@panaversity/ksor 0.0.26 → 0.0.27

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @panaversity/ksor
 
+## 0.0.27
+
+### Patch Changes
+
+- 6bc9d8f: The emitted `Dockerfile` names the files it copies instead of `COPY . ./`.
+
+  **A `.dockerignore` is not honoured by every build host.** Vercel's container
+  builder ignores it, so `COPY . ./` swept in `node_modules` and the built site —
+  about a gigabyte — and the deploy failed with the registry rejecting the push as
+  `PAYLOAD_TOO_LARGE`. The error arrives from the host and says nothing about the
+  file that caused it.
+
+  Naming what enters the image is the only form portable across build hosts. The
+  `.dockerignore` stays as defence in depth for builders that do respect it, but it
+  is no longer what bounds the image.
+
+  The risk of naming files is forgetting one — which is exactly how the registration
+  file came to be missing from the image two releases ago. That is covered: the
+  container acceptance job boots the built image and asserts it serves the tools the
+  registration names, so a forgotten file fails there rather than at a deploy.
+
 ## 0.0.26
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@panaversity/ksor",
-  "version": "0.0.26",
+  "version": "0.0.27",
   "description": "Knowledge System of Record — compile governed markdown into a static site for people and an MCP server for AI agents, with citations and measured abstention.",
   "keywords": [
     "abstention",
@@ -71,8 +71,8 @@
     "tsdown": "0.22.14",
     "typescript": "7.0.2",
     "vitest": "^4.1.10",
-    "@panaversity/ksor-content": "0.0.0",
-    "@panaversity/ksor-content-gateway": "0.0.0"
+    "@panaversity/ksor-content-gateway": "0.0.0",
+    "@panaversity/ksor-content": "0.0.0"
   },
   "engines": {
     "node": ">=24"

package/templates/scaffold/Dockerfile

@@ -22,12 +22,16 @@ WORKDIR /app
 COPY package.json ./
 RUN npm install --omit=dev --no-audit --no-fund
 
-# The record's identity, configuration, and its MCP registration
-# (system/gateways/). What is deliberately ABSENT is decided in .dockerignore —
-# the corpus, the website and every secret — rather than by listing files here:
-# naming them one at a time is how the door came to ship without the very file
-# that shapes its tool surface (found live).
-COPY . ./
+# The record's identity and configuration, and this door's own MCP registration.
+#
+# NAMED, not `COPY . ./`. A .dockerignore is not honoured by every builder —
+# Vercel's is not, and `COPY . ./` there swept in node_modules and the built
+# site, producing a registry push rejected as PAYLOAD_TOO_LARGE (found live).
+# Naming what enters the image is the only form that is portable across build
+# hosts. The risk of naming things is forgetting one; that is covered by a test
+# which boots the built image and asserts it serves the tools this file names.
+COPY instance.md ./
+COPY system/gateways/ ./system/gateways/
 
 # Most container hosts inject PORT; 80 is a sane default when nothing does.
 ENV PORT=80

package/templates/scaffold/dockerignore

@@ -1,5 +1,10 @@
 # DENY EVERYTHING, then allow exactly what the door needs.
 #
+# Defence in depth, NOT the bound. The Dockerfile names the files it copies,
+# because a .dockerignore is not honoured by every build host — Vercel's is
+# not. This file protects local `docker build` and every builder that does
+# respect it; the Dockerfile protects the rest.
+#
 # The inverse — listing what to exclude — cannot bound the image, because it can
 # only exclude what someone thought of. A build output, a cache, a backup
 # directory or a vendored dependency in the project root all end up inside, and