chore(cleanup): deploy-audit fixes — Makefile, Dockerfile, compose, smoke, externals

Dockerfile

@@ -6,18 +6,30 @@ RUN apk add --no-cache git ca-certificates tzdata
 WORKDIR /build
 
 # GrayCodeAI sibling modules are unpublished at their current code (the public proxy
-# froze v0.1.0 at old commits). Resolve them locally via the committed go.work
+# froze v0.1.0 at old commits). Resolve them locally via a generated go.work
 # (use . + replace => ./external/<repo>), bypassing the proxy/sumdb entirely.
 ENV GOPRIVATE=github.com/GrayCodeAI/* \
     GONOSUMDB=github.com/GrayCodeAI/* \
     GONOSUMCHECK=1
 
+# Build-time provenance (passed by .github/workflows/docker.yml or `docker build
+# --build-arg VERSION=... --build-arg COMMIT=... --build-arg BUILD_DATE=...`).
+# Default to "dev"/"none"/"unknown" so plain `docker build .` still produces a
+# runnable image — matching the cmd/hawk/main.go ldflags fallbacks.
+ARG VERSION=dev
+ARG COMMIT=none
+ARG BUILD_DATE=unknown
+
 COPY . .
 
 # Clone every sibling hawk imports into ./external, then generate a go.work that
 # resolves them locally. NOTE: the committed go.work/go.work.sum are excluded by
 # .dockerignore, so we must (re)create the workspace here. Do NOT run
 # 'go mod download' first — the frozen-proxy v0.1.0 fails checksum verification.
+#
+# main.Version / main.Commit / main.BuildDate are baked in from the ARGs above;
+# this is the only correct source — `git describe` would always return empty
+# because `.dockerignore` excludes `.git/` from the build context.
 RUN rm -rf external go.work go.work.sum && mkdir -p external && \
     for repo in eyrie inspect sight tok trace yaad; do \
       git clone --depth=1 "https://github.com/GrayCodeAI/${repo}.git" "external/${repo}"; \
@@ -27,7 +39,10 @@ RUN rm -rf external go.work go.work.sum && mkdir -p external && \
         echo "	github.com/GrayCodeAI/${repo} => ./external/${repo}"; \
       done; echo ")"; } > go.work && \
     CGO_ENABLED=0 GOOS=linux go build -trimpath \
-    -ldflags="-s -w -X main.Version=$(git describe --tags --always 2>/dev/null || echo dev)" \
+    -ldflags="-s -w \
+      -X main.Version=${VERSION} \
+      -X main.Commit=${COMMIT} \
+      -X main.BuildDate=${BUILD_DATE}" \
     -o hawk ./cmd/hawk
 
 # Runtime stage — Alpine (hawk requires git + bash for workspace operations; distroless excluded)

Makefile

@@ -152,7 +152,7 @@ setup: ## Set up local development environment (go.work + external repos).
 		fi; \
 	done
 	@echo "Generating go.work..."
-	@echo "module hawk-eco" > go.work
+	@echo "go 1.26.4" > go.work
 	@echo "" >> go.work
 	@echo "use (" >> go.work
 	@echo "	." >> go.work
@@ -219,8 +219,8 @@ build-static: ## Build fully static binaries for Linux (musl-compatible)
 	GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -trimpath -ldflags="$(LDFLAGS)" -o bin/$(NAME)-linux-amd64-static $(MAIN_PKG)
 	GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build -trimpath -ldflags="$(LDFLAGS)" -o bin/$(NAME)-linux-arm64-static $(MAIN_PKG)
 
-size-check: build ## Report binary size and warn if over threshold (50MB)
+size-check: build ## Report binary size and warn if over threshold (100MB, matching CI).
 	@SIZE=$$(stat -f%z bin/$(NAME) 2>/dev/null || stat -c%s bin/$(NAME) 2>/dev/null); \
 	MB=$$(echo "scale=1; $$SIZE / 1048576" | bc); \
 	echo "Binary size: $${MB} MB"; \
-	if [ $$SIZE -gt 52428800 ]; then echo "WARNING: binary exceeds 50MB"; exit 1; fi
+	if [ $$SIZE -gt 104857600 ]; then echo "ERROR: binary exceeds 100MB (CI threshold)"; exit 1; fi

deploy/docker/docker-compose.yml

@@ -5,7 +5,17 @@ services:
     build:
       context: ../../
       dockerfile: Dockerfile
+      args:
+        # Optional: set VERSION/COMMIT/BUILD_DATE to stamp the binary.
+        # Defaults in the Dockerfile produce "dev"/"none"/"unknown".
+        VERSION: ${VERSION:-dev}
+        COMMIT: ${COMMIT:-none}
+        BUILD_DATE: ${BUILD_DATE:-unknown}
     image: ghcr.io/graycodeai/hawk:dev
+    # Override the Dockerfile's default `CMD ["--help"]` so the container
+    # actually runs the HTTP/SSE daemon. `--host 0.0.0.0` is required for
+    # the published port to be reachable from outside the container.
+    command: ["daemon", "start", "--host", "0.0.0.0", "--port", "4590"]
     ports:
       - "4590:4590"
     environment:

scripts/smoke-hawk.sh

@@ -21,10 +21,6 @@ set +o pipefail
 "$BIN" path >/dev/null 2>&1 || true
 set -o pipefail
 
-echo "== hawk yaad =="
-"$BIN" yaad --limit 2 >/dev/null || true
-"$BIN" yaad search decision --limit 2 >/dev/null || true
-
 echo "== ecosystem tests =="
 go test ./internal/config/ -run TestFormatEcosystemPanel -count=1
 go test ./cmd/ -run 'TestDoctor|TestYaad|TestEcosystem|TestPath' -count=1