feat(deploy): Hugging Face Spaces Dockerfile + supervisord launcher

- Dockerfile.hf: python:3.12-slim base, system deps for RDKit /
nibabel / MNE, pip install requirements.txt, BUILD-TIME train of
the BBB model artifact (RUN python -m src.models.bbb_model) so the
first /predict/bbb call is instant on cold start.
- ENV defaults: DEPLOY_ENV=hf_spaces, NEUROBRIDGE_DISABLE_MLFLOW=1,
NEUROBRIDGE_DISABLE_LLM=1 (jury can opt back into LLM by setting
OPENROUTER_API_KEY in HF Space secrets and unsetting the disable
flag).
- supervisord.conf launches FastAPI on :8000 and Streamlit on :7860
in the same container; Streamlit exposes the HF public URL.
- .dockerignore trims build context (data/processed, mlruns, .venv,
tests/ except fixtures, docs).
- 2 new smoke tests: Dockerfile exists and contains expected stages.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -1,12 +1,16 @@
 .venv/
-.venv312/
+.venv*/
 __pycache__/
 *.pyc
 .pytest_cache/
 .mypy_cache/
-data/raw/*
-data/processed/*
+.ruff_cache/
+data/processed/
 mlruns/
 .git/
+.github/
 docs/
 tests/
+!tests/fixtures/
+.streamlit/
+notebooks/

Dockerfile.hf

@@ -0,0 +1,45 @@
+# NeuroBridge Enterprise — Hugging Face Spaces deployment image
+# Single container running FastAPI (port 8000) + Streamlit (port 7860).
+# HF Spaces routes :7860 to the public URL automatically.
+
+FROM python:3.12-slim AS base
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1 \
+    DEPLOY_ENV=hf_spaces \
+    NEUROBRIDGE_DISABLE_MLFLOW=1 \
+    NEUROBRIDGE_DISABLE_LLM=1
+
+# --- system deps for RDKit, nibabel, MNE ---
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    libgomp1 \
+    libxrender1 \
+    libsm6 \
+    libxext6 \
+    supervisor \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+# --- Python deps ---
+COPY requirements.txt ./
+RUN pip install -r requirements.txt
+
+# --- project source ---
+COPY src/ ./src/
+COPY tests/fixtures/ ./tests/fixtures/
+COPY data/raw/ ./data/raw/
+COPY supervisord.conf ./supervisord.conf
+
+# --- build BBB model artifact at image-build time ---
+# This makes the first /predict/bbb call instant on cold start.
+RUN python -m src.models.bbb_model
+
+# --- HF Spaces convention ---
+EXPOSE 7860
+
+# --- launch FastAPI + Streamlit under supervisord ---
+CMD ["supervisord", "-n", "-c", "/app/supervisord.conf"]

supervisord.conf

@@ -0,0 +1,25 @@
+[supervisord]
+nodaemon=true
+user=root
+logfile=/dev/stdout
+logfile_maxbytes=0
+pidfile=/tmp/supervisord.pid
+
+[program:fastapi]
+command=uvicorn src.api.main:app --host 0.0.0.0 --port 8000
+autostart=true
+autorestart=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:streamlit]
+command=streamlit run src/frontend/app.py --server.port 7860 --server.address 0.0.0.0 --server.headless true --server.enableCORS false
+environment=NEUROBRIDGE_API_URL="http://127.0.0.1:8000"
+autostart=true
+autorestart=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0

tests/deploy/test_dockerfile_hf.py

@@ -0,0 +1,50 @@
+"""Smoke test: Dockerfile.hf is well-formed and contains expected stages.
+
+We don't actually build the image (too slow for unit tests). We just verify
+the file exists, is non-empty, and has the load-bearing instructions.
+"""
+from pathlib import Path
+
+import pytest
+
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+DOCKERFILE = REPO_ROOT / "Dockerfile.hf"
+
+
+@pytest.fixture(scope="module")
+def dockerfile_text() -> str:
+    if not DOCKERFILE.exists():
+        pytest.skip(f"{DOCKERFILE} does not exist yet (Day-8 T3 RED phase)")
+    return DOCKERFILE.read_text()
+
+
+class TestDockerfileHF:
+    """Day-8 T3: Hugging Face Spaces Dockerfile smoke."""
+
+    def test_dockerfile_exists_and_nonempty(self):
+        assert DOCKERFILE.exists(), f"missing {DOCKERFILE}"
+        assert DOCKERFILE.stat().st_size > 0, f"{DOCKERFILE} is empty"
+
+    def test_dockerfile_contains_required_stages(self, dockerfile_text):
+        """The HF Dockerfile must:
+        - Start FROM a Python base
+        - Install requirements.txt
+        - Build the BBB model artifact at build time
+        - Set NEUROBRIDGE_DISABLE_MLFLOW=1 by default
+        - Expose port 7860 (HF Spaces convention)
+        - Launch via supervisord
+        """
+        text = dockerfile_text.lower()
+        assert "from python" in text, "must FROM a Python base image"
+        assert "requirements.txt" in text, "must reference requirements.txt"
+        assert "src.models.bbb_model" in dockerfile_text, (
+            "must build the BBB model artifact at image-build time"
+        )
+        assert "neurobridge_disable_mlflow" in text, (
+            "must set NEUROBRIDGE_DISABLE_MLFLOW for HF deploy"
+        )
+        assert "7860" in text, "must expose port 7860 (HF Spaces convention)"
+        assert "supervisord" in text, (
+            "must launch FastAPI + Streamlit via supervisord"
+        )