@panaversity/ksor 0.0.24 → 0.0.26

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # @panaversity/ksor
 
+## 0.0.26
+
+### Patch Changes
+
+- b90de22: Bound the container image: `.dockerignore` now denies everything and allows only
+  what the door needs.
+
+  The previous shape listed what to exclude, which cannot bound an image — it can
+  only exclude what someone thought of. A build output, a cache, a vendored
+  dependency or a backup directory in the project root all rode in, and the failure
+  arrived as a container registry rejecting the push (`PAYLOAD_TOO_LARGE`) rather
+  than as anything about the file that was added.
+
+  Now: `*`, then `!package.json`, `!instance.md`, and `system/gateways/` — this
+  door's own MCP registration. Everything else stays out, including the corpus (the
+  door serves from Postgres), the website (a separately hosted surface), and every
+  `.env` (a DSN baked into a layer is published to anyone who can pull the image).
+
+  The container acceptance job now reports the built image's size and fails past a
+  ceiling, so an allow-list that stops bounding it goes red here rather than at
+  someone's deploy.
+
+## 0.0.25
+
+### Patch Changes
+
+- ed2dce0: Fix the container serving the DEFAULT tool surface while the repository said
+  otherwise.
+
+  `.dockerignore` excluded all of `system/` — correct when that directory held only
+  the website, and wrong the moment the door's own registration moved into
+  `system/gateways/`. The file never reached the image, so a record that had
+  renamed its tools, dropped one, or written what it covers was deployed serving
+  none of it. Nothing went red: the door booted, `/health` was green, searches
+  returned cited hits, and only `tools/list` betrayed it.
+
+  It now excludes `system/site/`, and the Dockerfile copies the project rather than
+  naming files one at a time — which is how the door came to ship without the very
+  file that shapes its tool surface.
+
+  The container acceptance job now writes a customized registration before building
+  the image and asserts the served tool is the one that file names. Found by
+  deploying and looking at `tools/list`, which is the only thing that would have.
+
 ## 0.0.24
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@panaversity/ksor",
-  "version": "0.0.24",
+  "version": "0.0.26",
   "description": "Knowledge System of Record — compile governed markdown into a static site for people and an MCP server for AI agents, with citations and measured abstention.",
   "keywords": [
     "abstention",

package/templates/scaffold/Dockerfile

@@ -22,10 +22,12 @@ WORKDIR /app
 COPY package.json ./
 RUN npm install --omit=dev --no-audit --no-fund
 
-# The record's identity and configuration. The CORPUS is deliberately absent:
-# the door serves from Postgres, and knowledge/ belongs to the build that
-# published it — see .dockerignore.
-COPY instance.md ./
+# The record's identity, configuration, and its MCP registration
+# (system/gateways/). What is deliberately ABSENT is decided in .dockerignore —
+# the corpus, the website and every secret — rather than by listing files here:
+# naming them one at a time is how the door came to ship without the very file
+# that shapes its tool surface (found live).
+COPY . ./
 
 # Most container hosts inject PORT; 80 is a sane default when nothing does.
 ENV PORT=80

package/templates/scaffold/dockerignore

@@ -1,26 +1,32 @@
-# Keep the serving image to what serving needs.
+# DENY EVERYTHING, then allow exactly what the door needs.
+#
+# The inverse — listing what to exclude — cannot bound the image, because it can
+# only exclude what someone thought of. A build output, a cache, a backup
+# directory or a vendored dependency in the project root all end up inside, and
+# the failure arrives as a registry rejecting the push rather than as anything
+# about the file you added (found live: PAYLOAD_TOO_LARGE).
+#
+# So: nothing ships unless it is named here.
+*
 
-# Secrets. The image takes its configuration from the environment at RUN time;
-# baking a .env into a layer publishes it to anyone who can pull the image.
-.env
-.env.*
-!.env.example
+# The manifest, which pins @panaversity/ksor and is what `npm install` reads.
+!package.json
 
-# The corpus. The door serves from Postgres — knowledge/ was published by
-# `ksor ingest` before this container ever started, and copying it in would
-# suggest the container reads it. It does not.
-knowledge/
+# The record's identity and configuration. Its prose is the MCP server's
+# instructions, so the door genuinely needs the file.
+!instance.md
 
-# The website. It is the OTHER surface, built and hosted separately.
-system/
+# This door's own MCP registration — what its tools are called, what it says it
+# covers, and which of them exist. Excluding it makes the container serve the
+# default surface while your repository says otherwise.
+!system
+system/*
+!system/gateways
 
-# Build and tooling noise.
-node_modules/
-.git/
-.github/
-.agents/
-.claude/
-.gemini/
-*.log
-.DS_Store
-.ksor-denylist.json
+# Deliberately NOT here, and each for a reason:
+#   .env          configuration arrives from the environment at run time; a DSN
+#                 baked into a layer is published to anyone who can pull it.
+#   knowledge/    the door serves from Postgres. Copying the corpus in would
+#                 suggest the container reads it, and it never does.
+#   system/site/  the other surface, built and hosted separately.
+#   node_modules/ installed inside the image, from the manifest above.