and #11 AC)
+# We will use codecov https://about.codecov.io/language/rust/
+codecov:
+  require_ci_to_pass: true
+
+coverage:
+  precision: 2
+  round: down
+  range: "70...100"
+
+  status:
+    project: true
+    patch: true
+    changes: false
+
+parsers:
+  gcov:
+    branch_detection:
+      conditional: yes
+      loop: yes
+      method: no
+      macro: no
+
+comment: false
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..3a70ed9
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,75 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 0 * * *'  # Run daily at midnight
+
+concurrency:
+  group: ci-cpu-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Build & Test
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+    steps:
+      # actions/checkout@v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+
+      # dtolnay/rust-toolchain@stable
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          components: clippy, rustfmt
+
+      - name: Install components (rustfmt, clippy, llvm-tools)
+        run: rustup component add rustfmt clippy llvm-tools-preview
+
+      # Swatinem/rust-cache@v2 (adopted from corinth-canal for better caching)
+      - name: Cache Cargo + target
+        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2
+        with:
+          shared-key: "cpu-ci-v1"
+          cache-on-failure: true
+
+      - name: Check formatting
+        run: cargo fmt --check
+
+      - name: Clippy (lint)
+        run: cargo clippy --all-targets --all-features -- -D warnings
+
+      - name: Build
+        run: cargo build --all-features
+
+      - name: Test
+        run: cargo test --all-features
+
+      # Coverage using Codecov (per review: "We will use codecov https://about.codecov.io/language/rust/")
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@16b05812d776ae1dfaabc8277e421fb6d2506419 # v2
+        with:
+          tool: cargo-llvm-cov
+
+      - name: Generate coverage report
+        run: cargo llvm-cov --lib --all-features --locked --lcov --output-path lcov.info
+
+      - name: Upload coverage to Codecov
+        if: ${{ env.CODECOV_TOKEN != '' }}
+        uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5
+        with:
+          token: ${{ env.CODECOV_TOKEN }}
+          files: lcov.info
+          fail_ci_if_error: true
+          verbose: true
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
deleted file mode 100644
index 4e35d4d..0000000
--- a/.github/workflows/rust.yml
+++ /dev/null
@@ -1,164 +0,0 @@
-name: Rust
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v4
-    - name: Build
-      run: cargo build --verbose
-    - name: Run tests
-      run: cargo test --verbose
-      
-name: Cache
-  uses: actions/cache@v5.1.0
-  with:
-    # A list of files, directories, and wildcard patterns to cache and restore
-    path: 
-    # An explicit key for restoring and saving the cache
-    key: 
-    # An ordered multiline string listing the prefix-matched keys, that are used for restoring stale cache if no cache hit occurred for key. Note `cache-hit` returns false in this case.
-    restore-keys: # optional
-    # The chunk size used to split up large files during upload, in bytes
-    upload-chunk-size: # optional
-    # An optional boolean when enabled, allows windows runners to save or restore caches that can be restored or saved respectively on other platforms
-    enableCrossOsArchive: # optional, default is false
-    # Fail the workflow if cache entry is not found
-    fail-on-cache-miss: # optional, default is false
-    # Check if a cache entry exists for the given input(s) (key, restore-keys) without downloading the cache
-    lookup-only: # optional, default is false
-    # Run the post step to save the cache even if another step before fails
-    save-always: # optional, default is false
-
-name: Download a Build Artifact
-  uses: actions/download-artifact@v3.1.0
-  with:
-    # Artifact name
-    name: # optional
-    # Destination path
-    path: # optional
-
-name: Close Stale Issues
-  uses: actions/stale@v10.3.0
-  with:
-    # Token for the repository. Can be passed in using `{{ secrets.GITHUB_TOKEN }}`.
-    repo-token: # optional, default is ${{ github.token }}
-    # The message to post on the issue when tagging it. If none provided, will not mark issues stale.
-    stale-issue-message: # optional
-    # The message to post on the pull request when tagging it. If none provided, will not mark pull requests stale.
-    stale-pr-message: # optional
-    # The message to post on the issue when closing it. If none provided, will not comment when closing an issue.
-    close-issue-message: # optional
-    # The message to post on the pull request when closing it. If none provided, will not comment when closing a pull requests.
-    close-pr-message: # optional
-    # The number of days old an issue or a pull request can be before marking it stale. Set to -1 to never mark issues or pull requests as stale automatically.
-    days-before-stale: # optional, default is 60
-    # The number of days old an issue can be before marking it stale. Set to -1 to never mark issues as stale automatically. Override "days-before-stale" option regarding only the issues.
-    days-before-issue-stale: # optional
-    # The number of days old a pull request can be before marking it stale. Set to -1 to never mark pull requests as stale automatically. Override "days-before-stale" option regarding only the pull requests.
-    days-before-pr-stale: # optional
-    # The number of days to wait to close an issue or a pull request after it being marked stale. Set to -1 to never close stale issues or pull requests.
-    days-before-close: # optional, default is 7
-    # The number of days to wait to close an issue after it being marked stale. Set to -1 to never close stale issues. Override "days-before-close" option regarding only the issues.
-    days-before-issue-close: # optional
-    # The number of days to wait to close a pull request after it being marked stale. Set to -1 to never close stale pull requests. Override "days-before-close" option regarding only the pull requests.
-    days-before-pr-close: # optional
-    # The label to apply when an issue is stale.
-    stale-issue-label: # optional, default is Stale
-    # The label to apply when an issue is closed.
-    close-issue-label: # optional
-    # The labels that mean an issue is exempt from being marked stale. Separate multiple labels with commas (eg. "label1,label2").
-    exempt-issue-labels: # optional, default is 
-    # The reason to use when closing an issue.
-    close-issue-reason: # optional, default is not_planned
-    # The label to apply when a pull request is stale.
-    stale-pr-label: # optional, default is Stale
-    # The label to apply when a pull request is closed.
-    close-pr-label: # optional
-    # The labels that mean a pull request is exempt from being marked as stale. Separate multiple labels with commas (eg. "label1,label2").
-    exempt-pr-labels: # optional, default is 
-    # The milestones that mean an issue or a pull request is exempt from being marked as stale. Separate multiple milestones with commas (eg. "milestone1,milestone2").
-    exempt-milestones: # optional, default is 
-    # The milestones that mean an issue is exempt from being marked as stale. Separate multiple milestones with commas (eg. "milestone1,milestone2"). Override "exempt-milestones" option regarding only the issues.
-    exempt-issue-milestones: # optional, default is 
-    # The milestones that mean a pull request is exempt from being marked as stale. Separate multiple milestones with commas (eg. "milestone1,milestone2"). Override "exempt-milestones" option regarding only the pull requests.
-    exempt-pr-milestones: # optional, default is 
-    # Exempt all issues and pull requests with milestones from being marked as stale. Default to false.
-    exempt-all-milestones: # optional, default is false
-    # Exempt all issues with milestones from being marked as stale. Override "exempt-all-milestones" option regarding only the issues.
-    exempt-all-issue-milestones: # optional, default is 
-    # Exempt all pull requests with milestones from being marked as stale. Override "exempt-all-milestones" option regarding only the pull requests.
-    exempt-all-pr-milestones: # optional, default is 
-    # Only issues or pull requests with all of these labels are checked if stale. Defaults to `` (disabled) and can be a comma-separated list of labels.
-    only-labels: # optional, default is 
-    # Only issues or pull requests with at least one of these labels are checked if stale. Defaults to `` (disabled) and can be a comma-separated list of labels.
-    any-of-labels: # optional, default is 
-    # Only issues with at least one of these labels are checked if stale. Defaults to `` (disabled) and can be a comma-separated list of labels. Override "any-of-labels" option regarding only the issues.
-    any-of-issue-labels: # optional, default is 
-    # Only pull requests with at least one of these labels are checked if stale. Defaults to `` (disabled) and can be a comma-separated list of labels. Override "any-of-labels" option regarding only the pull requests.
-    any-of-pr-labels: # optional, default is 
-    # Only issues with all of these labels are checked if stale. Defaults to `[]` (disabled) and can be a comma-separated list of labels. Override "only-labels" option regarding only the issues.
-    only-issue-labels: # optional, default is 
-    # Only pull requests with all of these labels are checked if stale. Defaults to `[]` (disabled) and can be a comma-separated list of labels. Override "only-labels" option regarding only the pull requests.
-    only-pr-labels: # optional, default is 
-    # The maximum number of operations per run, used to control rate limiting (GitHub API CRUD related).
-    operations-per-run: # optional, default is 30
-    # Remove stale labels from issues and pull requests when they are updated or commented on.
-    remove-stale-when-updated: # optional, default is true
-    # Remove stale labels from issues when they are updated or commented on. Override "remove-stale-when-updated" option regarding only the issues.
-    remove-issue-stale-when-updated: # optional, default is 
-    # Remove stale labels from pull requests when they are updated or commented on. Override "remove-stale-when-updated" option regarding only the pull requests.
-    remove-pr-stale-when-updated: # optional, default is 
-    # Run the processor in debug mode without actually performing any operations on live issues.
-    debug-only: # optional, default is false
-    # The order to get issues or pull requests. Defaults to false, which is descending.
-    ascending: # optional, default is false
-    # What to sort results by. Valid options are `created`, `updated`, and `comments`. Defaults to `created`.
-    sort-by: # optional, default is created
-    # Delete the git branch after closing a stale pull request.
-    delete-branch: # optional, default is false
-    # The date used to skip the stale action on issue/pull request created before it (ISO 8601 or RFC 2822).
-    start-date: # optional, default is 
-    # The assignees which exempt an issue or a pull request from being marked as stale. Separate multiple assignees with commas (eg. "user1,user2").
-    exempt-assignees: # optional, default is 
-    # The assignees which exempt an issue from being marked as stale. Separate multiple assignees with commas (eg. "user1,user2"). Override "exempt-assignees" option regarding only the issues.
-    exempt-issue-assignees: # optional, default is 
-    # The assignees which exempt a pull request from being marked as stale. Separate multiple assignees with commas (eg. "user1,user2"). Override "exempt-assignees" option regarding only the pull requests.
-    exempt-pr-assignees: # optional, default is 
-    # Exempt all issues and pull requests with assignees from being marked as stale. Default to false.
-    exempt-all-assignees: # optional, default is false
-    # Exempt all issues with assignees from being marked as stale. Override "exempt-all-assignees" option regarding only the issues.
-    exempt-all-issue-assignees: # optional, default is 
-    # Exempt all pull requests with assignees from being marked as stale. Override "exempt-all-assignees" option regarding only the pull requests.
-    exempt-all-pr-assignees: # optional, default is 
-    # Exempt draft pull requests from being marked as stale. Default to false.
-    exempt-draft-pr: # optional, default is false
-    # Display some statistics at the end regarding the stale workflow (only when the logs are enabled).
-    enable-statistics: # optional, default is true
-    # A comma delimited list of labels to add when an issue or pull request becomes unstale.
-    labels-to-add-when-unstale: # optional, default is 
-    # A comma delimited list of labels to remove when an issue or pull request becomes stale.
-    labels-to-remove-when-stale: # optional, default is 
-    # A comma delimited list of labels to remove when an issue or pull request becomes unstale.
-    labels-to-remove-when-unstale: # optional, default is 
-    # Any update (update/comment) can reset the stale idle time on the issues and pull requests.
-    ignore-updates: # optional, default is false
-    # Any update (update/comment) can reset the stale idle time on the issues. Override "ignore-updates" option regarding only the issues.
-    ignore-issue-updates: # optional, default is 
-    # Any update (update/comment) can reset the stale idle time on the pull requests. Override "ignore-updates" option regarding only the pull requests.
-    ignore-pr-updates: # optional, default is 
-    # Only the issues or the pull requests with an assignee will be marked as stale automatically.
-    include-only-assigned: # optional, default is false
-    # Only issues with a matching type are processed as stale/closed. Defaults to `[]` (disabled) and can be a comma-separated list of issue types.
-    only-issue-types: # optional, default is 
diff --git a/README.md b/README.md
index d244420..008448a 100644
--- a/README.md
+++ b/README.md
@@ -50,4 +50,47 @@ is returned as raw `Vec<u8>`.
 
 `load_gguf`, `parse_bytes`, `GgufLayout`, `GgufMetadata`, `Tensor`,
 `DType`, `extract_expert`, `list_experts`, `MoeExpertWeights`,
-`RawTensor`, `ParserError`, `Result`.
\ No newline at end of file
+`RawTensor`, `ParserError`, `Result`.
+
+## Ecosystem / Sibling parsers (LIM-9)
+
+- **engram-parser** (this crate): canonical zero-dep GGUF v3 deserializer + per-expert MoE raw weight ripper.
+- Safetensors extraction (header inspection, deterministic manifest, MoE router/expert candidate discovery via classify + groups + layout families) from `rmems/corinth-canal` (experimental source of inspiration) is tracked as a **separate issue** in this repo: #10 (parallel to the GGUF work in #7).
+  - Source-side bootstrap/supporting: rmems/corinth-canal#116.
+  - Coordination for consumers (e.g. future multi-format in cortex): Limen-Neural/cortex-tensor#9.
+  - The reusable implementation will target a dedicated Limen-Neural crate (per org boundary matrix LIM-9); engram-parser charter remains GGUF-only.
+- **Clarification**: one-way extraction/copy of code from inspiration. We are not adding any dependency from corinth-canal. corinth-canal keeps an unmodified reference copy (per its PROMOTION_RULES "frozen" status). See #10, #7, and the plan for full cross-links and "no dep on corinth-canal" language.
+
+Cross-links and updates performed when #10 was created.
+
+## Development
+
+This is a pure-Rust, zero-dependency crate. All commands use `--all-features`.
+
+```bash
+# Format
+cargo fmt --check
+
+# Lint (fail on warnings)
+cargo clippy --all-targets --all-features -- -D warnings
+
+# Build
+cargo build --all-features
+
+# Test
+cargo test --all-features
+
+# Coverage (local; uses cargo-llvm-cov)
+cargo llvm-cov --lib --all-features --locked --lcov --output-path lcov.info
+```
+
+## CI
+
+- GitHub Actions: `.github/workflows/ci.yml` (harden in progress via #11; uses Codecov per https://about.codecov.io/language/rust/ )
+- Azure Pipelines: `azure-pipelines.yml` (tracked in #8 for cross-platform ubuntu/mac/windows)
+- Docker: `Dockerfile` + `.github/workflows/docker-build.yml` (tracked in #9 for GHCR reproducible builds; use user's Docker CLI for local verification)
+- Other CI/DX issues: #12 (security), #13 (releases on tags w/ sentry option), #14 (MSRV), #15 (Dependabot no auto-merge), #16 (layout clean)
+
+See the issue bodies for full ACs and corinth-canal inspiration patterns (one-way copy only; no dep on corinth-canal).
+
+Cross-reference: #11, #8, #9, #7, #5, LIM-9.
diff --git a/src/gguf/cursor.rs b/src/gguf/cursor.rs
index 4cb67c4..f58cabf 100644
--- a/src/gguf/cursor.rs
+++ b/src/gguf/cursor.rs
@@ -137,9 +137,9 @@ impl<'a> GgufCursor<'a> {
             VT_U64 => self.read_u64(),
             VT_I64 => Ok(self.read_i64()? as u64),
             VT_BOOL => Ok(self.read_u8()? as u64),
-            other => Err(self.unsupported(format!(
-                "expected numeric GGUF value, got type {other}"
-            ))),
+            other => {
+                Err(self.unsupported(format!("expected numeric GGUF value, got type {other}")))
+            }
         }
     }
 
diff --git a/src/gguf/layout.rs b/src/gguf/layout.rs
index 9ce80bd..b51514a 100644
--- a/src/gguf/layout.rs
+++ b/src/gguf/layout.rs
@@ -100,10 +100,12 @@ impl GgufLayout {
 
     /// Lookup a tensor by exact name.
     pub fn tensor(&self, name: &str) -> Result<&Tensor> {
-        self.tensors.get(name).ok_or_else(|| ParserError::MissingTensor {
-            name: name.to_owned(),
-            path: self.path.clone(),
-        })
+        self.tensors
+            .get(name)
+            .ok_or_else(|| ParserError::MissingTensor {
+                name: name.to_owned(),
+                path: self.path.clone(),
+            })
     }
 
     /// Find all tensors whose name ends with the given suffix. Useful
@@ -121,7 +123,10 @@ impl GgufLayout {
 
 /// Parse the GGUF header + KV metadata + tensor directory out of a
 /// byte slice. Does not validate payload bytes, only directory offsets.
-pub(crate) fn parse_layout(bytes: &[u8], path: &str) -> Result<(GgufMetadata, HashMap<String, Tensor>, usize, usize)> {
+pub(crate) fn parse_layout(
+    bytes: &[u8],
+    path: &str,
+) -> Result<(GgufMetadata, HashMap<String, Tensor>, usize, usize)> {
     let mut cursor = GgufCursor::new(bytes, path);
 
     let magic = cursor.read_exact(4)?;
@@ -192,9 +197,12 @@ pub(crate) fn parse_layout(bytes: &[u8], path: &str) -> Result<(GgufMetadata, Ha
         let relative_offset = cursor.read_u64()? as usize;
         let dtype = DType::from_ggml_type(ggml_type);
 
-        let n_elements = dims.iter().try_fold(1usize, |acc, &d| acc.checked_mul(d)).ok_or_else(
-            || invalid_layout(path, format!("tensor '{name}' element count overflow")),
-        )?;
+        let n_elements = dims
+            .iter()
+            .try_fold(1usize, |acc, &d| acc.checked_mul(d))
+            .ok_or_else(|| {
+                invalid_layout(path, format!("tensor '{name}' element count overflow"))
+            })?;
         let byte_len = dtype.byte_len_for_elements(n_elements).ok_or_else(|| {
             invalid_layout(
                 path,
diff --git a/src/gguf/tensor.rs b/src/gguf/tensor.rs
index 6677647..9f10c3c 100644
--- a/src/gguf/tensor.rs
+++ b/src/gguf/tensor.rs
@@ -178,9 +178,8 @@ impl Tensor {
         }
         // SAFETY: dtype, length, and alignment all checked above; lifetime
         // is tied to the input slice which borrows the owning layout.
-        let slice = unsafe {
-            std::slice::from_raw_parts(bytes.as_ptr() as *const f32, self.n_elements)
-        };
+        let slice =
+            unsafe { std::slice::from_raw_parts(bytes.as_ptr() as *const f32, self.n_elements) };
         Ok(slice)
     }
 
@@ -210,9 +209,8 @@ impl Tensor {
             });
         }
         // SAFETY: dtype, length, and alignment checked above.
-        let slice = unsafe {
-            std::slice::from_raw_parts(bytes.as_ptr() as *const u16, self.n_elements)
-        };
+        let slice =
+            unsafe { std::slice::from_raw_parts(bytes.as_ptr() as *const u16, self.n_elements) };
         Ok(slice)
     }
 
diff --git a/src/lib.rs b/src/lib.rs
index 12cac1b..dcdad7a 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -29,7 +29,5 @@ pub mod gguf;
 pub mod moe;
 
 pub use error::{ParserError, Result};
-pub use gguf::{
-    DType, GgufLayout, GgufMetadata, Tensor, f16_bits_to_f32, load_gguf, parse_bytes,
-};
+pub use gguf::{DType, GgufLayout, GgufMetadata, Tensor, f16_bits_to_f32, load_gguf, parse_bytes};
 pub use moe::{MoeExpertWeights, RawTensor, extract_expert, list_experts};
diff --git a/src/moe/extract.rs b/src/moe/extract.rs
index 7256bc5..e193853 100644
--- a/src/moe/extract.rs
+++ b/src/moe/extract.rs
@@ -115,11 +115,7 @@ fn extract_role(
 /// dimension in the `dims` vector. The per-expert chunk consists of
 /// the first `n_elements / n_experts` elements per expert, laid out
 /// contiguously in the tensor buffer.
-fn slice_stacked_expert(
-    layout: &GgufLayout,
-    tensor: &Tensor,
-    expert: usize,
-) -> Result<RawTensor> {
+fn slice_stacked_expert(layout: &GgufLayout, tensor: &Tensor, expert: usize) -> Result<RawTensor> {
     let n_experts = stacked_expert_count(tensor).ok_or_else(|| ParserError::InvalidLayout {
         path: layout.path.clone(),
         reason: format!(
@@ -149,10 +145,12 @@ fn slice_stacked_expert(
         });
     }
     let stride = tensor.byte_len / n_experts;
-    let start = expert.checked_mul(stride).ok_or_else(|| ParserError::InvalidLayout {
-        path: layout.path.clone(),
-        reason: format!("stacked stride overflow for tensor '{}'", tensor.name),
-    })?;
+    let start = expert
+        .checked_mul(stride)
+        .ok_or_else(|| ParserError::InvalidLayout {
+            path: layout.path.clone(),
+            reason: format!("stacked stride overflow for tensor '{}'", tensor.name),
+        })?;
     let end = start + stride;
     if end > bytes.len() {
         return Err(ParserError::InvalidLayout {

From 2d432222034842fdae3dbd0d574c4a87a0c0d3c4 Mon Sep 17 00:00:00 2001
From: Bot <montoyaraul34@gmail.com>
Date: Sat, 4 Jul 2026 16:25:32 -0500
Subject: [PATCH 03/18] feat: combine #9 (Docker workflow + GHCR) and #11
 (harden GH Actions CI) into one PR

- #11: hardened ci.yml (schedule, concurrency, Swatinem/rust-cache, Codecov per your review link, etc.), added codecov.yml, README Development/CI section, removed junk rust.yml, fmt cleanup
- #9: added Dockerfile (multi-stage CPU-only, RUST_VERSION=1.85 for edition2024, .dockerignore to exclude nested dir/target for clean builds) + .github/workflows/docker-build.yml (modeled on corinth, standard ubuntu runners, GHA cache, GHCR publish only on main)
- Per user: one PR for 9+11; skipping #8 (Azure) for now
- Using your Docker CLI wrapper for any local verification (as required in reviews)

Refs #9 #11
---
 .dockerignore                      |  6 +++
 .github/workflows/docker-build.yml | 61 ++++++++++++++++++++++++++++++
 Dockerfile                         | 59 +++++++++++++++++++++++++++++
 3 files changed, 126 insertions(+)
 create mode 100644 .dockerignore
 create mode 100644 .github/workflows/docker-build.yml
 create mode 100644 Dockerfile

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..e55ac7a
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,6 @@
+# Ignore junk for Docker builds (helps with the duplicated layout issue)
+engram-parser/
+target/
+**/.git
+**/*.rs.bk
+Cargo.lock  # will be copied explicitly if needed, but manifests are first
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
new file mode 100644
index 0000000..1898014
--- /dev/null
+++ b/.github/workflows/docker-build.yml
@@ -0,0 +1,61 @@
+name: Docker Build
+
+on:
+  pull_request:
+    branches:
+      - '**'
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: docker-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build Docker Image (CPU-only)
+    permissions:
+      contents: read
+      packages: write
+    # Standard GitHub runners (no self-hosted GPU for this CPU-only crate)
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+
+      - name: Set Docker tags
+        id: tags
+        run: |
+          REPO="ghcr.io/${{ github.repository }}"
+          TAGS="${REPO}:${{ github.sha }}"
+          if [ "${{ github.event_name }}" = "push" ] && [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            TAGS="$TAGS,${REPO}:main"
+          fi
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            TAGS="$TAGS,${REPO}:pr-${{ github.event.number }}"
+          fi
+          echo "tags=$TAGS" >> $GITHUB_OUTPUT
+
+      - name: Login to GitHub Container Registry (only on main push for publish)
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build Docker Image
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
+        with:
+          context: .
+          push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+          tags: ${{ steps.tags.outputs.tags }}
+          # No build-args needed (CPU-only, stable Rust in Dockerfile)
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..cb5c854
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,59 @@
+# syntax=docker/dockerfile:1.4
+#
+# Dockerfile for engram-parser (pure-Rust, zero-dep GGUF/MoE parser).
+# Multi-stage for small image and reproducible CI builds.
+# 
+# Build with user's Docker CLI (as per review): use your wrapper/alias for `docker`.
+# Example verification:
+#   docker build --target builder -t engram-parser-builder .
+#   docker run --rm engram-parser-builder cargo test --all-features
+#
+# See .github/workflows/docker-build.yml and issue #9 for usage in CI (GHCR on main).
+# Follows corinth-canal patterns adapted for CPU-only / no CUDA.
+# Avoids A && B || C anti-pattern (Codacy warning) by using explicit grouping or separate RUNs.
+
+ARG RUST_VERSION=1.85
+
+# Builder stage: compile with all features for verification
+FROM rust:${RUST_VERSION}-slim AS builder
+
+WORKDIR /app
+
+# System deps for Rust (minimal for this zero-dep crate)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    pkg-config \
+    libssl-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy manifests first for better layer caching
+COPY Cargo.toml Cargo.lock ./
+
+# Create dummy main to cache deps (since no [[bin]] by default, use the lib + test)
+RUN mkdir src && echo "fn main() {}" > src/main.rs && \
+    cargo build --release --all-features && \
+    rm -rf src
+
+# Now copy real source
+COPY . .
+
+# Build (this layer will be cached on source changes only)
+# Note: we build the lib + run tests in CI job; here we just ensure it builds
+RUN cargo build --release --all-features
+
+# Runtime / verification stage (minimal)
+FROM debian:stable-slim AS runtime
+
+RUN useradd -m -u 10001 appuser
+
+WORKDIR /app
+
+# Copy the built artifacts (for if we expose a binary later, e.g. gguf_smoke)
+COPY --from=builder /app/target/release /app/target/release
+
+# For library use, the image mainly serves as a reproducible build env.
+# You can also cargo install or use as base for downstream.
+
+USER appuser
+
+# Default: show help if a binary is present; otherwise this is a build image
+CMD ["cargo", "--version"]

From bfece09cbf10b0bc3c3feb5a25f62bf4e24e70f8 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 15:18:47 +0000
Subject: [PATCH 04/18] fix: address Devin Review bugs in Docker/CI config

- .dockerignore: remove Cargo.lock exclusion that broke Docker COPY
- Dockerfile: fix CMD to use echo instead of unavailable cargo binary
- Dockerfile: remove unnecessary pkg-config/libssl-dev (zero-dep crate)
- Dockerfile: remove no-op dummy-main dep caching layer
- Dockerfile: copy only library artifact instead of entire target/release
- ci.yml: consolidate redundant rustup component install into dtolnay action
- docker-build.yml: fix checkout action SHA (was invalid v5, now v4.2.2)

Co-Authored-By: Raul Montoya Cardenas  <montoyaraul34@gmail.com>
---
 .dockerignore                      |  1 -
 .github/workflows/ci.yml           |  5 +----
 .github/workflows/docker-build.yml |  3 ++-
 Dockerfile                         | 29 +++++++----------------------
 4 files changed, 10 insertions(+), 28 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index e55ac7a..2cc9f6d 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -3,4 +3,3 @@ engram-parser/
 target/
 **/.git
 **/*.rs.bk
-Cargo.lock  # will be copied explicitly if needed, but manifests are first
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3a70ed9..5560b30 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,10 +32,7 @@ jobs:
       - name: Install Rust stable
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
         with:
-          components: clippy, rustfmt
-
-      - name: Install components (rustfmt, clippy, llvm-tools)
-        run: rustup component add rustfmt clippy llvm-tools-preview
+          components: clippy, rustfmt, llvm-tools-preview
 
       # Swatinem/rust-cache@v2 (adopted from corinth-canal for better caching)
       - name: Cache Cargo + target
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 1898014..f22e145 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -25,7 +25,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      # actions/checkout@v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           persist-credentials: false
 
diff --git a/Dockerfile b/Dockerfile
index cb5c854..455a41f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,25 +19,13 @@ FROM rust:${RUST_VERSION}-slim AS builder
 
 WORKDIR /app
 
-# System deps for Rust (minimal for this zero-dep crate)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    pkg-config \
-    libssl-dev \
-    && rm -rf /var/lib/apt/lists/*
-
-# Copy manifests first for better layer caching
+# Copy manifests and lock file for reproducibility
 COPY Cargo.toml Cargo.lock ./
 
-# Create dummy main to cache deps (since no [[bin]] by default, use the lib + test)
-RUN mkdir src && echo "fn main() {}" > src/main.rs && \
-    cargo build --release --all-features && \
-    rm -rf src
-
-# Now copy real source
+# Copy source
 COPY . .
 
-# Build (this layer will be cached on source changes only)
-# Note: we build the lib + run tests in CI job; here we just ensure it builds
+# Build the crate (zero external deps, no system packages needed)
 RUN cargo build --release --all-features
 
 # Runtime / verification stage (minimal)
@@ -47,13 +35,10 @@ RUN useradd -m -u 10001 appuser
 
 WORKDIR /app
 
-# Copy the built artifacts (for if we expose a binary later, e.g. gguf_smoke)
-COPY --from=builder /app/target/release /app/target/release
-
-# For library use, the image mainly serves as a reproducible build env.
-# You can also cargo install or use as base for downstream.
+# Copy only the compiled library artifact (not the entire target/release tree)
+COPY --from=builder /app/target/release/libengram_parser.rlib /app/lib/
 
 USER appuser
 
-# Default: show help if a binary is present; otherwise this is a build image
-CMD ["cargo", "--version"]
+# Library crate with no binary target; default to a no-op informational message.
+CMD ["echo", "engram-parser: use as base image or override CMD"]

From a5fee4a3591f1998f6171bccf5dcdc28980aa5b0 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 15:23:20 +0000
Subject: [PATCH 05/18] fix: add docker/setup-buildx-action for GHA cache
 support

The docker driver does not support cache-from/cache-to type=gha.
setup-buildx-action creates a docker-container driver that does.

Co-Authored-By: Raul Montoya Cardenas  <montoyaraul34@gmail.com>
---
 .github/workflows/docker-build.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index f22e145..246a3ca 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -30,6 +30,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+
       - name: Set Docker tags
         id: tags
         run: |

From d7674bfde6edecf70315c68aa68e4ff74023491c Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 15:27:07 +0000
Subject: [PATCH 06/18] fix: bump RUST_VERSION to 1.87 (matches MSRV) +
 lowercase Docker tags
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Dockerfile: RUST_VERSION 1.85 → 1.87 to match Cargo.toml rust-version
- docker-build.yml: lowercase github.repository for valid Docker tags

Co-Authored-By: Raul Montoya Cardenas  <montoyaraul34@gmail.com>
---
 .github/workflows/docker-build.yml | 2 +-
 Dockerfile                         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 246a3ca..8415aa6 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -36,7 +36,7 @@ jobs:
       - name: Set Docker tags
         id: tags
         run: |
-          REPO="ghcr.io/${{ github.repository }}"
+          REPO="ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
           TAGS="${REPO}:${{ github.sha }}"
           if [ "${{ github.event_name }}" = "push" ] && [ "${{ github.ref }}" = "refs/heads/main" ]; then
             TAGS="$TAGS,${REPO}:main"
diff --git a/Dockerfile b/Dockerfile
index 455a41f..a2d66c6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,7 +12,7 @@
 # Follows corinth-canal patterns adapted for CPU-only / no CUDA.
 # Avoids A && B || C anti-pattern (Codacy warning) by using explicit grouping or separate RUNs.
 
-ARG RUST_VERSION=1.85
+ARG RUST_VERSION=1.87
 
 # Builder stage: compile with all features for verification
 FROM rust:${RUST_VERSION}-slim AS builder

From 53e94ad5ecb24d96f47a7b42b3321d2d5b3a1651 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 15:29:02 +0000
Subject: [PATCH 07/18] fix: make Codecov upload non-blocking (repo may not be
 configured yet)

Co-Authored-By: Raul Montoya Cardenas  <montoyaraul34@gmail.com>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5560b30..21d3aa2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -68,5 +68,5 @@ jobs:
         with:
           token: ${{ env.CODECOV_TOKEN }}
           files: lcov.info
-          fail_ci_if_error: true
+          fail_ci_if_error: false
           verbose: true

From ce7aeab92272d94a0d8a861c0439befd65391168 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 15:34:49 +0000
Subject: [PATCH 08/18] fix: simplify Dockerfile to single-stage (library crate
 has no binary)

Remove non-functional runtime stage that copied an .rlib into a
debian image with no Rust toolchain. The image now serves as a
CI verification / reproducible build environment with cargo available.

Co-Authored-By: Raul Montoya Cardenas  <montoyaraul34@gmail.com>
---
 Dockerfile | 44 +++++++++++++++++++-------------------------
 README.md  |  7 +++----
 2 files changed, 22 insertions(+), 29 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index a2d66c6..9c096c2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,21 +1,25 @@
 # syntax=docker/dockerfile:1.4
 #
 # Dockerfile for engram-parser (pure-Rust, zero-dep GGUF/MoE parser).
-# Multi-stage for small image and reproducible CI builds.
-# 
-# Build with user's Docker CLI (as per review): use your wrapper/alias for `docker`.
-# Example verification:
-#   docker build --target builder -t engram-parser-builder .
-#   docker run --rm engram-parser-builder cargo test --all-features
+# Single-stage build for CI verification and reproducible builds.
 #
-# See .github/workflows/docker-build.yml and issue #9 for usage in CI (GHCR on main).
-# Follows corinth-canal patterns adapted for CPU-only / no CUDA.
-# Avoids A && B || C anti-pattern (Codacy warning) by using explicit grouping or separate RUNs.
+# engram-parser is a library crate with no binary target, so there is no
+# standalone artifact to deploy to a runtime image. This image is used for:
+#   - CI build/test verification
+#   - Reproducible build environment
+#   - Base image for downstream crates that depend on engram-parser
+#
+# Usage:
+#   docker build -t engram-parser .
+#   docker run --rm engram-parser cargo test --all-features
+#
+# See .github/workflows/docker-build.yml and issue #9 for CI (GHCR on main).
 
 ARG RUST_VERSION=1.87
 
-# Builder stage: compile with all features for verification
-FROM rust:${RUST_VERSION}-slim AS builder
+FROM rust:${RUST_VERSION}-slim
+
+RUN useradd -m -u 10001 appuser
 
 WORKDIR /app
 
@@ -25,20 +29,10 @@ COPY Cargo.toml Cargo.lock ./
 # Copy source
 COPY . .
 
-# Build the crate (zero external deps, no system packages needed)
-RUN cargo build --release --all-features
-
-# Runtime / verification stage (minimal)
-FROM debian:stable-slim AS runtime
-
-RUN useradd -m -u 10001 appuser
-
-WORKDIR /app
-
-# Copy only the compiled library artifact (not the entire target/release tree)
-COPY --from=builder /app/target/release/libengram_parser.rlib /app/lib/
+# Build and test the crate (zero external deps, no system packages needed)
+RUN cargo build --release --all-features && \
+    cargo test --release --all-features
 
 USER appuser
 
-# Library crate with no binary target; default to a no-op informational message.
-CMD ["echo", "engram-parser: use as base image or override CMD"]
+CMD ["cargo", "test", "--all-features"]
diff --git a/README.md b/README.md
index 1010239..fbe8f59 100644
--- a/README.md
+++ b/README.md
@@ -127,12 +127,11 @@ cargo llvm-cov --lib --all-features --locked --lcov --output-path lcov.info
 ## Docker
 
 ```bash
-# Build the image locally
+# Build the image locally (includes build + test verification)
 docker build -t engram-parser .
 
-# Build only the builder stage (for running tests)
-docker build --target builder -t engram-parser-builder .
-docker run --rm engram-parser-builder cargo test --all-features
+# Run tests in the container
+docker run --rm engram-parser
 
 # Pull from GHCR (published on merges to main)
 docker pull ghcr.io/limen-neural/engram-parser:main

From 5a382a401f7328c45605160b7f4cd858c8e5b211 Mon Sep 17 00:00:00 2001
From: Bot <montoyaraul34@gmail.com>
Date: Tue, 7 Jul 2026 10:35:05 -0500
Subject: [PATCH 09/18] fix: address remaining bot review comments

- Pin Debian base image to bookworm-slim for reproducibility
- Move GitHub expressions to env vars to prevent template injection
- Both changes address coderabbitai review feedback

Co-Authored-By: Mimo Code agent: MiMo-V2.5
---
 .github/workflows/docker-build.yml | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 8415aa6..31ac94a 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -35,14 +35,20 @@ jobs:
 
       - name: Set Docker tags
         id: tags
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          REF: ${{ github.ref }}
+          PR_NUMBER: ${{ github.event.number }}
+          COMMIT_SHA: ${{ github.sha }}
+          REPO_RAW: ${{ github.repository }}
         run: |
-          REPO="ghcr.io/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
-          TAGS="${REPO}:${{ github.sha }}"
-          if [ "${{ github.event_name }}" = "push" ] && [ "${{ github.ref }}" = "refs/heads/main" ]; then
+          REPO="ghcr.io/$(echo "$REPO_RAW" | tr '[:upper:]' '[:lower:]')"
+          TAGS="${REPO}:${COMMIT_SHA}"
+          if [ "$EVENT_NAME" = "push" ] && [ "$REF" = "refs/heads/main" ]; then
             TAGS="$TAGS,${REPO}:main"
           fi
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            TAGS="$TAGS,${REPO}:pr-${{ github.event.number }}"
+          if [ "$EVENT_NAME" = "pull_request" ]; then
+            TAGS="$TAGS,${REPO}:pr-${PR_NUMBER}"
           fi
           echo "tags=$TAGS" >> $GITHUB_OUTPUT
 

From fec84323d28e1a359fc18dc0a83aa9b31172bdec Mon Sep 17 00:00:00 2001
From: Bot <montoyaraul34@gmail.com>
Date: Tue, 7 Jul 2026 11:27:17 -0500
Subject: [PATCH 10/18] fix: address remaining bot review comments

- Change coverage command from --lib to --all-targets (codacy suggestion)
- Fixes coverage to include integration tests and doc tests

Addresses review feedback from codacy-production and coderabbitai bots.

Co-Authored-By: Mimo Code agent: MiMo-V2.5
---
 .github/workflows/ci.yml | 2 +-
 README.md                | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 21d3aa2..75e22b1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -60,7 +60,7 @@ jobs:
           tool: cargo-llvm-cov
 
       - name: Generate coverage report
-        run: cargo llvm-cov --lib --all-features --locked --lcov --output-path lcov.info
+        run: cargo llvm-cov --all-targets --all-features --locked --lcov --output-path lcov.info
 
       - name: Upload coverage to Codecov
         if: ${{ env.CODECOV_TOKEN != '' }}
diff --git a/README.md b/README.md
index fbe8f59..7fb10b9 100644
--- a/README.md
+++ b/README.md
@@ -121,7 +121,7 @@ cargo build --all-features
 cargo test --all-features
 
 # Coverage (local; requires cargo-llvm-cov: cargo install cargo-llvm-cov)
-cargo llvm-cov --lib --all-features --locked --lcov --output-path lcov.info
+cargo llvm-cov --all-targets --all-features --locked --lcov --output-path lcov.info
 ```
 
 ## Docker

From 6cf0e32e450014bef6ac27d4e9a969b93efa1c23 Mon Sep 17 00:00:00 2001
From: Raul Montoya Cardenas <montoyaraul34@gmail.com>
Date: Tue, 7 Jul 2026 12:05:31 -0500
Subject: [PATCH 11/18] Update Dockerfile

Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 Dockerfile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 9c096c2..af61446 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -33,6 +33,8 @@ COPY . .
 RUN cargo build --release --all-features && \
     cargo test --release --all-features
 
+RUN chown -R appuser:appuser /app
+
 USER appuser
 
 CMD ["cargo", "test", "--all-features"]

From 4e90722b8b5467ad56d47236bc2ffd787827bdd9 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 17:15:01 +0000
Subject: [PATCH 12/18] fix: add --release to CMD to match build step and avoid
 recompilation

Co-Authored-By: Raul Montoya Cardenas  <montoyaraul34@gmail.com>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index af61446..ad06eaa 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -37,4 +37,4 @@ RUN chown -R appuser:appuser /app
 
 USER appuser
 
-CMD ["cargo", "test", "--all-features"]
+CMD ["cargo", "test", "--release", "--all-features"]

From fe1bf98529700941d5d3d3fdf98b453a70f70242 Mon Sep 17 00:00:00 2001
From: Raul Montoya Cardenas <montoyaraul34@gmail.com>
Date: Tue, 7 Jul 2026 12:45:08 -0500
Subject: [PATCH 13/18] Update .github/workflows/ci.yml

Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 75e22b1..1d51ad0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,8 +9,8 @@ on:
     - cron: '0 0 * * *'  # Run daily at midnight
 
 concurrency:
-  group: ci-cpu-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  group: ci-cpu-${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read

From 2c1643e830ece4b59f77631a73b3a377d4cc0834 Mon Sep 17 00:00:00 2001
From: Bot <montoyaraul34@gmail.com>
Date: Tue, 7 Jul 2026 22:34:34 -0500
Subject: [PATCH 14/18] fix: address remaining PR #17 review comments
 (overflow, clean-tree, permissions)

Addresses three outstanding review comments from PR #17:

1. src/moe/extract.rs: Use checked_add for end calculation in
   stacked_slice_range to prevent overflow from untrusted GGUF
   metadata (codacy-production review).

2. .github/workflows/ci.yml: Add clean-tree guard step after
   build+test to verify no unexpected artifacts are left behind
   (qodo-code-review).

3. .github/workflows/docker-build.yml: Split Docker workflow into
   build (minimal permissions for PRs) + publish (packages:write
   only on main push) jobs to follow least-privilege principle
   (qodo-code-review).

Co-Authored-By: Cline agent: Deepseek-v4-flash
---
 .github/workflows/ci.yml           | 10 +++++++
 .github/workflows/docker-build.yml | 46 ++++++++++++++++++++++++++----
 .gitignore                         |  2 ++
 src/moe/extract.rs                 |  7 ++++-
 4 files changed, 58 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1d51ad0..771064b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -53,6 +53,16 @@ jobs:
       - name: Test
         run: cargo test --all-features
 
+      # Verify build/test leaves no unexpected artifacts (clean-tree guard per qodo review)
+      - name: Check working tree is clean
+        run: |
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "❌ Working tree has unexpected changes after build+test:"
+            git status --short
+            exit 1
+          fi
+          echo "✅ Working tree is clean"
+
       # Coverage using Codecov (per review: "We will use codecov https://about.codecov.io/language/rust/")
       - name: Install cargo-llvm-cov
         uses: taiki-e/install-action@16b05812d776ae1dfaabc8277e421fb6d2506419 # v2
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 31ac94a..4bfd66e 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -20,7 +20,6 @@ jobs:
     name: Build Docker Image (CPU-only)
     permissions:
       contents: read
-      packages: write
     # Standard GitHub runners (no self-hosted GPU for this CPU-only crate)
     runs-on: ubuntu-latest
 
@@ -52,20 +51,55 @@ jobs:
           fi
           echo "tags=$TAGS" >> $GITHUB_OUTPUT
 
-      - name: Login to GitHub Container Registry (only on main push for publish)
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+      - name: Build Docker Image
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
+        with:
+          context: .
+          push: false
+          tags: ${{ steps.tags.outputs.tags }}
+          # No build-args needed (CPU-only, stable Rust in Dockerfile)
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  publish:
+    name: Publish to GHCR
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: build
+    permissions:
+      contents: read
+      packages: write
+    runs-on: ubuntu-latest
+
+    steps:
+      # actions/checkout@v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+
+      - name: Set Docker tags
+        id: tags
+        env:
+          COMMIT_SHA: ${{ github.sha }}
+          REPO_RAW: ${{ github.repository }}
+        run: |
+          REPO="ghcr.io/$(echo "$REPO_RAW" | tr '[:upper:]' '[:lower:]')"
+          echo "tags=${REPO}:${COMMIT_SHA},${REPO}:main" >> $GITHUB_OUTPUT
+
+      - name: Login to GitHub Container Registry
         uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build Docker Image
+      - name: Build and Push Docker Image
         uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: .
-          push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+          push: true
           tags: ${{ steps.tags.outputs.tags }}
           # No build-args needed (CPU-only, stable Rust in Dockerfile)
           cache-from: type=gha
-          cache-to: type=gha,mode=max
diff --git a/.gitignore b/.gitignore
index 74b27f1..eeb1374 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,5 @@
 /target
 /Cargo.lock.bak
 **/*.rs.bk
+.mimocode/
+engram-parser/
diff --git a/src/moe/extract.rs b/src/moe/extract.rs
index 02b0f1c..9e01d05 100644
--- a/src/moe/extract.rs
+++ b/src/moe/extract.rs
@@ -202,7 +202,12 @@ fn stacked_slice_range(
             path: layout.path.clone(),
             reason: format!("stacked stride overflow for tensor '{}'", tensor.name),
         })?;
-    let end = start + stride;
+    let end = start
+        .checked_add(stride)
+        .ok_or_else(|| ParserError::InvalidLayout {
+            path: layout.path.clone(),
+            reason: format!("stacked end overflow for tensor '{}'", tensor.name),
+        })?;
     if end > buffer_len {
         return Err(ParserError::InvalidLayout {
             path: layout.path.clone(),

From daa99599544003fcc19612cc16379c2632c12569 Mon Sep 17 00:00:00 2001
From: Bot <montoyaraul34@gmail.com>
Date: Tue, 7 Jul 2026 22:54:19 -0500
Subject: [PATCH 15/18] fix: address remaining PR #17 bot review comments
 (round 2)

- Dockerfile: Add RUN cargo fetch between manifest COPY and source COPY
  to complete the Docker layer caching pattern for future dependency use
  (devin-ai-integration review)

- docker-build.yml: Make cancel-in-progress conditional on pull_request
  events (like ci.yml), preventing accidental cancellation of main-branch
  Docker image publications (devin-ai-integration review)

- docker-build.yml: Use github.event.pull_request.head.sha for PR builds
  instead of github.sha (merge commit), providing more intuitive source
  traceability for PR Docker image tags (devin-ai-integration review)

Co-Authored-By: Cline agent: Deepseek-v4-pro
---
 .github/workflows/docker-build.yml | 4 ++--
 Dockerfile                         | 4 ++++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 4bfd66e..163fd7a 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -10,7 +10,7 @@ on:
 
 concurrency:
   group: docker-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read
@@ -38,7 +38,7 @@ jobs:
           EVENT_NAME: ${{ github.event_name }}
           REF: ${{ github.ref }}
           PR_NUMBER: ${{ github.event.number }}
-          COMMIT_SHA: ${{ github.sha }}
+          COMMIT_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
           REPO_RAW: ${{ github.repository }}
         run: |
           REPO="ghcr.io/$(echo "$REPO_RAW" | tr '[:upper:]' '[:lower:]')"
diff --git a/Dockerfile b/Dockerfile
index ad06eaa..72ebcbf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,6 +26,10 @@ WORKDIR /app
 # Copy manifests and lock file for reproducibility
 COPY Cargo.toml Cargo.lock ./
 
+# Pre-fetch dependencies (no-op for zero-deps today, enables layer caching
+# when dependencies are added in the future)
+RUN cargo fetch
+
 # Copy source
 COPY . .
 

From 87c6c1adf308ec4860319e8086f3023c4ee5e9b6 Mon Sep 17 00:00:00 2001
From: Bot <montoyaraul34@gmail.com>
Date: Tue, 7 Jul 2026 23:08:58 -0500
Subject: [PATCH 16/18] fix: revert cargo fetch (fails without src/ present at
 COPY stage)

cargo fetch requires a target (src/lib.rs, src/main.rs, [lib], or [[bin]])
to parse Cargo.toml. Since source is copied after manifests, cargo fetch
fails with "no targets specified in the manifest". The Docker layer caching
pattern is already adequately handled by the separate COPY steps; adding
cargo fetch for a future crate with deps would also require dummy source
scaffolding (rejected for simplicity per ce7aeab single-stage design).

Verified: docker build succeeds, docker run passes all 6 tests.

Co-Authored-By: Cline agent: Deepseek-v4-pro
---
 Dockerfile | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 72ebcbf..ad06eaa 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,10 +26,6 @@ WORKDIR /app
 # Copy manifests and lock file for reproducibility
 COPY Cargo.toml Cargo.lock ./
 
-# Pre-fetch dependencies (no-op for zero-deps today, enables layer caching
-# when dependencies are added in the future)
-RUN cargo fetch
-
 # Copy source
 COPY . .
 

From e2a93947cace1019d339b1456910f64b642d2e86 Mon Sep 17 00:00:00 2001
From: Bot <montoyaraul34@gmail.com>
Date: Tue, 7 Jul 2026 23:11:08 -0500
Subject: [PATCH 17/18] fix: remove stale gcov parser from codecov config (CI
 generates lcov)

The parsers.gcov.branch_detection section in .github/codecov.yml was
dead config: CI generates lcov format via cargo llvm-cov --lcov, not
gcov. Removed to avoid confusion (flagged by devin-ai-integration).

Co-Authored-By: Cline agent: Deepseek-v4-pro
---
 .github/codecov.yml | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/.github/codecov.yml b/.github/codecov.yml
index 1b38302..daa2a2d 100644
--- a/.github/codecov.yml
+++ b/.github/codecov.yml
@@ -13,12 +13,5 @@ coverage:
     patch: true
     changes: false
 
-parsers:
-  gcov:
-    branch_detection:
-      conditional: yes
-      loop: yes
-      method: no
-      macro: no
-
+# CI generates lcov format (cargo llvm-cov --lcov); no gcov parser needed.
 comment: false

From eaa90b2270de522cbc439be0ff5fb12cd64a5b52 Mon Sep 17 00:00:00 2001
From: Bot <montoyaraul34@gmail.com>
Date: Tue, 7 Jul 2026 23:31:46 -0500
Subject: [PATCH 18/18] fix: merge publish job back into single Docker build
 job (no Skipped checks)

The separate publish job (if: push to main, needs: build) showed as
"Skipped" in the PR checks UI, cluttering the status list. Merged back
into a single build job with login+push gated by if conditions. The
packages:write permission is requested at the job level but the token
is only used for publishing on main pushes (login and push steps both
have the same if guard).

Co-Authored-By: Cline agent: DeepSeek-v4-pro
---
 .github/workflows/docker-build.yml | 45 ++++--------------------------
 1 file changed, 5 insertions(+), 40 deletions(-)

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 163fd7a..b943ee6 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -20,7 +20,7 @@ jobs:
     name: Build Docker Image (CPU-only)
     permissions:
       contents: read
-    # Standard GitHub runners (no self-hosted GPU for this CPU-only crate)
+      packages: write
     runs-on: ubuntu-latest
 
     steps:
@@ -51,55 +51,20 @@ jobs:
           fi
           echo "tags=$TAGS" >> $GITHUB_OUTPUT
 
-      - name: Build Docker Image
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
-        with:
-          context: .
-          push: false
-          tags: ${{ steps.tags.outputs.tags }}
-          # No build-args needed (CPU-only, stable Rust in Dockerfile)
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-  publish:
-    name: Publish to GHCR
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    needs: build
-    permissions:
-      contents: read
-      packages: write
-    runs-on: ubuntu-latest
-
-    steps:
-      # actions/checkout@v4.2.2
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-        with:
-          persist-credentials: false
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
-
-      - name: Set Docker tags
-        id: tags
-        env:
-          COMMIT_SHA: ${{ github.sha }}
-          REPO_RAW: ${{ github.repository }}
-        run: |
-          REPO="ghcr.io/$(echo "$REPO_RAW" | tr '[:upper:]' '[:lower:]')"
-          echo "tags=${REPO}:${COMMIT_SHA},${REPO}:main" >> $GITHUB_OUTPUT
-
       - name: Login to GitHub Container Registry
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and Push Docker Image
+      - name: Build Docker Image
         uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: .
-          push: true
+          push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
           tags: ${{ steps.tags.outputs.tags }}
           # No build-args needed (CPU-only, stable Rust in Dockerfile)
           cache-from: type=gha
+          cache-to: type=gha,mode=max