[HivMindAI]

Summary

• add a provider-neutral two-container private deployment profile for one trusted operator
• keep FastAPI internal, expose only the Next.js loopback port, and persist the full MLForge workspace in one Docker volume
• add liveness/readiness endpoints with durable storage verification
• add non-root Docker images, Compose hardening, operational documentation, and a CI deployment smoke test
• enable the Next.js standalone production output

Security boundary

This profile is intentionally single-user and private. It must be accessed through an SSH tunnel or a reviewed private gateway and must not be exposed directly to the public internet.

Validation

• ruff check .
• ruff format --check .
• mypy src tests
• python -m pytest — 244 passed, 85.12% coverage
• python -m build
• npm run lint
• npm run build

Docker is not installed on the development workstation, so the new GitHub Actions job validates Compose configuration, builds both images, starts the stack, and checks browser-facing readiness.