[langesven]

Problem

• Production deploys have been blocked since fix(frontend): keep zod off the logged-out boot path #115140 merged. Every master commit since then fails the Container Images CD build, so no image ships.
• fix(frontend): keep zod off the logged-out boot path #115140 made frontend/build.mjs import frontend/plugins/zodJitless.mjs.
• .dockerignore allows only listed frontend/ paths, and frontend/plugins/ is not one of them.
• The frontend build in the image then fails with ERR_MODULE_NOT_FOUND for that file (example run).

Changes

• Adds !frontend/plugins to .dockerignore, so the plugin reaches the Docker build context. Nothing user-visible changes.

How did you test this code?

• A scratch busybox build with the repo as its context copies frontend/plugins/, and zodJitless.mjs is present in the image.
• A local docker build --target frontend-build (the stage that failed in CI) completes: all 8 turbo tasks pass.
• Not run: the later image stages, which this change does not touch. PR CI does not build the production image, so the next master build is the first full check.

Test rationale: No new test. The master image build already catches this class of failure.

Release status

• No feature flag controls this change

Docs update

None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Claude Opus 5.5 (claude-opus-5-5)

• The on-call engineer found the failing builds through the image-build alert. The agent traced them to the missing context path in the run logs.
• Duplicate search: no open PR fixes this. fix(deps): update zod to 4.6.7 for cve-2023-54404 #115271 bumps zod but does not touch the Docker context.
• Skills invoked: /writing-pr-descriptions.

🤖 Generated with Claude Code

[trunk-io]

😎 Merged successfully - details.

[github-actions]

🤖 CI report

⚠️ Trunk lane — backend Python lane

This PR is assigned to the backend Python lane. It runs backend Python tests and may merge in parallel with PRs in other lanes.

[parameterai]

Risk: No findings

This PR adds !frontend/plugins to .dockerignore so the frontend build plugins reach the Docker build context, fixing blocked production image builds. The directory contains only five build-plugin source files with no secrets or sensitive data, so the change introduces no security risk.

_{Sentinel reviewed b87a5af · Review settings}

[stamphog]

Not approved — escalated to a human reviewer.

Re-add the stamphog label to request another review once you have addressed this.

This touches container build tooling without independent assurance; neither discussion comment is a current-head review. Request a review from Codex, Claude, or a human teammate covering the build-context change before re-requesting.

• Risky territory without independent assurance: CI/deploy/build tooling — .dockerignore now includes frontend/plugins in Docker build contexts; Dockerfile copies frontend into the build stage, and frontend/build.mjs imports a module from that directory.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	1L, 1F substantive — within ceiling
tier	✓	T1-agent / T1a-trivial (1L, 1F, single-area, fix)
stamphog 2.4.1		.stamphog/policy.yml @ b87a5af · reviewed head b87a5af

[posthog]

PostHog Review · Deep · reviewed b87a5af

Nothing to post.

Step	Status	Result
Prepare the diff	done	1 file, 1 chunk
Pick perspectives	done	1 perspective
Run review passes	done	0 issues
Merge overlapping findings	done	0 → 0
Validate findings	done
Publish	done	Nothing to post

[stamphog]

Not approved — escalated to a human reviewer.

Re-add the stamphog label to request another review once you have addressed this.

This changes production image build inputs and requires independent assurance; the bot discussion summaries are not qualifying current-head reviews. Request a current-head review from Codex, Claude, or a teammate covering the Docker build change before re-requesting.

• Risky territory without independent assurance: CI/deploy/build tooling — .dockerignore now includes frontend/plugins in Docker build contexts; Dockerfile copies that directory into the frontend build stage, whose build script imports its zod plugin.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	1L, 1F substantive — within ceiling
tier	✓	T1-agent / T1a-trivial (1L, 1F, single-area, fix)
stamphog 2.4.1		.stamphog/policy.yml @ b87a5af · reviewed head b87a5af

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-10-12 11:41 UTC	Run
prod-us	✅ Deployed	2026-10-12 11:54 UTC	Run
prod-eu	✅ Deployed	2026-10-12 11:57 UTC	Run