import InfoBox from '../components/InfoBox.astro';

The devcontainer had grown to 507 packages and 2.84 GB on disk, without any specific complaint that it was too slow or too large. That made the audit a precaution rather than a cleanup target: inventory the image and its surrounding scripts, find what looked redundant, then decide whether each candidate was unused, invisible to static analysis, or expensive for a reason.

## Absence in the repository is not absence

The compiler toolchain was the clean removal. It occupied about 194 MB, no current dependency needed a native build, no script invoked it, and there was no confirmed interactive use. Python looked equally unused in the repository, but that evidence was misleading. Claude Code, Codex, and Antigravity regularly create small one-off scripts during a session, work that never appears in a committed grep result. Python stayed, with its purpose documented where the image installs it.

Video conversion was the larger temptation. Its distribution package pulled in roughly 367 MB of graphics dependencies that a headless recording pipeline does not need, and a smaller static binary was technically feasible. The alternative lost on a different axis: it would replace an audited operating-system package with a third-party wrapper carrying its own update and patch cadence. The recording pipeline is load-bearing, so the known larger package stayed.

<InfoBox title="What the audit changed" variant="note">
  One unused compiler toolchain left the image. Python and video conversion stayed with
  explicit reasons. The existing developer-CLI maintenance tests gained a CI job that runs
  whenever the devcontainer surface changes.
</InfoBox>

## Test the workshop itself

The audit also found that the tests behind [developer CLI lifecycle management](/posts/developer-cli-auto-updates#enforcing-lifecycle-invariants) only ran when someone remembered them. They use fakes and fixtures, so there was no reason to require a running container or leave them as a manual ritual. A broad path-based CI gate now protects the whole devcontainer directory, avoiding a hand-maintained list that could silently miss the next script.

The useful outcome is not the space saved. It is a clearer standard for what belongs in the workshop: repository references are evidence, interactive use counts even when no file records it, and supply-chain simplicity can outweigh raw image size. The packages that remain now have reasons, and the scripts that keep them current have an automatic check.