Dockerfile.dockerignore drops integration test fixtures

Context

PR #12018 introduced ai/deploy/Dockerfile.dockerignore to keep the ai/deploy build context small after the first real cloud-deployment exercise exposed a 90 GB context risk. GitHub Actions was degraded at the time, so PR #12018 merged without ordinary PR CI signal. After GitHub Status moved Actions/Pages back to monitoring/operational on 2026-05-26, empty synchronize commits on unrelated PRs #12020 and #12021 finally triggered CI and exposed the current dev regression.

The Problem

ai/deploy/Dockerfile.dockerignore excludes the whole test tree:

test

That is valid for the production deploy-runtime instinct, but the integration-unified test harness still expects KB ingestion fixture files to exist inside the container at /app/test/playwright/integration/ai/kb-ingestion/fixtures/external-workspaces/....

Empirical CI evidence:

• PR #12021, Tests run 26449761852, integration-unified failed at test/playwright/integration/ai/kb-ingestion/multi-tenant.spec.mjs:579 with ENOENT: no such file or directory, open /app/test/playwright/integration/ai/kb-ingestion/fixtures/external-workspaces/mini-neo-workspace/expected-chunks.jsonl.
• PR #12020, Tests run 26449792723, also failed after retrigger on an unrelated docs-only branch.
• git diff --name-status origin/dev...origin/codex/12015-day0-container-runtimes touches only learn/agentos/cloud-deployment/Day0Tutorial.md.
• git diff --name-status origin/dev...origin/codex/11924-residual-comment-cleanup touches only GitHub workflow sync service files, not deploy Docker context or KB fixture files.
• git show 55865f816:ai/deploy/Dockerfile.dockerignore shows the new test exclusion on current origin/dev.

The failure is therefore a base regression from the new deploy Docker ignore policy, not a branch-specific failure in #12020 or #12021.

The Architectural Reality

Affected surfaces:

• ai/deploy/Dockerfile.dockerignore owns the deploy build context boundary.
• ai/deploy/Dockerfile builds the image that the integration harness runs as /app.
• test/playwright/integration/ai/kb-ingestion/multi-tenant.spec.mjs depends on fixture data under test/playwright/integration/ai/kb-ingestion/fixtures/external-workspaces/** being visible from inside that image.

The underlying tension is valid: the deploy image should not carry the whole repository test tree by default, but current integration coverage still has a fixture contract crossing that build-context boundary.

The Fix

Restore the narrow fixture contract without reopening the original large-context problem. Preferred implementation order:

1. Add a narrow negated allow-list in ai/deploy/Dockerfile.dockerignore for the KB ingestion fixture subtree required by integration-unified, if that works with Docker ignore ordering.
2. If narrow negation is too brittle, update the integration harness to mount or copy the fixture directory explicitly instead of relying on full test context visibility.

Do not simply remove the test exclusion wholesale unless the narrow option fails; the 90 GB build-context risk from #12017 remains real.

Contract Ledger

Decision Record impact

aligned-with ADR 0014 and the deploy buildability follow-up from #12017. No ADR successor risk; this restores the test contract around the already-accepted build-context shrink.

Acceptance Criteria

• The ai/deploy Docker build context still excludes broad non-runtime payloads such as apps, docs, examples, resources, learn, dist, node_modules, and generic test outputs.
• The KB ingestion fixture path needed by integration-unified is visible in the deploy image or mounted explicitly for the integration run.
• integration-unified no longer fails with ENOENT for /app/test/playwright/integration/ai/kb-ingestion/fixtures/external-workspaces/mini-neo-workspace/expected-chunks.jsonl.
• PR #12020 and PR #12021 can be interpreted as ordinary branch validations after rebasing/retriggering against the fixed dev baseline.

Out of Scope

• Reopening the entire deploy image context.
• Changing KB ingestion semantics.
• Any Caddy TLS hostname fix; that is tracked separately in #12022, though both are small enough to share one cloud-deploy follow-up PR.

Avoided Traps

• Blaming #12020 or #12021. Their diffs do not touch the missing fixture path or deploy Docker context.
• Removing the test exclusion wholesale. That would erase the original #12017 context-size win.
• Treating the earlier zero-check state and the later failed-check state as the same bug. The zero-check state was a GitHub Actions incident; this ticket covers the post-trigger CI regression.

Related

• #12017 — original build-context inflation ticket.
• #12018 — merged PR that introduced ai/deploy/Dockerfile.dockerignore during the Actions incident.
• #12020 and #12021 — unrelated PRs that exposed the regression once CI retriggered.
• #12022 — adjacent cloud-deploy Caddy TLS hostname bug.

Handoff Retrieval Hints

• Semantic: Dockerfile.dockerignore expected-chunks ENOENT, integration-unified fixture missing /app/test, PR #12018 dockerignore test exclusion regression.
• Actions runs: 26449761852 and 26449792723.
• Base commit: 55865f816 fix(deploy): restore cloud compose buildability (#12014, #12016, #12017, #12019) (#12018).