Stamp source-built base images

Makefile

@@ -54,10 +54,12 @@ stop:  ## Stop everything `make start` started: the task containers + the -L pan
 
 build:  ## Build the per-CLI base task-container images (override CLIs with AGENT_CLIS=)
 	uv build --wheel --out-dir src/panopticon/docker/
+	version=$$(uv run python -c 'import panopticon; print(panopticon.__version__)'); \
 	wheel=$$(ls -1 src/panopticon/docker/panopticon_app*.whl | xargs -n1 basename); \
 	for cli in $(AGENT_CLIS); do \
 	  docker build \
 	    --tag panopticon-base-$$cli \
+	    --label org.panopticon.version=$$version \
 	    --build-arg PANOPTICON_WHEEL=$$wheel \
 	    --build-arg AGENT_CLI=$$cli \
 	    --file src/panopticon/docker/Dockerfile \

docs/dev.md

@@ -62,6 +62,11 @@ make start       # task service + session-service runner + dashboard supervisor
 make stop        # tear it all down (task containers + the -L panopticon tmux server)
 ```
 
+Run `make build` again after updating the Panopticon source when those changes need to be
+available inside task containers. The runner uses the package-version label written by this
+manual build, so it will not replace the checkout-built image with the same published release;
+rebuilding is what refreshes source changes made without a version bump.
+
 Individual pieces, when you want just one:
 
 - `make serve` — the task service (control plane) over HTTP

tests/test_makefile.py

@@ -0,0 +1,16 @@
+"""Developer-command regression tests."""
+
+from pathlib import Path
+
+from panopticon.sessionservice.images import VERSION_LABEL
+
+
+def test_make_build_stamps_checkout_wheel_with_package_version() -> None:
+    makefile = (Path(__file__).parents[1] / "Makefile").read_text()
+    build_recipe = makefile.split("build:  ##", 1)[1].split("\nclean:  ##", 1)[0]
+
+    assert "uv build --wheel" in build_recipe
+    assert "PANOPTICON_WHEEL=$$wheel" in build_recipe
+    assert "version=$$(uv run python" in build_recipe
+    assert "print(panopticon.__version__)" in build_recipe
+    assert f"--label {VERSION_LABEL}=$$version" in build_recipe