I4229 — The image's build stage carries every file the crate embeds

○READY wave 0 · p2 · implementation profile · parallel safe

Part of development-runtime — The runtime has a development surface.

Objective

Fail validate, not the image build, when the executable embeds a file the image's compiling stages do not copy: a unit test of the Dockerfile renderer walks the package's non-test sources, resolves every include_str! and include_bytes! against the file that names it, and requires each to fall under a path the deps or build stage copies.

Why

Train 6 (I2674) embedded share/mesh-cache-provider/* in mesh/cache_provision.rs while the image's build stage copied apps/majordomus-cli alone, and master's docker-image job failed (run 40189935629 on 71857dbb609: couldn't read share/mesh-cache-provider/policy.json). A pull request builds the image only when the image's own definition changes, so the defect reached master unseen. Train 7 moved the payload under apps/majordomus-cli/assets/, which the build stage copies; #2523 wrote this guard alongside a COPY share fix that the move made unnecessary.

Current state

On 2efeacea031 nothing short of building the image checks that an embedded file reaches the build context.

Desired state

deploy::render::tests::the_build_stage_carries_every_file_the_package_embeds passes on master's layout and fails, naming the file and the path, when a source embeds a file outside what the deps and build stages copy.

Scope

• .ai/repo/project/issues/I4229.yaml
• apps/majordomus-cli/src/deploy/render.rs

Out of scope

• Changing what the image copies: master's layout already carries every embedded file
• Embeds written through concat! or env!, which name no literal path

Dependencies

None. This issue is a root of the graph.

Acceptance criteria

• The test passes on master's sources
• A source that embeds ../../../share/advisors.yaml fails the test, naming that source and that path

Validation

• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --lib deploy::render::tests::the_build_stage_carries_every_file_the_package_embeds

Evidence required

• embedded_files_reach_the_build_stage

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I4229.yaml. Read it back with majordomus plan show I4229.