feat: add container packaging, Docker Compose, and CI pipeline

.dockerignore

@@ -0,0 +1,64 @@
+# =============================================================================
+# Consolidated .dockerignore — applies to all Docker builds from repo root
+# =============================================================================
+# Both backend and web images build with context: . (repo root).
+# Backend needs: pyproject.toml, uv.lock, src/
+# Web needs: web/
+
+# Git
+.git/
+.github/
+.gitignore
+
+# Docker configs (Dockerfiles read via -f, not from context)
+docker/
+
+# Tests
+tests/
+
+# Documentation
+docs/
+*.md
+
+# Virtual environments
+.venv/
+venv/
+
+# Python caches
+__pycache__/
+*.py[cod]
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+
+# Coverage
+htmlcov/
+coverage.xml
+.coverage
+.coverage.*
+
+# Databases
+*.db
+*.sqlite3
+
+# Environment files
+.env
+.env.*
+
+# IDE
+.idea/
+.vscode/
+
+# Claude Code config
+.claude/
+
+# Logs
+logs/
+*.log
+
+# OS files
+Thumbs.db
+.DS_Store
+
+# uv
+.python-version

CONTRIBUTING.md → .github/CONTRIBUTING.md

@@ -8,7 +8,7 @@ cd ai-company
 uv sync
 ```
 
-For the full setup walkthrough (prerequisites, IDE config, etc.), see [docs/getting_started.md](docs/getting_started.md).
+For the full setup walkthrough (prerequisites, IDE config, etc.), see [docs/getting_started.md](../docs/getting_started.md).
 
 ## Branching Strategy
 
@@ -107,11 +107,11 @@ To run all hooks manually:
 uv run pre-commit run --all-files
 ```
 
-See [docs/getting_started.md](docs/getting_started.md) for the full list of hooks and what each one does.
+See [docs/getting_started.md](../docs/getting_started.md) for the full list of hooks and what each one does.
 
 ## Code Style
 
-Code conventions (type hints, docstrings, immutability, line length, etc.) are documented in [CLAUDE.md](CLAUDE.md). Both human contributors and AI assistants follow the same rules.
+Code conventions (type hints, docstrings, immutability, line length, etc.) are documented in [CLAUDE.md](../CLAUDE.md). Both human contributors and AI assistants follow the same rules.
 
 ## Pull Request Process
 
@@ -128,15 +128,18 @@ Code conventions (type hints, docstrings, immutability, line length, etc.) are d
 ```text
 src/ai_company/       # Main package
   api/  budget/  cli/  communication/  config/  core/
-  engine/  memory/  providers/  security/  templates/  tools/
+  engine/  hr/  memory/  observability/  persistence/
+  providers/  security/  templates/  tools/
 tests/
   unit/  integration/  e2e/
 docs/                 # Developer documentation
+docker/               # Dockerfiles, Compose, .env.example
+web/                  # Web UI scaffold (nginx + placeholder)
 .github/              # CI, dependabot, actions
 ```
 
-See [docs/getting_started.md](docs/getting_started.md) for descriptions of each sub-package.
+See [docs/getting_started.md](../docs/getting_started.md) for descriptions of each sub-package.
 
 ## License
 
-This project is licensed under [BUSL-1.1](LICENSE). By contributing, you agree that your contributions will be licensed under the same terms.
+This project is licensed under [BUSL-1.1](../LICENSE). By contributing, you agree that your contributions will be licensed under the same terms.

.github/dependabot.yml

@@ -34,3 +34,31 @@ updates:
       - Aureliolo
     labels:
       - type:ci
+
+  - package-ecosystem: docker
+    directory: /docker/backend
+    schedule:
+      interval: daily
+      time: "06:00"
+      timezone: Etc/UTC
+    commit-message:
+      prefix: "chore"
+    open-pull-requests-limit: 5
+    reviewers:
+      - Aureliolo
+    labels:
+      - type:chore
+
+  - package-ecosystem: docker
+    directory: /docker/web
+    schedule:
+      interval: daily
+      time: "06:00"
+      timezone: Etc/UTC
+    commit-message:
+      prefix: "chore"
+    open-pull-requests-limit: 5
+    reviewers:
+      - Aureliolo
+    labels:
+      - type:chore

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-python-uv
@@ -37,7 +37,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-python-uv
@@ -54,7 +54,7 @@ jobs:
       matrix:
         python-version: ["3.14"]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-python-uv
@@ -73,6 +73,8 @@ jobs:
             --cov-fail-under=80 \
             --junitxml=junit.xml
 
+      # Codecov upload is best-effort — CI should not fail on Codecov outages
+      # or missing tokens. Coverage enforcement is handled by --cov-fail-under.
       - name: Upload coverage to Codecov
         if: always()
         uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5
@@ -83,7 +85,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         with:
           name: test-results-${{ matrix.python-version }}
           path: junit.xml

.github/workflows/dependency-review.yml

@@ -14,12 +14,12 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
 
       - name: Dependency Review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4
         with:
           fail-on-severity: high
           # LicenseRef-scancode-free-unknown: aiosqlite 0.21.0 — MIT per classifiers, scancode misdetects