From 219ca627230aa3b77b21a95a4dfbbbf169cf425c Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 14 Aug 2026 22:37:04 +0000 Subject: [PATCH] docker: remove the four ADD fetches that are blocking every deploy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit They are mine (3c76143) and they break the build. `AdaWorldAPI/ndarray`'s default branch is `master`, not `main`, so `.../ndarray/commits/main.atom` is a guaranteed 404 — and a failed `ADD` fails the build. Every deploy dies at step 11/16. Removed rather than corrected, because the whole block should not exist. It was added to bust the sibling-clone layer after a stale lance-graph clone took a deploy down — but what made a stale clone FATAL was `COUNT_FUSE`, a compile-time length assert that turned "this mirror is one concept behind OGAR" into E0080 at const-eval. lance-graph #954 removed that fuse: activation now checks the PLUGGED concepts against the mirror at runtime and names the drift. A slightly stale sibling compiles now; real drift surfaces where it can be read. So the fetches defended a failure class that had already been retired, and paid for it with four network calls in the build's critical path where any 404 or blip kills the deploy. The comment directly above them named that exact hazard and I shipped them anyway. Deletions only in effect — no build step changes, no clone step changes, no behaviour change beyond the layer being cacheable again. The comment that replaces them records why the block is absent, so it does not get re-added, and points at explicit SHA ARGs as the instrument to use if cache staleness needs solving: an ARG change busts the layer with zero network calls and fails legibly at `git checkout`. --- Dockerfile | 42 +++++++++++++++++------------------------- 1 file changed, 17 insertions(+), 25 deletions(-) diff --git a/Dockerfile b/Dockerfile index 1b1ca00b7e..a074a3c36b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -148,32 +148,24 @@ RUN cd /build/q2/.claude/maps \ # the first suspect. Two ways out: push any q2 commit (busts COPY, busts this), or # redeploy with the build cache disabled. # -# THE FIX BELOW makes the sibling HEADs an actual layer input. Each `ADD` of a -# repo's `commits/main` fetches on every build and writes a file whose CONTENT is -# that repo's current commit; Docker hashes it, so the clone layer busts exactly -# when a sibling moves and stays cached when none did. Four small requests buy -# back the property this comment used to claim for free. +# NO CACHE-BUST FETCH HERE, deliberately — and the reason is that the failure +# above no longer has teeth. What made a stale sibling clone FATAL was +# `lance-graph-ogar`'s COUNT_FUSE: a compile-time length assert that turned +# "this clone's codebook mirror is one concept behind OGAR" into E0080 at +# const-eval. lance-graph #954 removed it — activation now verifies the +# PLUGGED concepts against the mirror at runtime and reports drift by name +# (`MirrorDrift { concept, authority_id, mirror_id }`). A slightly stale +# sibling compiles; real drift surfaces where it can be read. # -# Unauthenticated on purpose — the same URLs the `git clone` lines below already -# fetch without credentials, so these are reachable on the same terms. -# -# ⚠ The ATOM FEED, not `api.github.com`, and the difference is load-bearing. -# Unauthenticated api.github.com allows 60 requests/hour PER IP, and CI builders -# share egress IPs — so the API form would eventually 403, and a failed `ADD` -# FAILS THE BUILD. That trades a stale cache for a new outage cause, which is -# the opposite of the point. `github.com//commits/main.atom` is served by -# the web frontend, is not under that quota, and its entries carry commit ids + -# commit dates, so its content changes exactly when HEAD moves. -# -# This does NOT replace the deeper choice — explicit SHA ARGs bumped -# deliberately, or removing the hand-maintained mirror via hotplug enumeration -# so the fuse's whole failure class disappears. Those are architectural calls, -# deliberately not made here. This one only restores "latest of everything" to -# being true per DEPLOY instead of per COMMIT. -ADD https://github.com/AdaWorldAPI/lance-graph/commits/main.atom /tmp/rev/lance-graph.atom -ADD https://github.com/AdaWorldAPI/ndarray/commits/main.atom /tmp/rev/ndarray.atom -ADD https://github.com/AdaWorldAPI/OGAR/commits/main.atom /tmp/rev/OGAR.atom -ADD https://github.com/AdaWorldAPI/openstreetmap-website-rs/commits/main.atom /tmp/rev/osm-website.atom +# An earlier revision of this file put four `ADD https://…/commits/main.atom` +# lines here to make sibling HEADs a layer input. That was the wrong +# instrument twice over: it defended a failure class that had already been +# retired, and it put four network fetches in the build's critical path where +# any 404 or blip kills the deploy — which is exactly what happened, because +# `AdaWorldAPI/ndarray`'s default branch is `master`, not `main`, so one of +# the four could only ever 404. If cache staleness needs solving again, solve +# it with explicit SHA ARGs (an ARG change busts the layer with zero network +# calls and fails legibly at `git checkout`), never with a build-time fetch. # # Sibling checkouts the path deps (and the [patch] in q2's Cargo.toml) resolve against: # /build/lance-graph → lance-graph @ main HEAD — carries guid-v2-tail +