[Fix] OpenCode SDK server fails to start on Railway: root-owned HOME artifacts in the inference image

[mrubens]

Problem

On nightly (Railway), the LLM router falls back on every request, and task title refresh / work-kind classification fail:

[LLM Router] Routing fallback ... reason="OpenCode SDK server exited before it was ready ... code 1"
PermissionDenied: FileSystem.open (/tmp/.local/share/opencode/log/opencode.log)

Root cause: runtime-inference-base (#114) installs OpenCode and runs opencode --version as root with the image's HOME=/tmp. That bakes root-owned /tmp/.npm and /tmp/.local/share/opencode/ into the image layer. The final stage runs as the hardened non-root roomote-app user (#105) with the same HOME, which cannot write inside those root-owned directories, so the in-process OpenCode SDK server dies at startup.

Why nothing caught it:

• Compose deployments (and the deployment acceptance smoke test) mount a fresh tmpfs over /tmp, masking the baked artifacts entirely — the skew only bites hosts that run the raw image, i.e. Railway.
• The smoke test's tool check was command -v opencode, which locates the binary without executing it.
• [Fix] Restore control-plane runtime tools for routing and PR bootstrap #114 was never deployed to Railway until the publish pipeline unblocked today ([Fix] Skip candidate-only runtime tool checks when verifying the baseline release #125), so the first production exposure was develop-f68732c7 at 20:10 UTC.

Fix

• .docker/app/Dockerfile: remove /tmp/.npm, /tmp/.local, and /tmp/.cache in the same RUN layer that installs and version-checks OpenCode, so the image ships a pristine /tmp and the runtime user creates its own HOME state.
• deploy/ci/deployment-smoke.sh: the candidate check now executes opencode --version as the container user instead of just locating it. This verifies runtime executability (startup writes state under HOME); the comment documents that the tmpfs masks the raw-image case, which the Dockerfile layer now prevents.

Testing

• bash -n on the smoke script. Local Docker daemon is unhealthy on this machine, so the image build is validated by this PR's Docker Build checks and, post-merge, by the (re-armed) deployment acceptance gate on the develop publish run.
• Verification on nightly after deploy: api logs should show no PermissionDenied ... opencode.log, and [LLM Router] lines should stop reporting phase="fallback" with the SDK-server-exit reason.

[roomote-roomote]

No new code issues found. The previously flagged issue is resolved. See task

• .docker/app/Dockerfile — the OpenCode install/version-check layer no longer leaves root-owned dotdirs in the shipped /tmp. Resolved by running the whole step under a disposable HOME=/tmp/opencode-build and rm -rf-ing it in the same RUN, so .npm/.local/.config/.cache (and any future dotdir) never persist in the layer.

Review summary

The fix correctly targets the root cause: the runtime user shares HOME=/tmp and could not write into the root-owned OpenCode data dir baked in by the build. Stripping /tmp/.local (which holds .local/share/opencode/log/opencode.log, the exact path in the crash) resolves the reported PermissionDenied. The smoke-test upgrade to actually execute opencode --version and the honest tmpfs caveat in the comment are both good.

Sync update (a731217): The latest commit replaces the fixed rm -rf /tmp/.npm /tmp/.local /tmp/.cache allowlist with a disposable HOME=/tmp/opencode-build scoped to the single RUN, removed via rm -rf /tmp/opencode-build at the end of the same chain. This is the more robust of the two options suggested in the initial review: every dotdir npm or OpenCode writes now lands under the disposable HOME and is removed, so the previously-omitted /tmp/.config leftover no longer ships and there is no allowlist to maintain. The export is scoped to that build shell, so the runtime ENV HOME=/tmp from runtime-base is unaffected. No new issues found.

#	Severity	File	Line	Issue
1	✅ Resolved	.docker/app/Dockerfile	285	/tmp/.config (and any other root-owned dotdir) leftover is eliminated by the disposable-HOME approach.

[mrubens]

Addressed the review finding: rather than adding /tmp/.config to the allowlist, the install/version-check layer now runs under a disposable HOME=/tmp/opencode-build that is removed at the end of the same RUN — the reviewer's second, more robust option. Any dotdir npm or OpenCode writes (now or in future versions) stays out of the shipped layer, with no allowlist to maintain. Runtime HOME=/tmp from runtime-base is unaffected since the export is scoped to that one RUN shell.