Fix Docker builds and add Railway root config

.dockerignore

@@ -0,0 +1,31 @@
+# Keep the build context small and reproducible. Anything generated on a
+# developer machine must not leak into an image.
+node_modules
+**/node_modules
+
+.next
+**/.next
+dist
+**/dist
+build
+**/build
+
+*.db
+*.db-wal
+*.db-shm
+local.db*
+
+.git
+.github
+.claude
+coverage
+*.log
+
+.env
+.env.*
+!.env.example
+
+README.md
+CLAUDE.md
+AGENTS.md
+docs

README.md

@@ -9,16 +9,19 @@ platform, the prospect, or your own rate limits say it should not.
 
 ## Status
 
-Foundation. The deterministic core of V1 is built and tested; the AI agents and
-the PWA are not. See [`docs/prd-implementation-map.md`](docs/prd-implementation-map.md)
-for exactly what exists.
+Foundation. The deterministic core, the API, the PWA and one live provider are
+built and tested; a prospect can go from a GitHub handle to a card in the
+approval queue today. The LLM layer — the outreach composer and the rest of the
+§20 agent suite — is not built. See
+[`docs/prd-implementation-map.md`](docs/prd-implementation-map.md) for exactly
+what exists.
 
 ## Quick start
 
 ```bash
 bun install
 bun run db:migrate          # applies migrations to ./local.db
-bun test                    # 202 tests
+bun test                    # 265 tests
 bun run check               # format, typecheck, test
 ```
 
@@ -43,6 +46,7 @@ packages/
   domain/     canonical types — depends on nothing
   db/         Turso/libSQL client and migration runner
   policy/     the deterministic policy engine
+  recommend/  next-best-action engine
   identity/   cross-network identity resolution
   signals/    signal decay
   scoring/    ICP fit, intent, reachability, relationship, opportunity
@@ -52,6 +56,22 @@ migrations/   forward-only .sql, applied in filename order
 docker/       one Dockerfile per deployable service
 ```
 
+## The pipeline
+
+One GitHub handle goes all the way to a card in the approval queue:
+
+```text
+enrich → resolve identities → collect signals → score → recommend
+```
+
+`apps/worker/src/pipeline.ts` runs it. GitHub first because it is free, its
+profiles carry links the person published themselves — `twitter_username`,
+`blog`, `company` — and developer tooling is the launch wedge. A real profile
+typically yields three linked identities before any paid provider is touched.
+
+Each stage persists before the next runs, so a crash resumes rather than
+restarting, and a half-enriched prospect is still inspectable.
+
 ## The three ideas worth knowing
 
 **The policy engine is arithmetic, not judgement.** Every outbound action
@@ -85,12 +105,29 @@ someone who opted out.
 
 ## Deployment
 
-Railway, one service per Dockerfile, deploying from this repository. Each
-service has its own `railway.json` with a health check. Migrations run as an
-explicit release step, never from every replica.
+Railway, one service per Dockerfile, deploying from this repository.
+
+The root `railway.json` configures the **default service** as the API. For each
+additional service, open its settings and set the config file path — Railway
+only reads a subdirectory config if you point it there:
+
+| Service | Config file path            |
+| ------- | --------------------------- |
+| api     | `/railway.json`             |
+| web     | `/apps/web/railway.json`    |
+| worker  | `/apps/worker/railway.json` |
+
+**Leave Root Directory unset.** These Dockerfiles expect the repository root as
+their build context; scoping a service to `apps/web` breaks every `COPY` and
+the workspace install.
+
+Without a config file Railway falls back to railpack auto-detection, which
+cannot find a start command in a Bun workspace and fails the build — that
+symptom means the service is not pointed at its config.
 
-Set up separate Turso databases, provider keys, and secrets per environment.
-Production customer data is never copied into staging.
+Migrations run as an explicit release step, never from every replica. Set up
+separate Turso databases, provider keys, and secrets per environment;
+production customer data is never copied into staging.
 
 ## Conventions
 

apps/worker/package.json

@@ -17,6 +17,7 @@
     "@outreachgraph/policy": "workspace:*",
     "@outreachgraph/providers": "workspace:*",
     "@outreachgraph/scoring": "workspace:*",
-    "@outreachgraph/signals": "workspace:*"
+    "@outreachgraph/signals": "workspace:*",
+    "@outreachgraph/recommend": "workspace:*"
   }
 }