@panaversity/ksor 0.0.25 → 0.0.26

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # @panaversity/ksor
 
+## 0.0.26
+
+### Patch Changes
+
+- b90de22: Bound the container image: `.dockerignore` now denies everything and allows only
+  what the door needs.
+
+  The previous shape listed what to exclude, which cannot bound an image — it can
+  only exclude what someone thought of. A build output, a cache, a vendored
+  dependency or a backup directory in the project root all rode in, and the failure
+  arrived as a container registry rejecting the push (`PAYLOAD_TOO_LARGE`) rather
+  than as anything about the file that was added.
+
+  Now: `*`, then `!package.json`, `!instance.md`, and `system/gateways/` — this
+  door's own MCP registration. Everything else stays out, including the corpus (the
+  door serves from Postgres), the website (a separately hosted surface), and every
+  `.env` (a DSN baked into a layer is published to anyone who can pull the image).
+
+  The container acceptance job now reports the built image's size and fails past a
+  ceiling, so an allow-list that stops bounding it goes red here rather than at
+  someone's deploy.
+
 ## 0.0.25
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@panaversity/ksor",
-  "version": "0.0.25",
+  "version": "0.0.26",
   "description": "Knowledge System of Record — compile governed markdown into a static site for people and an MCP server for AI agents, with citations and measured abstention.",
   "keywords": [
     "abstention",

package/templates/scaffold/dockerignore

@@ -1,29 +1,32 @@
-# Keep the serving image to what serving needs.
+# DENY EVERYTHING, then allow exactly what the door needs.
+#
+# The inverse — listing what to exclude — cannot bound the image, because it can
+# only exclude what someone thought of. A build output, a cache, a backup
+# directory or a vendored dependency in the project root all end up inside, and
+# the failure arrives as a registry rejecting the push rather than as anything
+# about the file you added (found live: PAYLOAD_TOO_LARGE).
+#
+# So: nothing ships unless it is named here.
+*
 
-# Secrets. The image takes its configuration from the environment at RUN time;
-# baking a .env into a layer publishes it to anyone who can pull the image.
-.env
-.env.*
-!.env.example
+# The manifest, which pins @panaversity/ksor and is what `npm install` reads.
+!package.json
 
-# The corpus. The door serves from Postgres — knowledge/ was published by
-# `ksor ingest` before this container ever started, and copying it in would
-# suggest the container reads it. It does not.
-knowledge/
+# The record's identity and configuration. Its prose is the MCP server's
+# instructions, so the door genuinely needs the file.
+!instance.md
 
-# The website — the OTHER surface, built and hosted separately. NOT all of
-# system/: system/gateways/ holds this door's own registration, and excluding
-# it made the container silently serve the default tool surface while the
-# repository said otherwise (found live).
-system/site/
+# This door's own MCP registration — what its tools are called, what it says it
+# covers, and which of them exist. Excluding it makes the container serve the
+# default surface while your repository says otherwise.
+!system
+system/*
+!system/gateways
 
-# Build and tooling noise.
-node_modules/
-.git/
-.github/
-.agents/
-.claude/
-.gemini/
-*.log
-.DS_Store
-.ksor-denylist.json
+# Deliberately NOT here, and each for a reason:
+#   .env          configuration arrives from the environment at run time; a DSN
+#                 baked into a layer is published to anyone who can pull it.
+#   knowledge/    the door serves from Postgres. Copying the corpus in would
+#                 suggest the container reads it, and it never does.
+#   system/site/  the other surface, built and hosted separately.
+#   node_modules/ installed inside the image, from the manifest above.