Harden CPU AI image builds

docs/CODEX_EXECUTION_LOG.md

@@ -7015,3 +7015,21 @@ Open:
 ## Next recommended pass
 
 - Finish the inactive candidate, run fixed-threshold positive evidence and split pure-empty/sparse-context background matrices, and preserve the current production default unless the promotion report passes every gate.
+# Sprint 172 - CPU AI image build hardening
+
+## What changed
+
+- Reordered `deploy/unraid/Dockerfile.all-in-one` so `pyproject.toml` and minimal package metadata are installed before the complete backend source is copied.
+- Code-only backend changes can now reuse the expensive GIS/AI dependency layer; dependency metadata changes still invalidate it.
+- The opt-in CPU AI build now installs the same validated PyTorch `2.13.0` / torchvision `0.28.0` versions from the official CPU wheel index before installing the `ai` extra.
+- Kept the full GIS and YOLO import/preflight smoke after the complete backend source copy.
+
+## Validation so far
+
+- RED: the new Docker ordering/CPU-wheel regression test failed against the old Dockerfile.
+- GREEN: `python -m pytest backend/tests/test_docker_runtime_config.py -q`: 26 passed.
+- `python -m pip index versions` confirmed `torch 2.13.0+cpu` and `torchvision 0.28.0+cpu` are available from the configured CPU index for the workstation platform.
+
+## Remaining validation
+
+- Build the AI-enabled all-in-one image on Tower after the current inactive model training run finishes, verify Torch reports a CPU build and rerun live migration/browser smokes before replacing the runtime.

docs/DEPENDENCY_POLICY.md

@@ -43,6 +43,18 @@ AI dependencies remain separate in the `ai` optional dependency group and must
 not be installed by the default Docker backend image unless an explicit AI image
 or profile is introduced later.
 
+The opt-in Unraid all-in-one AI build is CPU-oriented because its documented
+runtime sets `YOLO_DEVICE=cpu`. It installs the pinned PyTorch/torchvision pair
+from PyTorch's CPU wheel index before installing the `ai` extra. This avoids
+shipping unused CUDA runtime libraries. The index and versions remain explicit
+Docker build arguments so a future, separately validated GPU image can override
+them without changing the base dependency group.
+
+Docker dependency metadata is copied before application source. Backend source
+changes therefore reuse the dependency layer while changes to `pyproject.toml`
+still invalidate it correctly. Runtime GIS and YOLO import/preflight smokes run
+after the complete backend source is copied.
+
 ## Approved AI
 
 - PyTorch