From 55dfc19e1debd9a5f4bb3ec2a632d606452e2bd7 Mon Sep 17 00:00:00 2001
From: chopratejas <chopratejas@gmail.com>
Date: Sat, 2 May 2026 18:43:09 -0700
Subject: [PATCH] =?UTF-8?q?fix(ci):=20unblock=20A0=20Docker=20e2e=20?=
 =?UTF-8?q?=E2=80=94=20install=20pkg-config=20+=20opt=20out=20wrap-e2e?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two CI failures introduced by Hotfix-A0's deployment-stage smoke test:

1. docker-native-e2e: the new maturin step in the builder stage failed
   with "Could not find openssl via pkg-config". The workspace
   transitively depends on `openssl-sys` (via reqwest's native-tls
   path in some dep chain). The previous Dockerfile only installed
   `build-essential`/`g++`/`curl`/`ca-certificates` — enough for the
   proxy binary build because cached target/ artefacts already had
   openssl-sys compiled, but the fresh maturin invocation hits a cold
   build and needs the dev headers. Add `pkg-config` + `libssl-dev`.

2. docker-wrap-e2e: this image is a `node:22-bookworm` base that
   installs headroom in editable mode for CLI-routing-only tests
   (aider, codex, openclaw via the wrap subcommand). It deliberately
   does NOT build the Rust extension. After A0, the proxy
   `lifespan` startup refuses to start when `headroom._core` can't
   import — so the wrap-e2e proxy port never opens, the harness's
   /health check times out, and the test fails. The wrap-e2e scope
   doesn't cover compression behaviour, so set
   `HEADROOM_REQUIRE_RUST_CORE=false` to start in degraded
   Python-only mode. Compression is exercised end-to-end by the
   smoke-test and docker-native-e2e jobs which build via the main
   Dockerfile.

The remaining 3 PR check failures (validate * 3) were transient
PyPI download failures (`nvidia-cuda-cupti-cu12==12.8.90`,
`safetensors==0.7.0`) — unrelated to the realignment branch; they
need a re-run, not a code change.
---
 Dockerfile          | 7 +++++++
 e2e/wrap/Dockerfile | 9 ++++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index ddddb00c4..553de90f0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,12 +18,19 @@ ARG UV_VERSION
 # image actually carries `headroom._core`; previously the runtime image
 # shipped without the Rust extension and every compressed request fell
 # back to a Python-only path or no-op.
+#
+# `pkg-config` + `libssl-dev` are required because the workspace
+# transitively pulls `openssl-sys` (via reqwest/native-tls in some
+# dependency chain). Without them, `cargo` fails the maturin build with
+# "Could not find openssl via pkg-config" — observed in PR #350 CI.
 RUN apt-get update && \
   apt-get install -y --no-install-recommends \
     build-essential \
     g++ \
     curl \
     ca-certificates \
+    pkg-config \
+    libssl-dev \
   && rm -rf /var/lib/apt/lists/*
 
 RUN python -m pip install --no-cache-dir uv==${UV_VERSION}
diff --git a/e2e/wrap/Dockerfile b/e2e/wrap/Dockerfile
index 34b8b3765..e46425754 100644
--- a/e2e/wrap/Dockerfile
+++ b/e2e/wrap/Dockerfile
@@ -8,7 +8,14 @@ ENV DEBIAN_FRONTEND=noninteractive \
     PIP_DISABLE_PIP_VERSION_CHECK=1 \
     PIP_NO_CACHE_DIR=1 \
     PYTHONUNBUFFERED=1 \
-    PYTHONDONTWRITEBYTECODE=1
+    PYTHONDONTWRITEBYTECODE=1 \
+    # Hotfix-A0: this image installs headroom in editable mode and does
+    # NOT carry the Rust extension — the wrap-e2e harness exercises CLI
+    # routing only, not compression, so booting the proxy in degraded
+    # Python-only mode is the right scope for this test. Production
+    # images (main Dockerfile + smoke-test) build the wheel; this one
+    # opts out of the fail-loud startup smoke check.
+    HEADROOM_REQUIRE_RUST_CORE=false
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \