saravanakumardb1
ba8b4d1ace
docs(docker): roadmap v5 — add F16 (registry workspace:* leaks)
...
Discovered during A0-V execution on learning_ai_clock (2026-05-27).
F16: At least 10 of ~50 published @bytelyst/* packages in the Gitea
registry have unrewritten 'workspace:*' refs in their package.json
dependencies. pnpm install inside Docker fails with
ERR_PNPM_WORKSPACE_PKG_NOT_FOUND because there is no workspace context
inside the container.
Confirmed broken (latest version each):
@bytelyst/auth@0.1.5 → errors=workspace:*
@bytelyst/diagnostics-client@0.1.6 → api-client=workspace:*
@bytelyst/events@0.1.5 → queue=workspace:*
@bytelyst/extraction@0.1.5 → api-client=workspace:*
@bytelyst/fastify-auth@0.1.5 → errors=workspace:*
@bytelyst/fastify-core@0.1.5 → errors=workspace:* ← clock dep
@bytelyst/feedback-client@0.1.6 → api-client=workspace:*
@bytelyst/field-encrypt@0.1.6 → errors=workspace:* ← clock dep
@bytelyst/react-auth@0.1.6 → api-client=workspace:*
@bytelyst/sync@0.1.5 → api-client, telemetry-client=workspace:*
Changes:
- § 0: bump count to 16; add F16 row (Critical severity)
- § 0 Implications: F16 blocks every A0-V; updated rationale
- § 3: insert new Phase A-pre (republish + publish-time guard) before A0
- § 3 A0-V: append blocked-status note linking to clock@0be887288
- § 10 Execution order: renumber; insert A-pre as step 3
- § 11 Risk register: add F16 row
Implementation status:
✅ Step 2 (A0 on clock) — committed in learning_ai_clock@0be887288;
Dockerfile + compose changes correct, end-to-end build blocked on F16
⏸ Step 3 (A-pre) — next; touches common-plat publish flow
⏸ Step 4+ (A0-V retry on clock, then onward) — blocked on A-pre
2026-05-27 01:18:25 -07:00
saravanakumardb1
8025cd5d82
docs(docker): roadmap v4 — integrate Gitea hardening (F14, F15)
...
Adds 2 new findings to the docker build optimization roadmap and updates
templates to consume the new GITEA_NPM_OWNER env var shipped in common-plat
commit 610a59fd.
- F14: hardcoded Gitea owner literal across 14 repos (now resolved upstream
via ${GITEA_NPM_OWNER:-learning_ai_user})
- F15: stale shell-env tokens (caught by scripts/gitea/doctor.sh)
- A0-1, A0-3, 7.1, 7.2, 7.5: snippets updated to thread GITEA_NPM_OWNER
through .npmrc.docker, Dockerfile ARG/ENV, and docker-compose build args
- A0-D: new step — run gitea-doctor.sh as pre-build gate (replaces
'wait 4 minutes for ERR_PNPM_AUTHENTICATION' with 'fail fast in 2 sec')
- Phase E: now distinguishes gitea-doctor (shipped) from docker-doctor (to
build). Adds two new docker-doctor checks for F14
- Risk register: F14/F15 mitigations called out explicitly
2026-05-27 00:53:33 -07:00
saravanakumardb1
1a638a84e1
docs: roadmap v3 — incorporate review feedback (F11-F13, Phase E)
...
Review-driven additions:
- F11 added (silent UI breakage from missing/un-COPY'd postcss.config.mjs;
4 repos hit this tonight: notes dff459e, jarvis_jr 36f6bc1,
clock a308c6444, local_memory_gpt 07cdf6b)
- F12 added (healthcheck localhost → IPv6 false-fail; jarvis_jr incident)
- F13 added (enumerated COPY drift from filesystem; root cause of F11b)
Structural changes:
- New A8 (config-file COPY audit + glob pattern decision)
- New A9 (healthcheck IPv4 canonicalization)
- New A0-V verification gate (build Gitea path before optimizing)
- New § 2.5 canonical decisions (Alpine + ARG BASE_IMAGE override,
127.0.0.1, --lockfile=false pending ADR)
- New § 7.5 canonical web Dockerfile (was missing, where F11 lives)
- New § 7.6 docker-doctor.sh skeleton
- New Phase E (docker-doctor.sh CI lint as durable insurance)
- B7 promoted from Phase D to Phase B proper (drift compounds)
- B4 husky hook extended to also block .tgz and .bak
- A0-1 env-var expansion chain explicitly documented
- A2-3 verification command corrected (docker buildx du, not docker history)
- Pilot order inverted: clock first (web + backend), then peakpulse
- C9 smoke test added (CSS bundle > 50 KB, F11 guard)
- 4 new risk-register rows for F11/F12/F13/BASE_IMAGE drift
2026-05-27 00:34:07 -07:00
saravanakumardb1
529d4f37f5
docs: add Docker build optimization roadmap (post-audit v2)
...
Captures audit findings on Dockerfile patterns across pilot repos
(peakpulse, clock):
- 10 concrete bugs documented (F1-F10): .dockerignore blocks
pnpm-lock.yaml, sibling-workspace lockfile problem, .npmrc.docker
inconsistencies, missing BuildKit cache mounts, etc.
- Phase A0 added: fix Gitea-registry path before optimizing
(without it, the 'default' path doesn't actually work)
- Phase A1-A7: corepack, cache mounts, layer reordering, measurement
- Phase B: docker-prep.sh hardening (dry-run, idempotency,
auto-restore, pre-commit guard)
- Phase C: 7 verification gates
- Phase D: deferred 11-repo rollout checklist
- ADR-pending lockfile policy decision (A3)
- Risk register + 6 open questions
2026-05-27 00:28:10 -07:00
