build: add the container image and developer targets

The artifact is baked into the image rather than mounted so that the
image tag is a complete description of what the service predicts and a
rollback is deploying the previous tag.

The build runs the golden row check so that an image unable to reproduce
its own recorded prediction never reaches a registry.

Dockerfile

@@ -0,0 +1,48 @@
+# The model is baked into the image rather than mounted, so the image tag is a complete
+# description of what the service will predict and rolling back means deploying the
+# previous tag. The build fails if the artifact does not reproduce its own golden row.
+
+FROM python:3.13-slim AS builder
+
+ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1
+
+WORKDIR /app
+COPY requirements.txt .
+RUN python -m venv /opt/venv \
+ && /opt/venv/bin/pip install --upgrade pip \
+ && /opt/venv/bin/pip install -r requirements.txt
+
+
+FROM python:3.13-slim AS runtime
+
+ENV PATH="/opt/venv/bin:$PATH" \
+    PYTHONPATH=/app \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    OMP_NUM_THREADS=2 \
+    OPENBLAS_NUM_THREADS=2 \
+    MKL_NUM_THREADS=2
+
+COPY --from=builder /opt/venv /opt/venv
+
+WORKDIR /app
+COPY phiusiil/ ./phiusiil/
+COPY server/ ./server/
+COPY model/ ./model/
+COPY pyproject.toml README.md ./
+
+RUN useradd --uid 10001 --no-create-home --shell /usr/sbin/nologin serve \
+ && chown -R serve:serve /app
+USER serve
+
+# Boot-time honesty check, at build time: an image whose artifact produces different
+# numbers from the training run must not be publishable.
+RUN python -m server.selftest --golden
+
+EXPOSE 8000
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+    CMD python -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/healthz', timeout=4).status==200 else 1)"
+
+CMD ["uvicorn", "server.app:app", "--host", "0.0.0.0", "--port", "8000"]

Makefile

@@ -0,0 +1,41 @@
+VENV := .venv
+PY := $(VENV)/bin/python
+PIP := $(VENV)/bin/pip
+PORT ?= 8000
+IMAGE ?= fetiai-v1-phiusiil-binclf-knn-scratch-500k:local
+
+.DEFAULT_GOAL := help
+
+help: ## Show this help
+	@grep -hE '^[a-zA-Z_-]+:.*?## ' $(MAKEFILE_LIST) | awk 'BEGIN{FS=":.*?## "}{printf "  \033[36m%-16s\033[0m %s\n", $$1, $$2}'
+
+$(VENV): ## Create the virtualenv
+	python3 -m venv $(VENV)
+
+install: $(VENV) ## Install pinned dependencies
+	$(PIP) install --upgrade pip
+	$(PIP) install -r requirements.txt -r requirements-dev.txt
+
+selftest: ## Verify the artifact reproduces its recorded golden row
+	$(PY) -m server.selftest --golden
+
+namecheck: ## Fail if the parent project's internal library name appears anywhere
+	$(PY) -m pytest tests/test_naming.py -q
+
+test: ## Run the full offline suite
+	$(PY) -m pytest -q
+
+serve: ## Run the API on http://127.0.0.1:$(PORT)
+	$(VENV)/bin/uvicorn server.app:app --host 127.0.0.1 --port $(PORT)
+
+docker-build: ## Build the container image
+	docker build -t $(IMAGE) .
+
+docker-test: ## Run the golden-row self-test inside the built image
+	docker run --rm $(IMAGE) python -m server.selftest --golden
+
+clean: ## Remove caches
+	rm -rf .pytest_cache .ruff_cache .mypy_cache
+	find . -name __pycache__ -type d -prune -exec rm -rf {} +
+
+.PHONY: help install selftest namecheck test serve docker-build docker-test clean