[Phase 16] S13 — Packaging metadata, dependency single-source, container distribution #899

Roadmap · Phase 16, step S13 · size L · 7 unit(s) · planned in docs/roadmap/phase-16-trust-surface-hardening.md:682-721

Summary

The distribution surface — what a user installs and what they run it in — with one root cause: hand-maintained duplicates of a single truth. docker-compose.yaml mounts hf_cache:/root/.cache/huggingface while the image drops to USER forgelm, so the cache never persists (an artifact defect, not only a documentation one). The manual advertises three image variants (latest, slim, airgap) that nothing builds, and every documented docker run … forgelm --config … resolves to forgelm forgelm … against the shipped ENTRYPOINT.

Units

Blocked by

#888 — the standard this step is reviewed against; write it first.

Decisions this step executes

• C-15 — container distribution: local docker build is the contract; a published image is tracked as a condition (deferred issue).
• C-16 — fix the docker-compose.yaml cache path in the same change, with a ### Fixed entry naming the orphaned-volume effect.

Plan

• Delete the three phantom variants and re-derive README and both manuals from the artifacts on disk.
• Fix the compose cache path in the same change.

Exit criteria

• README and both manuals describe exactly one distribution path.
• A guard fails when a first-party registry reference has no backing publish workflow, when a compose file name in prose is absent from disk, or when a documented service name is absent from services:.
• The documented first container command succeeds in a workflow_dispatch smoke job.
• Two disposable docker compose run --rm invocations share one cached snapshot without root.
• The documented wizard command leaves a validated YAML on the host after --rm that passes python3 -m forgelm --config <file> --dry-run.
• A meta-test compares normalised direct dependencies between the nightly minimum-deps list and the package metadata.
• A clean isolated build emits no packaging-metadata deprecation warning and twine check dist/* passes.

How to deliver

• One root-cause family, committed on its own; then an Opus review round and a Sonnet review round, each with verified findings fixed and committed before the next step begins.
• A reproducer that is red before the fix and green after; the full gauntlet from CLAUDE.md passes under ./.venv/bin/python.
• Every English documentation edit ships with its Turkish mirror in the same commit; a new or renamed audit event gets its EN and TR catalog rows in the same PR.
• A step that grows a deferred module carries its budget_history justification in the same diff; a widened guard rolls out non-strict first, then flips.
• Commit bodies cite Absorbs F-W20260729-…; the CHANGELOG [Unreleased] section gets an entry only for a change a user or library consumer can observe (decision C-20).

_{Planned in docs/roadmap/phase-16-trust-surface-hardening.md (read at f94595f). Unit IDs (F-W20260729-…) come from the 2026-07-29/30 full-project review; the issue numbers next to them are the October 2026 review's records of the same defects.}