feat(market-making): add docker image, compose, and docker hub publish

[julien-devatom]

Why

The market-making bot had no container distribution story: no Dockerfile, no compose file, and no publish path. Unlike the liquidators (deployed by us to Railway), this bot is meant to be run by operators on their own hosts, so it needs a published Docker Hub image plus a fully parametrizable runtime — YAML config, environment variables, or both — matching the CLI's existing configuration precedence (any set env var overrides its YAML counterpart). Releasing follows morpho-apps: a CalVer version bump in the PR is the release act; CI cuts the GitHub release, publishes the image, announces on Slack, and writes the notes.

What

• bots/market-making/Dockerfile — bun-workspace image (repo-root build context, mirrors blue-liquidation). The entrypoint is the mm CLI itself, so the container command selects any subcommand/flag (--readonly setup-check, --config /config/market-making.yaml start, …); the default command is the verbose combined monitor (start --verbose), which the Railway deployment from main runs via the image CMD.
• bots/market-making/docker-compose.yml — bind-mounts ./market-making.yaml read-only with create_host_path: false (fails loud when missing) and declares every supported variable as a null passthrough. Deliberately not ${VAR:-}: the config loader treats any set variable — even empty — as an override, so blue-liquidation's pattern would clobber YAML values. stop_grace_period defaults to 15m (override via STOP_GRACE_PERIOD) so shutdown cleanup — serial owned-offer cancellation, each receipt bounded by TRANSACTION_RECEIPT_TIMEOUT_MS (max 15m) — finishes before SIGKILL (Codex finding, fixed). A named state volume persists the bot's durable offer-group ownership (XDG_STATE_HOME=/state, pinned in the image) across recreations — without it a recreated container treats its own live offers as foreign (Devin finding, fixed).
• .github/workflows/deploy-market-making.yml — publishes to Docker Hub when a market-making-* GitHub release is published (other releases skip the job), or on manual dispatch. A release run builds the tagged commit and pushes the release tag verbatim + git-<shortsha>, moving latest unless prerelease; a dispatch builds the dispatched ref and pushes the tag input + git-<shortsha>. The Slack announcement happens after every image tag is pushed: release-slack-notify.yml skips market-making-* release events and this workflow re-enters it via its tag dispatch input, so an announced release always has its image (Codex finding, fixed).
• .github/workflows/tag-releases.yml — ported from morpho-apps (adapted apps/* → bots/*, ubuntu runners, allowlist instead of a static-version list): a merged PR bumping bots/market-making/package.json to CalVer YYYY.MM.DD-N creates the market-making-<version> release. Scoped to market-making only (paths filter + in-loop allowlist): the Railway bots release through deploy-production.yml strictly after a successful deploy, so a directory-scan release path would announce production releases that were never deployed (Codex finding, fixed). Every bumped version is validated before any release is created, so a non-CalVer bump fails loud with zero partial side effects (Codex finding, fixed). Releases are cut with the GIT_BOT_* GitHub App token precisely so the release event fires downstream workflows (image publish, Slack notify) — the default GITHUB_TOKEN is blocked from that by GitHub. A merge carrying both a version bump and the release-market-making label yields entirely to the label flow, so one merge never races itself into a pre-deploy publish or two same-day tags (Codex finding, fixed); version changes are detected against the push baseline github.event.before (zero-SHA/unreachable fallback to HEAD~1), so a bump buried in a multi-commit push still releases (Codex finding, fixed). Deviations from the original: initial notes are GitHub-generated from the bot's previous tag (--notes-start-tag) instead of a placeholder, because this repo's Slack post fires at publish time and must carry real content; and releases target the exact triggering commit (--target "$GITHUB_SHA") rather than the moving main pointer, which is resolved server-side at API-call time (Devin finding, fixed).
• .github/workflows/claude-write-release-notes.yml — ported from morpho-apps: consumes the write-release-notes repository_dispatch and rewrites the release notes via the pre-existing .claude/commands/ci-write-release-notes.md command (whose packages/{bot} paths are fixed to bots/{bot} + shared packages/ in this PR). Skips cleanly — not fails — while ANTHROPIC_API_KEY is absent. The per-app Slack-channel job from the original is dropped (release-slack-notify.yml covers announcing), and show_full_output stays off — the job holds an API key and a write token while allowing Bash (Codex finding, fixed).
• .dockerignore + .gitignore — the build context excludes every non-example **/*.yaml/**/*.yml (--config accepts arbitrary operator-chosen filenames) and **/*.env under any name (--env-file does too, e.g. market-making.env); .gitignore gains the same *.env rule plus any *market-making*-named YAML variant (examples and .github/** excepted), so secret-bearing configs can be neither baked into an image nor committed (Codex findings, fixed). The README tells operators to keep env files outside the repository tree and to include market-making in the filename of any in-tree custom YAML config.
• src/application/version.service.ts — mm --version now reads the package.json version (the release-tag source) instead of a hardcoded 0.0.0, so the version reported inside a published image matches its market-making-<version> release; tests assert manifest equality (Codex finding, fixed).
• README — new ## Docker section: build, run with env vars, run with mounted YAML, compose, release flow + one-time setup, deployed-host example. CLAUDE.md operator-surface sentence updated to match (mirror discipline).

Merge with main's Railway deployment (PR #136)

While this PR was in review, main landed market-making's Railway production deployment (its own Dockerfile/compose, scripts/deploy-railway.ts, the deploy-market-making-production.yml label flow, and the market-making-production environment). The merge reconciles the two on shared artifacts:

• One image, two deploy paths: the merged Dockerfile keeps this PR's mm-CLI entrypoint and XDG_STATE_HOME=/state while defaulting CMD to main's start --verbose — Railway (which runs the image CMD via RAILWAY_DOCKERFILE_PATH) behaves exactly as main shipped it, and operators keep full command parametrization.
• Compose: this PR's YAML + null-passthrough operator shape wins (main's was env-only with ${VAR:?}); main's market-making-state volume name is adopted and --verbose added to match the monitor default.
• Environment split: the publish workflow now uses a dedicated market-making-dockerhub environment — market-making-production already holds the Railway credentials on main, and mixing both credential sets in one environment would let each flow read the other's secrets.
• Coexisting release origins: deploy-production.yml's Release-market-making job (label flow, after a successful Railway deploy) now mints the same GIT_BOT_* App token as tag-releases (with a github.token fallback while the credentials don't exist), so label-flow releases also trigger the image publish — every market-making release gets an image and a post-publish Slack announcement regardless of origin; the already-exists guard keeps the two origins from double-creating a tag.
• README: both sections coexist — ## Docker (operator containers + Docker Hub publish) and main's ## Deploy (Railway) — with cross-links.

Release flow

Bump version in bots/market-making/package.json to YYYY.MM.DD-N inside the PR. On merge: tag-releases creates market-making-<version> (App token) → deploy-market-making publishes docker.io/<repo>:{market-making-YYYY.MM.DD-N, latest, git-<sha>}, then triggers the Slack announcement → claude-write-release-notes rewrites the notes. A release-market-making-labeled merge reaches the same publish path after its Railway deploy succeeds. Direct gh release create "market-making-…" and gh workflow run deploy-market-making.yml -f tag=… remain as manual paths.

One-time setup before first publish

1. market-making-dockerhub GitHub Environment (distinct from the Railway market-making-production one): secrets DOCKERHUB_USERNAME + DOCKERHUB_TOKEN (write-scope token; reaches docker login via stdin only), variable DOCKERHUB_REPOSITORY (<namespace>/<name>); deployment branches/tags policy allowing branch main and tags market-making-* (release runs execute on the tag ref).
2. The org GitHub App credentials GIT_BOT_CLIENT_ID / GIT_BOT_PRIVATE_KEY (same pair as morpho-apps) available to this repo.
3. Optional ANTHROPIC_API_KEY for the notes rewrite.

Reviewer notes

• The publish workflow validates DOCKERHUB_REPOSITORY as a two-component lowercase Docker Hub reference (a dotted or localhost first component would be read by docker as a registry host); docker tags are charset-validated.
• Earlier iterations implemented the publish as a CLI script, then as a PR-label flow; both were replaced per review direction — the net diff carries only the workflows.
• Verified: typecheck, lint (0 warnings), format, knip, jsdoc:check/jsdoc:build, full bun test (3 remaining failures are pre-existing anvil-fork/RPC-gated suites, identical on a clean tree), YAML parse of all three workflows, and shell-level simulations of both the publish tag derivation (release/prerelease/dispatch/invalid) and the two-phase tag-releases loop (CalVer bump with previous tag → correct --notes-start-tag; unchanged version → no-op; multi-bot push with one invalid bump → loud failure with zero releases created; all-valid multi-bot push → all created). docker build itself and the workflows' first CI runs remain unverified until the secrets/environment exist.

🤖 Generated with Claude Code

[devin-ai-integration]

Devin Review found 2 potential issues.

View 2 additional findings in Devin Review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 273484137d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[julien-devatom]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3028dbc8ae

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[prd-carapulse]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 28accb78d3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".