Kimi review on #581 found two real gaps:
1. docker/jaguar-toolchain.Dockerfile.dockerignore's `!tools` negation
didn't actually scope the build context. A bare `*` only matches
root-level entries (Go's filepath.Match, no `/` crossing), so nothing
under tools/ was ever excluded to begin with -- `!tools` was a no-op
re-include of an already-included tree. Fixed with the standard
Docker per-level exclude/re-include chain (tools/*, !tools/
jaguar-toolchain, tools/jaguar-toolchain/*, then the two leaf files).
Harmless in CI (fresh checkout, builder stage only COPYs PIN/setup.sh
regardless) but was sending a dev machine's full tools/vendor/
jaguar-toolchain/ (real clones + build artifacts) as build context.
2. Neither workflow's `paths:` filter covered the .dockerignore file
itself, and jaguar-toolchain-image.yml didn't cover its own filename
-- so a broken .dockerignore (finding 1) or an edit to the publish
workflow would silently run zero CI. Added both.
Consolidated fix pass over the 9-task Jaguar toolchain plan's final
whole-branch review:
- Add a no-push "docker build" validation step to jaguar-toolchain.yml so
the Dockerfile is actually exercised in CI; correct
jaguar-toolchain-image.yml's header comment, which falsely claimed that
coverage already existed.
- Add tools/jaguar-toolchain/setup.sh to jaguar-toolchain-image.yml's
paths: trigger -- the Dockerfile COPYs it, so editing it must republish.
- Align jaguar-toolchain.yml on actions/checkout@v7 (repo convention,
matches its sibling workflow).
- Add an OCI description LABEL to the Dockerfile's final stage crediting
42Bastian for new_bjl/lyxass, since the published image itself (not just
the README) redistributes those Unlicense-credited binaries.
- README: state plainly that BootIntro-style demos needing
`jagcrypt -tursi` still fail to build against the pinned pc_jagcrypt (a
real upstream gap, 38/54 JaguarDemos Makefiles affected) without
retracting the true claim that toolchain discovery/build wiring works;
add the jagcrypt binary to the pin-refresh verification checklist.
- Add timeout-minutes + a concurrency block (PR-triggered workflow) to
guard against rln's plain-HTTP fetch hanging; tighten the smoke step's
`command -v` check to a per-tool loop so a missing tool actually fails
the build.
Docker was unavailable in this environment (as in Task 7), so the new
validation step and LABEL are verified by YAML/shell syntax checks only,
not an actual build -- documented in
.superpowers/sdd/2026-08-23-jaguar-toolchain/final-fix-report.md.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Multi-stage image: builder stage runs tools/jaguar-toolchain/setup.sh
fetch+build (Tasks 1-3) on debian:bookworm-slim to compile rmac, rln,
lyxass, pc_jagcrypt from source; final stage carries only the built
binaries + new_bjl data tree, with PATH/BJL_ROOT set via ENV.
Reconciled against the brief's draft: the final stage's advertised use
case (`docker run <image> make jaguar-demos-build` against a mounted
repo copy) needs `git`+`ca-certificates` there too, not just the
builder stage -- `jaguar-demos-build` hard-depends on
`jaguar-demos-fetch`, which shells out to git every invocation
(verified via `make -n jaguar-demos-build`). Also added
`git config --global --add safe.directory '*'` since a root container
against a host-owned bind mount otherwise hits git's "detected dubious
ownership" refusal, and a Dockerfile-scoped .dockerignore so the
two-file COPY doesn't ship the whole repo (including the already-built
macOS toolchain binaries and the private ROM symlink) as build
context.
UNVERIFIED IN THIS SESSION: no Docker daemon is available here (`which
docker` finds nothing), so the image has never actually been built or
run. The builder-stage commands are known-working from Tasks 1-2's
real runs, and the final-stage COPY/ENV paths were checked against the
actual on-disk tools/vendor/jaguar-toolchain/ output in this worktree,
but the brief's Step 2 smoke test (`docker build` + `docker run ...
command -v rmac/rln/lyxass && ls "$BJL_ROOT/bin"`) and the
jaguar-demos-build end-to-end path were not exercised.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Joseph Mattiello