chore(monorepo): audit + targeted fixes for production readiness (#3)

Author: moralespanitz

.dockerignore

@@ -0,0 +1,34 @@
+# Build-context exclusions for any Dockerfile that uses the workspace root as
+# its build context (e.g. packages/core/Dockerfile).
+
+**/node_modules
+**/.turbo
+**/dist
+**/coverage
+**/.next
+**/.cache
+**/eval-results
+**/logs
+**/test-results
+**/tmp
+**/.DS_Store
+**/*.log
+
+# Secrets — never bake into images. Templates are allowed.
+**/.env
+**/.env.*
+!**/.env.example
+!**/.env.test.example
+
+# Local checkout-only state.
+.git
+.github
+.husky
+.changeset
+
+# Docs and assets that are not needed by the runtime image.
+docs
+web
+*.md
+!packages/core/README.md
+!README.md

.github/CODEOWNERS

@@ -39,6 +39,5 @@
 /adapters/                              @atomicstrata/atomicmemory-integrations
 /plugins/                               @atomicstrata/atomicmemory-integrations
 
-# Public smoke and docs surface.
+# Public smoke surface.
 /tests/                                 @atomicstrata/atomicmemory-maintainers
-/docs/                                  @atomicstrata/atomicmemory-maintainers

.github/workflows/ci.yml

@@ -38,8 +38,6 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
       - name: Run repo hygiene
         run: node scripts/ci/repo-hygiene.mjs
-      - name: Validate migration inventories
-        run: node scripts/ci/migration-inventories.mjs --check
 
   package-metadata:
     name: package-metadata

.gitignore

@@ -17,6 +17,8 @@ __pycache__/
 
 # Turborepo
 .turbo/
+# `turbo prune --docker` scratch output (also produced inside Dockerfile stages)
+out/
 
 # Logs
 *.log
@@ -25,10 +27,13 @@ pnpm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 
-# Env files (never commit secrets)
+# Env files (never commit secrets). Sanitized example templates are allowed.
 .env
 .env.*
 !.env.example
+!.env*.example
+# Smoke-test scratch env created by packages/core/scripts/docker-smoke-test.sh.
+.env.docker-smoke-test
 
 # OS / editor
 .DS_Store
@@ -42,3 +47,6 @@ Thumbs.db
 .tmp/
 tmp/
 *.local
+
+# Local raw-storage filesystem data (RAW_STORAGE_LOCAL_FS_ROOT defaults).
+data/raw-storage/

.npmrc

@@ -0,0 +1,7 @@
+# Link workspace packages locally during install so changes to packages/sdk
+# (and other workspace publishables) flow through to consumers like
+# packages/cli without a publish round-trip. The `prepublishOnly` guards in
+# each consumer still reject `workspace:` ranges, so published builds remain
+# pinned to registry versions — this only affects local dev resolution.
+link-workspace-packages=deep
+prefer-workspace-packages=true

AGENTS.md

@@ -13,7 +13,6 @@ repository. Human-facing project context lives in `README.md`, `CONTRIBUTING.md`
 - `plugins/` contains host integrations.
 - `tests/smoke/` contains public smoke contracts and contributor-safe release
   checks.
-- `docs/` contains public docs and migration provenance material.
 - `examples/` is reserved for future examples that have owners and CI coverage.
 
 ## Working Rules

CONTRIBUTING.md

@@ -68,7 +68,7 @@ lands in `packages/`, `adapters/`, or `plugins/`. Each package owns its own
 
 - Default branch: `main`. Direct pushes to `main` are not permitted.
 - Branch from `main` using a descriptive name (`feat/...`, `fix/...`,
-  `docs/...`, `chore/...`).
+  `chore/...`).
 - Keep commits small and focused. Use Conventional Commits style messages when
   practical (`feat(sdk): ...`, `fix(adapters/langchain): ...`).
 - Sign your commits where you can. Branch protection may require verified
@@ -109,7 +109,6 @@ must be green before merge.
 | `plugins/` | Host integrations. Directory uses the bare host name; package uses the `-plugin` suffix. |
 | `examples/` | Reserved for phase 2+. Only land examples with owners and CI coverage. |
 | `tests/smoke/` | Public, contributor-safe smoke tests and docs contracts. |
-| `docs/` | Public docs surface that ships from this repository. |
 
 Release orchestration, marketplace operations, sensitive service configuration,
 and any path under `/Users/...` are out of scope for this repository. If a

README.md

@@ -268,7 +268,6 @@ adapters/      framework integrations (Vercel AI, OpenAI Agents, LangChain,
 plugins/       host integrations (Claude Code, OpenClaw, Hermes, Codex, Cursor)
 examples/      reserved for phase 2+; only added with owners and CI coverage
 tests/smoke/   public, contributor-safe smoke tests
-docs/          public docs surface and migration provenance
 ```
 
 Release orchestration, marketplace operations, sensitive service configuration,