docs: record onnx runtime docker fix

.project-docs/30-worklog/tasks/20260818-learning-lockfile-9d2a.md

@@ -12,18 +12,21 @@
 
 ## Scope
 
-- Regenerate `OpenMAIC/pnpm-lock.yaml` from the current workspace manifests so
+- Synchronize `OpenMAIC/pnpm-lock.yaml` with the current workspace manifests so
   `packages/@makelore/learning-contracts` is represented and Docker's frozen
   install can pass.
-- Verify the regenerated lockfile with pnpm `10.28.0` and the same frozen
-  install command used by the Dockerfile.
-- Do not change application code or weaken the Dockerfile's frozen-lockfile
-  policy.
+- Make the CPU ACK image resilient to `onnxruntime-node`'s unnecessary CUDA
+  postinstall download while keeping the frozen-lockfile policy.
+- Verify the lockfile and the supported CPU install-script path with pnpm
+  `10.28.0` and the repository's pinned Node runtime.
 
 ## Intent And Constraints
 
-- The current failure is a dependency metadata mismatch: the learning
-  contracts package was added after the lockfile was last generated.
+- The first failure was a dependency metadata mismatch: the learning contracts
+  package was added after the lockfile was last generated.
+- The follow-up failure is an `onnxruntime-node@1.23.2` postinstall request for
+  CUDA 12 metadata; the Jenkins proxy returned HTTP 302 while the script only
+  accepts HTTP 200.
 - Use the package-manager version pinned by the Dockerfile (`pnpm@10.28.0`)
   when regenerating the lockfile.
 - Preserve the user's known `.project-docs/` adoption and avoid unrelated
@@ -37,6 +40,9 @@
 - The original Dockerfile policy remains `pnpm install --frozen-lockfile`.
 - Committed locally on `main` as `e1a0a14` (`fix: sync learning contracts
   lockfile`).
+- Updated `OpenMAIC/Dockerfile` to set `ONNXRUNTIME_NODE_INSTALL=skip` in the
+  dependency stage. The package's CPU runtime remains bundled; CUDA download is
+  now an explicit opt-in and requires a CUDA-capable runner image.
 
 ## Verification
 
@@ -46,15 +52,19 @@
 - Read-only final review returned `PASS`; the importer matches the manifest and
   existing lockfile peer snapshot, with no Dockerfile or application-code
   changes.
+- The `onnxruntime-node` install script exited 0 with
+  `ONNXRUNTIME_NODE_INSTALL=skip`; bundled Windows and Linux CPU binding files
+  were present.
 - Full Windows `pnpm install --frozen-lockfile` reached the existing postinstall
   chain and failed because `rm` is unavailable on Windows; the Dockerfile runs
   this chain inside Linux Alpine, so this is not the reported Jenkins failure.
-- Local Docker `deps` validation was not run because the Docker Desktop Linux
-  engine was unavailable (`dockerDesktopLinuxEngine` pipe missing).
+- Local Docker `deps` validation remains unavailable because the Docker Desktop
+  Linux engine is not running (`dockerDesktopLinuxEngine` pipe missing).
 
 ## Follow-ups
 
-- Commit and push `OpenMAIC/pnpm-lock.yaml`, then rerun the Jenkins Docker build.
+- Commit and push the lockfile and Dockerfile changes, then rerun the Jenkins
+  Docker build.
 - Local push to `origin/main` was blocked because this environment has no
   authenticated Git credential/TTY; rerun `git push origin main` from an
   authenticated terminal.
@@ -64,6 +74,18 @@
   untracked `.project-docs/` template tree; no task-specific shared-doc writes
   were made.
 
+## Follow-up: ONNX Runtime postinstall
+
+- The Linux Docker build reached `onnxruntime-node@1.23.2` postinstall, which
+  assumed CUDA 12 and rejected an HTTP 302 from the NuGet feed.
+- `OpenMAIC/Dockerfile` now defaults `ONNXRUNTIME_NODE_INSTALL=skip` in the
+  dependency stage. The package ships the CPU runtime; GPU builds can opt in
+  with `--build-arg ONNXRUNTIME_NODE_INSTALL=cuda12` after fixing NuGet access.
+- The install script exited 0 with `ONNXRUNTIME_NODE_INSTALL=skip` locally and
+  both bundled CPU runtime paths were present.
+- The CUDA override was not exercised end to end. Use it only with a working
+  NuGet/proxy path and a runner image that supplies the CUDA runtime.
+
 ## Promotion Candidates
 
 - None recorded.

.project-docs/30-worklog/tasks/20260818-onnx-cuda-postinstall-a7c4.md

@@ -0,0 +1,58 @@
+# Task: Stabilize ONNX Runtime Docker install
+
+## Identity
+
+- Task ID: 20260818-onnx-cuda-postinstall-a7c4
+- Mode: Feature
+- Branch: main
+- Worktree: D:\Datas\OthersProjects\openmaic
+- Base commit: 22dd55625fa5f855c6aa733ab6dd52bf2b878c96
+- Owner: developer
+- Status: Ready for integration
+
+## Scope
+
+- Record and verify the CPU ACK Docker fix for the `onnxruntime-node`
+  postinstall failure reported by Jenkins.
+- Keep CUDA provider download opt-in; do not claim a GPU image is supported
+  without a CUDA-capable runner and a verified NuGet/proxy path.
+
+## Intent And Constraints
+
+- Linux/x64 `onnxruntime-node@1.23.2` assumes CUDA 12 when no install mode is
+  provided and rejects the Jenkins proxy's HTTP 302 response from NuGet.
+- The CPU runtime and binding are bundled in the npm package, so the ACK image
+  should skip the unnecessary CUDA provider download.
+- Preserve `pnpm install --frozen-lockfile`; avoid unrelated application changes.
+
+## Outcome
+
+- `OpenMAIC/Dockerfile` in base commit `22dd556` sets
+  `ONNXRUNTIME_NODE_INSTALL=skip` before the dependency-stage install.
+- CUDA installation remains an explicit `cuda12` build-arg override and is
+  documented as requiring a CUDA-capable runner; it is outside this acceptance
+  scope.
+- The lockfile correction is in `e1a0a14`, and the adopted `.project-docs/` tree
+  is tracked in `469f72b`.
+
+## Verification
+
+- The upstream install script exited 0 with `ONNXRUNTIME_NODE_INSTALL=skip`.
+- Bundled Linux and Windows CPU runtime binding files were present.
+- `git diff --check` passed.
+- `check_project_docs.py` passed.
+- Local Linux Docker validation is unavailable because the Docker Desktop Linux
+  engine pipe is not running; Jenkins must perform the end-to-end build.
+- Final read-only reviewer returned `PASS`.
+
+## Follow-ups
+
+- Push `e1a0a14`, `469f72b`, and `22dd556` from an authenticated terminal, then
+  rerun the Jenkins CPU image build.
+- If GPU deployment is required, provide a CUDA-capable runner image and verify
+  the `ONNXRUNTIME_NODE_INSTALL=cuda12` path against the organization's NuGet
+  proxy before enabling it.
+
+## Promotion Candidates
+
+- None recorded.

OpenMAIC/Dockerfile

@@ -9,6 +9,14 @@ WORKDIR /app
 # ---- Stage 2: Dependencies ----
 FROM base AS deps
 
+# The npm package bundles the CPU runtime. Linux/x64 otherwise assumes CUDA 12
+# and downloads CUDA EP packages from NuGet during postinstall; that download
+# is not needed by the CPU ACK images and is fragile behind redirecting proxies.
+# A CUDA build must explicitly pass --build-arg ONNXRUNTIME_NODE_INSTALL=cuda12
+# and use a CUDA-capable runner image; that path is not enabled by default here.
+ARG ONNXRUNTIME_NODE_INSTALL=skip
+ENV ONNXRUNTIME_NODE_INSTALL=$ONNXRUNTIME_NODE_INSTALL
+
 # Native build tools for sharp, @napi-rs/canvas
 RUN apk add --no-cache python3 build-base g++ cairo-dev pango-dev jpeg-dev giflib-dev librsvg-dev