Make Railway deployments deterministic

.dockerignore

@@ -0,0 +1,8 @@
+.git
+.github
+.railway
+.env*
+build
+node_modules
+test
+npm-debug.log*

.github/workflows/ci.yml

@@ -26,3 +26,28 @@ jobs:
           cache: npm
       - run: npm ci --ignore-scripts
       - run: npm test
+
+  container-smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@v4
+      - run: docker build --tag quantum-rng-api:ci .
+      - run: docker run --detach --name quantum-rng-api --publish 127.0.0.1:8080:8080 quantum-rng-api:ci
+      - name: Verify production container
+        run: |
+          for attempt in {1..60}; do
+            if response="$(curl --fail --silent http://127.0.0.1:8080/v1/health)"; then
+              HEALTH_RESPONSE="$response" node - <<'NODE'
+          const health = JSON.parse(process.env.HEALTH_RESPONSE);
+          if (health.status !== 'ok') throw new Error(`unexpected status: ${health.status}`);
+          if (health.apiVersion !== '2.0.0') throw new Error(`unexpected API version: ${health.apiVersion}`);
+          if (health.engine?.name !== 'quantum_rng_v3') throw new Error(`unexpected engine: ${health.engine?.name}`);
+          NODE
+              exit 0
+            fi
+            sleep 2
+          done
+          docker logs quantum-rng-api
+          exit 1

.gitignore

@@ -13,3 +13,6 @@ yarn-error.log*
 # Environment variables
 .env
 .env.local
+
+# Local Railway project link
+.railway/

Dockerfile

@@ -0,0 +1,31 @@
+FROM node:22-bookworm-slim AS build
+
+WORKDIR /app
+
+RUN apt-get update \
+    && apt-get install --yes --no-install-recommends python3 make g++ \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY package.json package-lock.json binding.gyp ./
+COPY src ./src
+COPY vendor ./vendor
+
+RUN npm ci --omit=dev
+
+FROM node:22-bookworm-slim AS runtime
+
+ENV NODE_ENV=production \
+    HOST=0.0.0.0 \
+    PORT=8080
+
+WORKDIR /app
+
+COPY package.json package-lock.json server.js ./
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/build ./build
+
+USER node
+
+EXPOSE 8080
+
+CMD ["npm", "start"]

README.md

@@ -140,10 +140,14 @@ portable SIMD/scalar paths.
 
 ## Deployment
 
-`railway.toml` supplies the Railway build packages, start command, and
-`/v1/health` probe. A production deployment must place an authenticated,
-rate-limited TLS gateway in front of this process when the output is used by
-untrusted clients or security-sensitive systems.
+Railway builds the root `Dockerfile` with Node.js 22 and deploys `master`
+automatically after the GitHub Actions check suite passes. `railway.toml`
+defines the Docker builder, `/v1/health` probe, and restart policy. CI builds
+and starts the same production image before a change can reach production.
+
+A production deployment must place an authenticated, rate-limited TLS gateway
+in front of this process when the output is used by untrusted clients or
+security-sensitive systems.
 
 The service starts only after the native engine initializes. Unless disabled,
 it also requires the startup CHSH simulation check to exceed the classical

package.json

@@ -7,9 +7,9 @@
   "scripts": {
     "build": "node-gyp rebuild",
     "clean": "node-gyp clean",
+    "install": "npm run build",
     "start": "node server.js",
-    "test": "npm run build && node --test",
-    "postinstall": "npm run build"
+    "test": "npm run build && node --test"
   },
   "gypfile": true,
   "keywords": [

railway.toml

@@ -1,10 +1,9 @@
 [build]
-builder = "nixpacks"
+builder = "DOCKERFILE"
+dockerfilePath = "Dockerfile"
 
 [deploy]
-startCommand = "npm start"
 healthcheckPath = "/v1/health"
 healthcheckTimeout = 100
-
-[nixpacks]
-pkgs = ["python3", "make", "gcc"]
+restartPolicyType = "ON_FAILURE"
+restartPolicyMaxRetries = 3