fix: skip onnx cuda download for cpu image

.project-docs/30-worklog/tasks/20260818-learning-lockfile-9d2a.md

@@ -12,18 +12,21 @@
 
 ## Scope
 
-- Regenerate `OpenMAIC/pnpm-lock.yaml` from the current workspace manifests so
+- Synchronize `OpenMAIC/pnpm-lock.yaml` with the current workspace manifests so
   `packages/@makelore/learning-contracts` is represented and Docker's frozen
   install can pass.
-- Verify the regenerated lockfile with pnpm `10.28.0` and the same frozen
-  install command used by the Dockerfile.
-- Do not change application code or weaken the Dockerfile's frozen-lockfile
-  policy.
+- Make the CPU ACK image resilient to `onnxruntime-node`'s unnecessary CUDA
+  postinstall download while keeping the frozen-lockfile policy.
+- Verify the lockfile and the supported CPU install-script path with pnpm
+  `10.28.0` and the repository's pinned Node runtime.
 
 ## Intent And Constraints
 
-- The current failure is a dependency metadata mismatch: the learning
-  contracts package was added after the lockfile was last generated.
+- The first failure was a dependency metadata mismatch: the learning contracts
+  package was added after the lockfile was last generated.
+- The follow-up failure is an `onnxruntime-node@1.23.2` postinstall request for
+  CUDA 12 metadata; the Jenkins proxy returned HTTP 302 while the script only
+  accepts HTTP 200.
 - Use the package-manager version pinned by the Dockerfile (`pnpm@10.28.0`)
   when regenerating the lockfile.
 - Preserve the user's known `.project-docs/` adoption and avoid unrelated
@@ -37,6 +40,9 @@
 - The original Dockerfile policy remains `pnpm install --frozen-lockfile`.
 - Committed locally on `main` as `e1a0a14` (`fix: sync learning contracts
   lockfile`).
+- Updated `OpenMAIC/Dockerfile` to set `ONNXRUNTIME_NODE_INSTALL=skip` in the
+  dependency stage. The package's CPU runtime remains bundled; CUDA download is
+  now an explicit opt-in and requires a CUDA-capable runner image.
 
 ## Verification
 
@@ -46,15 +52,19 @@
 - Read-only final review returned `PASS`; the importer matches the manifest and
   existing lockfile peer snapshot, with no Dockerfile or application-code
   changes.
+- The `onnxruntime-node` install script exited 0 with
+  `ONNXRUNTIME_NODE_INSTALL=skip`; bundled Windows and Linux CPU binding files
+  were present.
 - Full Windows `pnpm install --frozen-lockfile` reached the existing postinstall
   chain and failed because `rm` is unavailable on Windows; the Dockerfile runs
   this chain inside Linux Alpine, so this is not the reported Jenkins failure.
-- Local Docker `deps` validation was not run because the Docker Desktop Linux
-  engine was unavailable (`dockerDesktopLinuxEngine` pipe missing).
+- Local Docker `deps` validation remains unavailable because the Docker Desktop
+  Linux engine is not running (`dockerDesktopLinuxEngine` pipe missing).
 
 ## Follow-ups
 
-- Commit and push `OpenMAIC/pnpm-lock.yaml`, then rerun the Jenkins Docker build.
+- Commit and push the lockfile and Dockerfile changes, then rerun the Jenkins
+  Docker build.
 - Local push to `origin/main` was blocked because this environment has no
   authenticated Git credential/TTY; rerun `git push origin main` from an
   authenticated terminal.
@@ -64,6 +74,18 @@
   untracked `.project-docs/` template tree; no task-specific shared-doc writes
   were made.
 
+## Follow-up: ONNX Runtime postinstall
+
+- The Linux Docker build reached `onnxruntime-node@1.23.2` postinstall, which
+  assumed CUDA 12 and rejected an HTTP 302 from the NuGet feed.
+- `OpenMAIC/Dockerfile` now defaults `ONNXRUNTIME_NODE_INSTALL=skip` in the
+  dependency stage. The package ships the CPU runtime; GPU builds can opt in
+  with `--build-arg ONNXRUNTIME_NODE_INSTALL=cuda12` after fixing NuGet access.
+- The install script exited 0 with `ONNXRUNTIME_NODE_INSTALL=skip` locally and
+  both bundled CPU runtime paths were present.
+- The CUDA override was not exercised end to end. Use it only with a working
+  NuGet/proxy path and a runner image that supplies the CUDA runtime.
+
 ## Promotion Candidates
 
 - None recorded.

OpenMAIC/Dockerfile

@@ -9,6 +9,14 @@ WORKDIR /app
 # ---- Stage 2: Dependencies ----
 FROM base AS deps
 
+# The npm package bundles the CPU runtime. Linux/x64 otherwise assumes CUDA 12
+# and downloads CUDA EP packages from NuGet during postinstall; that download
+# is not needed by the CPU ACK images and is fragile behind redirecting proxies.
+# A CUDA build must explicitly pass --build-arg ONNXRUNTIME_NODE_INSTALL=cuda12
+# and use a CUDA-capable runner image; that path is not enabled by default here.
+ARG ONNXRUNTIME_NODE_INSTALL=skip
+ENV ONNXRUNTIME_NODE_INSTALL=$ONNXRUNTIME_NODE_INSTALL
+
 # Native build tools for sharp, @napi-rs/canvas
 RUN apk add --no-cache python3 build-base g++ cairo-dev pango-dev jpeg-dev giflib-dev librsvg-dev