docker/: move compose stack to top-level docker/ folder

Mirror the charts/ layout — docker/docker-compose.yml + docker/README.md
sit at the repo root rather than being scattered across modules/ and
docs/deployment/. docker/README.md takes over as the canonical Docker
Compose deployment guide; old docs/deployment/ folder removed.

- Rewrite docker/README.md as a charts/README.md-shaped guide (no .env
  references, paths relative to new home).
- Update internal paths in docker/docker-compose.yml: schema.sql volume
  becomes ../modules/track-service/sql/schema.sql; quickstart hint reads
  cd docker.
- Update root README.md and AGENTS.md call sites (compose/cd hints,
  directory tree).
- Also gitignore */keyvault-secret-provider.local.yaml so per-cluster
  AKS overrides don't get tracked.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: cosmic-flood

.gitignore

@@ -201,4 +201,9 @@ data-process/stats-service/*.pyc
 data-process/stats-service/.venv/
 data-process/stats-service/venv/
 data-process/stats-service/.env
-!data-process/stats-service/.env.example
+!data-process/stats-service/.env.example
+
+# ======
+# charts/ (Helm)
+# ======
+charts/featbit-rda/**/values.local.yaml

AGENTS.md

@@ -53,7 +53,7 @@ Storage:
   ClickHouse          ← track-service read/write
 ```
 
-The runtime services (web, track-service, run-active-test) are wired together in `modules/docker-compose.yml`. The local-mode connector is published to npm and is **not** part of `docker compose` — each end user runs it themselves on their own machine.
+The runtime services (web, track-service, run-active-test) are wired together in `docker/docker-compose.yml`. The local-mode connector is published to npm and is **not** part of `docker compose` — each end user runs it themselves on their own machine.
 
 ---
 
@@ -304,10 +304,11 @@ npm run deploy
 
 ## 🐳 Docker Compose
 
-One self-contained compose file. All values are hard-coded — no `.env`, no `${}` substitution. To customize anything (image tag, passwords, FeatBit URL, signing key, sandbox0 key), edit `modules/docker-compose.yml` directly.
+One self-contained compose file. All values are hard-coded — no `.env`, no `${}` substitution. To customize anything (image tag, passwords, FeatBit URL, signing key, sandbox0 key), edit `docker/docker-compose.yml` directly.
 
 ```
-modules/
+docker/
+  README.md            ← deployment guide
   docker-compose.yml   ← single source of truth: image tags, ports, env, volumes, the x-signing-key anchor
 ```
 
@@ -327,7 +328,7 @@ The `Local Claude Code` chat path is **not** a docker service — users run `npx
 ### Start / Stop
 
 ```bash
-cd modules
+cd docker
 
 # 1. Replace REPLACE_ME in the x-signing-key anchor at the top of docker-compose.yml
 # 2. Bring it up:

README.md

@@ -25,7 +25,7 @@ The FeatBit Release Decision Agent is built **on top of** the FeatBit feature-fl
 
 **SaaS path** — sign up at **[featbit.co](https://featbit.co)** and you're done; FeatBit + RDA are bundled.
 
-**Self-host path** — install FeatBit first from **[github.com/featbit/featbit](https://github.com/featbit/featbit)** (Docker Compose or Helm). Replace `FEATBIT_API_URL` on the `web` block in `modules/docker-compose.yml` (or set `web.featbit.apiUrl` in Helm values) to point RDA's web at your FeatBit — runtime env, no rebuild required.
+**Self-host path** — install FeatBit first from **[github.com/featbit/featbit](https://github.com/featbit/featbit)** (Docker Compose or Helm). Replace `FEATBIT_API_URL` on the `web` block in `docker/docker-compose.yml` (or set `web.featbit.apiUrl` in Helm values) to point RDA's web at your FeatBit — runtime env, no rebuild required.
 
 PostgreSQL and ClickHouse are bundled into the Docker Compose stack and bootstrap themselves on first boot — you don't have to provision them. You can override the connection strings to point at your own databases instead; see the deployment guides.
 
@@ -37,7 +37,7 @@ The fastest path is the hosted version: sign up at **[featbit.co](https://featbi
 
 #### 2. Self-host with Docker Compose
 
-Full step-by-step guide: **[`docs/deployment/docker.md`](docs/deployment/docker.md)**.
+Full step-by-step guide: **[`docker/README.md`](docker/README.md)**.
 
 #### 3. Self-host with Helm on Kubernetes
 
@@ -118,7 +118,7 @@ Every experiment carries a `dataSourceMode`. The default (`featbit-managed`) pul
 
 - **[`AGENTS.md`](AGENTS.md)** — full service map, environment variables, troubleshooting, and the canonical metric storage contract.
 - **[`WHITE_PAPER.md`](WHITE_PAPER.md)** — product thesis and market positioning.
-- **[`docs/deployment/docker.md`](docs/deployment/docker.md)** — Docker Compose deployment, end to end.
+- **[`docker/README.md`](docker/README.md)** — Docker Compose deployment, end to end.
 - **[`charts/README.md`](charts/README.md)** — Helm chart deployment: install, prerequisites, layout, design decisions, AKS examples.
 - **[`docs/usage/`](docs/usage/)** — usage docs (placeholder until the docs site is published).
 - **[`skills/featbit-release-decision/`](skills/featbit-release-decision/)** — the release-decision workflow + CF-01 → CF-08 phase definitions.

docs/deployment/docker.md docker/README.mddocs/deployment/docker.md renamed to docker/README.md

@@ -1,25 +1,27 @@
-# Docker Compose deployment
+# FeatBit RDA Docker Compose stack
 
-The compose stack ships everything in one command — web, track-service, PostgreSQL, ClickHouse. Both database schemas bootstrap themselves on first boot, so there is nothing to apply by hand.
+Self-contained Docker Compose stack — `web`, `track-service`, PostgreSQL, ClickHouse — for single-host deployments and local trials. Both database schemas bootstrap themselves on first boot, so there is nothing to apply by hand.
+
+---
 
 ## What ships
 
 | Service | Image | Port | Notes |
 |---|---|---|---|
-| `web` | `featbit/featbit-rda-web:${VERSION}` | `3000` | Runs `prisma migrate deploy` against `DATABASE_URL` on every container start. |
-| `track-service` | `featbit/featbit-rda-track-service:${VERSION}` | `5050 → 8080` | Event ingest + per-experiment metric query. |
+| `web` | `featbit/featbit-rda-web:0.0.4-beta` | `3000` | Runs `prisma migrate deploy` against `DATABASE_URL` on every container start. |
+| `track-service` | `featbit/featbit-rda-track-service:0.0.4-beta` | `5050 → 8080` | Event ingest + per-experiment metric query. |
 | `postgres` | `postgres:16-alpine` | `5432` | Persistent volume `pg_data`. |
-| `clickhouse` | `clickhouse/clickhouse-server:24-alpine` | `8123`, `9000` | Auto-applies `track-service/sql/schema.sql` from `/docker-entrypoint-initdb.d/` on first boot. Persistent volume `ch_data`. |
+| `clickhouse` | `clickhouse/clickhouse-server:24-alpine` | `8123`, `9000` | Auto-applies `modules/track-service/sql/schema.sql` from `/docker-entrypoint-initdb.d/` on first boot. Persistent volume `ch_data`. |
 
-External dependency that **isn't** in the stack: a running FeatBit instance ([`github.com/featbit/featbit`](https://github.com/featbit/featbit)). Defaults to FeatBit SaaS (`https://app-api-experimentation.featbit.co`); self-hosters set `FEATBIT_API_URL` in `.env`.
+External dependency that **isn't** in the stack: a running FeatBit instance ([`github.com/featbit/featbit`](https://github.com/featbit/featbit)). Defaults to FeatBit SaaS (`https://app-api-experimentation.featbit.co`); self-hosters replace `FEATBIT_API_URL` on the `web` block.
 
 ---
 
 ## Quickstart
 
 The compose file is self-contained — no `.env`, no variable substitution. Two steps:
 
-**1. Set the cross-service signing key.** Open `modules/docker-compose.yml` and replace the `REPLACE_ME` placeholder in the `x-signing-key` anchor near the top with a long random string. Both `web` and `track-service` reference the anchor, so you only edit one place.
+**1. Set the cross-service signing key.** Open `docker/docker-compose.yml` and replace the `REPLACE_ME` placeholder in the `x-signing-key` anchor near the top with a long random string. Both `web` and `track-service` reference the anchor, so you only edit one place.
 
 Generate a key:
 
@@ -36,7 +38,7 @@ openssl rand -base64 48
 **2. Bring the stack up.**
 
 ```bash
-cd modules
+cd docker
 docker compose up -d
 ```
 
@@ -50,7 +52,7 @@ RDA delegates authentication to **FeatBit** — there is no separate user databa
 
 1. Make sure you have a FeatBit account on either:
    - [**featbit.co**](https://featbit.co) (FeatBit SaaS — default), or
-   - your **self-hosted FeatBit instance** ([`github.com/featbit/featbit`](https://github.com/featbit/featbit)). Set `FEATBIT_API_URL` in `.env` and re-`up -d` web before logging in.
+   - your **self-hosted FeatBit instance** ([`github.com/featbit/featbit`](https://github.com/featbit/featbit)). Replace `FEATBIT_API_URL` on the `web` block in `docker-compose.yml` and re-`up -d` web before logging in.
 2. On the login page, enter your FeatBit email + password. RDA forwards the credentials to FeatBit, gets back a JWT, and creates a session.
 
 If FeatBit is unreachable, login fails — check the [troubleshooting](#troubleshooting) row for *Browser login redirects in a loop*.
@@ -59,7 +61,7 @@ If FeatBit is unreachable, login fails — check the [troubleshooting](#troubles
 
 ## Configuration
 
-All knobs live in `modules/docker-compose.yml`. Edit the file directly — there is no `.env` layer. The fields you'll actually touch:
+All knobs live in `docker-compose.yml`. Edit the file directly — there is no `.env` layer. The fields you'll actually touch:
 
 | Field (in compose) | Default | What it does |
 |---|---|---|
@@ -89,7 +91,7 @@ docker compose up -d web track-service postgres
 Two things to know:
 
 - **External PG**: the role in `DATABASE_URL` needs `CREATE` / `ALTER` privileges (web runs `prisma migrate deploy` on every start).
-- **External CH**: apply the schema once before first run — `clickhouse-client --queries-file modules/track-service/sql/schema.sql` (idempotent).
+- **External CH**: apply the schema once before first run — `clickhouse-client --queries-file modules/track-service/sql/schema.sql` (idempotent; path is repo-root-relative).
 
 ### Web only (no track-service / ClickHouse)
 
@@ -103,7 +105,7 @@ docker compose up -d web postgres
 
 ## Going to production
 
-Compose is fine for a single host. For HA, autoscaling, ingress + TLS, secret projection from Key Vault, and pod disruption budgets, use the Helm chart instead — see [`charts/README.md`](../../charts/README.md).
+Compose is fine for a single host. For HA, autoscaling, ingress + TLS, secret projection from Key Vault, and pod disruption budgets, use the Helm chart instead — see [`../charts/README.md`](../charts/README.md).
 
 ---
 
@@ -119,4 +121,4 @@ Compose is fine for a single host. For HA, autoscaling, ingress + TLS, secret pr
 | Chat panel returns `401: missing authorization header` | `SANDBOX0_API_KEY` is `""` in `docker-compose.yml`. |
 | `clickhouse` container doesn't apply `schema.sql` | The init scripts only run when the data dir is empty. Wipe and re-init: `docker compose down -v` then `docker compose up -d` |
 
-For the full service map and env-var reference, see [`AGENTS.md`](../../AGENTS.md).
+For the full service map and env-var reference, see [`../AGENTS.md`](../AGENTS.md).

modules/docker-compose.yml docker/docker-compose.ymlmodules/docker-compose.yml renamed to docker/docker-compose.yml

@@ -7,7 +7,7 @@
 #   1. Replace REPLACE_ME below with a long random string. Generate one:
 #        macOS / Linux:   openssl rand -base64 48
 #        Windows (PS 7+): [Convert]::ToBase64String([Security.Cryptography.RandomNumberGenerator]::GetBytes(48))
-#   2. cd modules && docker compose up -d
+#   2. cd docker && docker compose up -d
 #   3. open http://localhost:3000
 
 # Shared HMAC-SHA256 key for env-secret signing. web mints tokens, track-service
@@ -57,7 +57,7 @@ services:
       # First-boot schema apply. clickhouse-server runs *.sql in this dir as
       # part of init when the data dir is empty. Idempotent on re-runs anyway
       # (uses IF NOT EXISTS), but only the first boot triggers it.
-      - ./track-service/sql/schema.sql:/docker-entrypoint-initdb.d/schema.sql:ro
+      - ../modules/track-service/sql/schema.sql:/docker-entrypoint-initdb.d/schema.sql:ro
     ulimits:
       nofile:
         soft: 262144