[contextablemark]

What this changes

server/src/computer/policy-network.ts imports the egress rules and matcher from ../../../agent-computer/src/egress, but server/Dockerfile never copies that file. A container built from server/Dockerfile (the server image the release publishes, and what docker compose --profile openbot runs) exits on start and restarts in a loop:

error: Cannot find module '../../../agent-computer/src/egress' from '/app/server/src/computer/policy-network.ts'

This copies the one file into the runtime stage. It imports only Node built-ins and shared/openbot-browser, which COPY shared shared already provides, so nothing else is needed. The all-in-one root Dockerfile already copies agent-computer/src and is not affected.

CI didn't catch it because component dockerfiles builds the server image but only boots the computer image. A follow-up could boot server too, or at least run bun -e 'await import("/app/server/src/index.ts")' in it. I've left that out to keep this PR to the fix.

Where it runs

• New state that outlives a request? None.
• What happens on the second replica? Same image on every replica; each one starts instead of crash-looping.
• Anything serialised? No.
• Anything fanned out to a browser? No.
• New listener, port, or schedule? No.

Boundary and audit

• Every acting call still goes through the gateway: resolve, decide, audit, then act. (No code change.)
• New refusals and new failures each write a row. (None added.)
• Nothing new is trusted from the client that the server can resolve itself.

Changelog

• A line in CHANGELOG.md under Unreleased.

Proof

Found while staging c396a5f locally with docker compose --profile openbot: the server container crash-looped with the error above. The server then ran healthy for several hours with this change applied.

On an image built from this branch (docker build -f server/Dockerfile ., arm64):

$ docker run --rm --network none --entrypoint sh <image> -c 'bun -e "await import(\"/app/server/src/computer/policy-network.ts\"); console.log(\"OK\")"'
OK
# Same image with the file removed (--user 0, rm /app/agent-computer/src/egress.ts):
error: Cannot find module '../../../agent-computer/src/egress' from '/app/server/src/computer/policy-network.ts'

🤖 Generated with Claude Code

[contextablemark]

Added the full-ci label. The component dockerfiles job, which builds server/Dockerfile, only runs on a pull request with that label (or on main/release). Without it, CI on this PR wouldn't build the image this change touches. That job still only boots the computer image, so the build alone wouldn't have caught the original crash; the proof that it starts is in the description.