chore(docker): lean images — drop unused playwright, dedupe grok layer, cache-stable /app layering

- agent-dev-fe / agent-qa-fe: remove playwright chromium + its system libs (~770MB each; verified unused — panel tests are vitest, e2e harness is scripted Python; pnpm kept)
- agent-grok: drop the redundant chown -R that duplicated the 149MB CLI tree into a second layer (install already runs as agent)
- agent-base + orchestrator runners: split the single /app COPY into .venv-first / source-last layers so a source-only deploy re-layers ~13MB instead of ~380MB per image
- agent-base: split the 813MB apt+node+claude-code RUN so a CLI bump no longer re-downloads the OS/node layer
- .dockerignore: exclude gitignored docs/internal from the orchestrator's docs COPY; pin uv helper image to 0.11
- verified: all four images rebuilt + runtime-probed (claude/git/jq/node/uv/pnpm/grok, import roboco, docs/alembic/agents present); .venv layer proven CACHED across a source-only change

.dockerignore

@@ -46,6 +46,11 @@ data/
 logs/
 *.log
 
+# Gitignored working notes — leak into the orchestrator's COPY docs layer from
+# a CEO working tree that has them checked out locally, causing env-dependent
+# cache keys (docs/rag/ + docs/map/ are NOT ignored — the agent-facing corpus).
+docs/internal/
+
 # VCS and editor cruft
 .idea
 .vscode

CHANGELOG.md

@@ -6,6 +6,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+### Changed
+
+- **Leaner agent/orchestrator images (~1.65GB less, cache-stable deploys).** Playwright + its Chromium and system libs are gone from `agent-dev-fe`/`agent-qa-fe` (~770MB each — verified unused repo-wide: panel tests are vitest, the e2e harness is scripted Python; browser-based FE QA is a designed follow-up, and the re-add is two lines scoped to `chromium-headless-shell` in the QA image only). The `agent-grok` image drops a redundant `chown -R` that duplicated the entire 149MB CLI tree into a second layer. The runner-stage `/app` COPY in `agent-base` and `orchestrator` is split `.venv`-first/source-last, so a source-only deploy re-layers ~13MB instead of ~380MB per image, and `agent-base`'s single 813MB apt+node+claude-code RUN is split so a CLI version bump no longer re-downloads the OS/node layer. Hygiene: gitignored `docs/internal/` no longer leaks into the orchestrator image from a working-tree build, and the `uv` helper image is pinned (`0.11`) instead of `:latest`. All four rebuilt images pass runtime probes (claude/git/jq/node/uv/pnpm/grok binaries, `import roboco`, docs/alembic/agents trees present); cache-stability proven by rebuild log (`.venv` layer CACHED across a source-only change).
+
 ## [0.19.0] - 2026-07-08
 
 ### Added

docker/agent-base.Dockerfile

@@ -14,7 +14,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         git \
     && rm -rf /var/lib/apt/lists/*
 
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.11 /uv /usr/local/bin/uv
 
 WORKDIR /app
 
@@ -45,10 +45,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     curl ca-certificates git gnupg jq build-essential \
     && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
-    && npm install -g @anthropic-ai/claude-code \
-    && npm cache clean --force \
     && apt-get purge -y --auto-remove gnupg \
-    && rm -rf /var/lib/apt/lists/* /root/.npm /tmp/*
+    && rm -rf /var/lib/apt/lists/*
+
+# Split from the apt layer above: this churns with every claude-code CLI
+# release, while the OS/node layer above stays stable across those bumps.
+RUN npm install -g @anthropic-ai/claude-code \
+    && npm cache clean --force \
+    && rm -rf /root/.npm /tmp/*
 
 RUN useradd -m -s /bin/bash agent
 
@@ -56,12 +60,17 @@ RUN useradd -m -s /bin/bash agent
 # `uv run python -m roboco.mcp.<server>`. Without it, all 10 roboco MCP
 # servers fail to start and the agent falls back to raw HTTP, losing every
 # guardrail and inline schema the MCP layer provides.
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.11 /uv /usr/local/bin/uv
 
 WORKDIR /app
 
-# Copy the pre-built venv + source from builder, owned by agent user
+# Copy the pre-built venv + source from builder, owned by agent user.
-COPY --from=builder --chown=agent:agent /app /app
+# .venv first (invalidated only by pyproject.toml/uv.lock changes via the
+# builder's own dep-then-project split), source dirs last so an app-code-only
+# change doesn't bust the much larger .venv layer's cache.
+COPY --from=builder --chown=agent:agent /app/.venv /app/.venv
+COPY --from=builder --chown=agent:agent /app/pyproject.toml /app/uv.lock /app/README.md /app/
+COPY --from=builder --chown=agent:agent /app/roboco /app/roboco
 
 # Hook scripts: 0755 so the `agent` user (not root) can read+execute them.
 # SessionStart hook runs these as agent; stricter perms break the hook with

docker/agent-dev-fe.Dockerfile

@@ -1,36 +1,14 @@
 # Frontend Developer Agent
-# React/TypeScript development with browser automation
+# React/TypeScript development
 
 FROM roboco-agent-base
 
 USER root
 
-# Playwright system dependencies
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    libnss3 \
-    libnspr4 \
-    libatk1.0-0 \
-    libatk-bridge2.0-0 \
-    libcups2 \
-    libdrm2 \
-    libxkbcommon0 \
-    libxcomposite1 \
-    libxdamage1 \
-    libxfixes3 \
-    libxrandr2 \
-    libgbm1 \
-    libasound2 \
-    libpango-1.0-0 \
-    libcairo2 \
-    && rm -rf /var/lib/apt/lists/*
-
 # Install pnpm globally
 RUN npm install -g pnpm
 
 USER agent
 
-# Install Playwright (browsers will be installed on first run or can be cached)
-RUN npx playwright install chromium
-
 LABEL role="frontend-developer"
-LABEL description="Frontend developer agent - React, TypeScript, Playwright"
+LABEL description="Frontend developer agent - React, TypeScript"

docker/agent-grok.Dockerfile

@@ -30,10 +30,10 @@ RUN su agent -s /bin/bash -c "set -euo pipefail; export HOME=/home/agent; \
     && rm -rf /tmp/*
 
 # Entrypoint: render ~/.grok/config.toml + the per-role flags, then run grok
-# headless (overrides the base image's `claude` entrypoint).
+# headless (overrides the base image's `claude` entrypoint). ~/.grok is already
+# agent:agent-owned (installed above via `su agent`), so no chown needed here.
 COPY docker/scripts/grok-cli-agent-entrypoint.sh /app/scripts/grok-cli-agent-entrypoint.sh
-RUN chmod 0755 /app/scripts/grok-cli-agent-entrypoint.sh \
+RUN chmod 0755 /app/scripts/grok-cli-agent-entrypoint.sh
-    && chown -R agent:agent /home/agent/.grok
 
 USER agent
 

docker/agent-qa-fe.Dockerfile

@@ -1,35 +1,13 @@
 # Frontend QA Agent
-# Browser testing and accessibility tools
+# Accessibility and code-level testing tools
 
 FROM roboco-agent-base
 
 USER root
 
-# Playwright system dependencies (same as fe-dev)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    libnss3 \
-    libnspr4 \
-    libatk1.0-0 \
-    libatk-bridge2.0-0 \
-    libcups2 \
-    libdrm2 \
-    libxkbcommon0 \
-    libxcomposite1 \
-    libxdamage1 \
-    libxfixes3 \
-    libxrandr2 \
-    libgbm1 \
-    libasound2 \
-    libpango-1.0-0 \
-    libcairo2 \
-    && rm -rf /var/lib/apt/lists/*
-
 RUN npm install -g pnpm
 
 USER agent
 
-# Playwright for browser testing
-RUN npx playwright install chromium
-
 LABEL role="frontend-qa"
-LABEL description="Frontend QA agent - browser testing, accessibility, visual regression"
+LABEL description="Frontend QA agent - accessibility, code review, testing"

docker/orchestrator.Dockerfile

@@ -14,7 +14,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         git \
     && rm -rf /var/lib/apt/lists/*
 
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.11 /uv /usr/local/bin/uv
 
 WORKDIR /app
 
@@ -71,8 +71,17 @@ RUN npm install -g pnpm
 
 WORKDIR /app
 
-# Copy the already-built venv + app tree from builder
+# Copy the already-built venv + app tree from builder.
-COPY --from=builder /app /app
+# .venv first (invalidated only by pyproject.toml/uv.lock changes via the
+# builder's own dep-then-project split), source dirs last so an app-code-only
+# change doesn't bust the much larger .venv layer's cache.
+COPY --from=builder /app/.venv /app/.venv
+COPY --from=builder /app/pyproject.toml /app/uv.lock /app/README.md /app/
+COPY --from=builder /app/roboco /app/roboco
+COPY --from=builder /app/agents /app/agents
+COPY --from=builder /app/docs /app/docs
+COPY --from=builder /app/alembic.ini /app/
+COPY --from=builder /app/alembic /app/alembic
 
 # uv is needed at runtime: WorkspaceService runs `uv sync` to pre-install
 # Python cell deps, and CI commands shell out to `uv run`. The builder stage