docs(mcp): correct Docker context and naming after the review repairs

.dockerignore

@@ -1,4 +1,4 @@
-# Keep Docker build contexts small: both service Dockerfiles use the repo
+# Keep Docker build contexts small: every service Dockerfile uses the repo
 # root as context (the pnpm workspace needs the root lockfile), so anything
 # not excluded here uploads on every build.
 .git

README.md

@@ -64,6 +64,6 @@ issues for vulnerabilities.
 
 [MIT](LICENSE) © IASER
 
-## Faithful Answers MCP application
+## MCP application
 
-[`apps/mcp`](apps/mcp/README.md) exposes Ansari answers through MCP with a self-contained React card for assistant hosts. It uses public saga a2ui packages, embedded Kitab fonts and local artwork. Start it separately with `pnpm mcp build` then `pnpm mcp start`; see its README for environment variables and its standalone Docker build.
+[`apps/mcp`](apps/mcp/README.md) exposes Ansari answers through MCP with a self-contained React card for assistant hosts. It uses public saga a2ui packages, embedded Kitab fonts and local artwork. Start it separately with `pnpm mcp build` then `pnpm mcp start`; see its README for environment variables and its Docker build, which uses the repository root as context.

apps/mcp/README.md

@@ -78,7 +78,7 @@ The same Hono application and official MCP handler (`src/server/fetch-app.ts`) r
 pnpm install --frozen-lockfile --strict-peer-dependencies --filter ansari-mcp...
 pnpm mcp verify          # typecheck, build, build:worker, test, test:browser
 
-# Run the Worker in Wrangler's local runtime under one declared environment (dev, beta or production). Its local secrets are `.dev.vars.<env>` only (git-ignored, and excluded from the Docker build context and the standalone verification copy, together with `.wrangler/` and `dist-worker/`). The script refuses a generic `.dev.vars`, which Wrangler would read for every environment, and turns off Wrangler's `.env` fallback.
+# Run the Worker in Wrangler's local runtime under one declared environment (dev, beta or production). Its local secrets are `.dev.vars.<env>` only (git-ignored, and excluded from the Docker build context, together with `.wrangler/` and `dist-worker/`). The script refuses a generic `.dev.vars`, which Wrangler would read for every environment, and turns off Wrangler's `.env` fallback.
 pnpm dev:worker:dev --var ANSARI_RELEASE:local-1
 curl http://127.0.0.1:8787/health
 ```

apps/mcp/test/copy-boundary.test.ts

@@ -4,7 +4,7 @@ import {existsSync, readFileSync, statSync} from 'node:fs';
 import {join, relative} from 'node:path';
 import {fileURLToPath} from 'node:url';
 
-// The copy boundaries (Docker build context and the standalone verification copy) must not carry
+// The Docker build context (the repository root) must not carry
 // credentials or local runtime state. Everything here is a synthetic marker; no real secret file is read.
 const root=fileURLToPath(new URL('../',import.meta.url));
 const NEVER_COPIED=['.env','.env.local','.dev.vars','.dev.vars.staging','.dev.vars.production','.wrangler/state/v3/cache.sqlite','dist-worker/index.js','node_modules/x/index.js','dist/view.html','.npmrc'];

apps/mcp/test/packaging.test.ts

@@ -54,8 +54,7 @@ test('the manifest pins one exact public version for every SAGA package it impor
   assert.ok(!/"(?:file|link|workspace|git\+?[a-z]*|https?):/.test(JSON.stringify({...manifest.dependencies,overrides:manifest.overrides,pnpm:manifest.pnpm})),'no local, tarball or workspace dependency source');
 });
 
-// Every lockfile that installs this application: the application's own (standalone installation) and, when this folder sits
-// in a monorepo, the workspace root's.
+// The lockfile that installs this application: the workspace root's. The application has none of its own (asserted below).
 const lockfiles:Array<{label:string;text:string;prefix:string}>=[];
 assert.equal(existsSync(join(root,'pnpm-lock.yaml')), false, 'only the root lockfile installs the app');
 assert.equal(existsSync(join(root,'pnpm-workspace.yaml')), false, 'only the root workspace config applies');

codev/resources/arch.md

@@ -48,11 +48,11 @@ The facilitator (`apps/api/lib/facilitator/agent.ts`) answers via a Gemini tool
 
 ## Monorepo layout, build & deploy
 
-The repo is a pnpm workspace of `apps/*` and `packages/*`, driven by Turborepo. `apps/mcp` is the standalone MCP application; it consumes public saga a2ui packages and has no dependency on the other applications. Run it explicitly with `pnpm mcp dev`. Its Docker context is its own directory, unlike the API/auth images described below. The root Markdown adapter override preserves the supported SAGA-owned A2UI dependency combination.
+The repo is a pnpm workspace of `apps/*` and `packages/*`, driven by Turborepo. `apps/mcp` is the standalone MCP application; it consumes public saga a2ui packages and has no dependency on the other applications. Run it explicitly with `pnpm mcp dev`. Like the API and auth images, its image builds from the repo root (see Docker build context below). The root Markdown adapter override preserves the supported SAGA-owned A2UI dependency combination.
 
 **Layout & task running.** Root tasks fan out through one cached Turborepo task graph; `pnpm dev` starts api, auth and frontend (`pnpm dev:no-auth` skips auth). Target a single package with `pnpm api <script>` / `pnpm auth <script>` / `pnpm frontend <script>`, or by running from inside the app directory.
 
-**Docker build context.** Both images build from the repo root, never from the app directory — the pnpm workspace needs the root lockfile and both images `COPY packages packages`. The Dockerfile invocation is always `-f apps/<app>/Dockerfile …` with `.` as the build context.
+**Docker build context.** All three images (api, auth, mcp) build from the repo root, never from the app directory — the pnpm workspace needs the root lockfile and every image does `COPY packages packages`. The Dockerfile invocation is always `-f apps/<app>/Dockerfile …` with `.` as the build context.
 
 **Strict env mode.** Turborepo runs in strict env mode: a variable not declared in `turbo.json` is invisible to tasks and absent from the cache key. Adding an env var means adding it to `globalEnv`, derived by four methods — the Zod schema in `apps/api/lib/config.ts`, a static `process.env.X` grep, a dynamic `process.env[` grep followed to its call-site literals, and the documented surface (`docs/self-hosting.md`, `.env.example`) for variables consumed by dependencies. Each method catches variables the others miss.
 

codev/reviews/301-faithful-answers-mcp.md

@@ -45,9 +45,9 @@ This new transport has not been deployed or qualified in actual hosts. Earlier h
 
 ## Standard application workspace placement
 
-The standalone package now lives at `apps/ansari-faithful-answers`, using the repository's existing `apps/*` enrollment. The extra `app/*` enrollment is removed. The root lockfile change only renames this package's importer: dependency declarations, unrelated importers and all package snapshots are unchanged. All 58 tracked package files moved, with 56 non-documentation files preserved byte-for-byte. CI, current setup instructions and architecture/spec/plan references use the new location. The walkthrough points to that location and retains historical source links at their original immutable revision.
+The standalone package moved to `apps/ansari-faithful-answers` (later renamed `apps/mcp`; see PR #323 review repairs below), using the repository's existing `apps/*` enrollment. The extra `app/*` enrollment is removed. The root lockfile change only renames this package's importer: dependency declarations, unrelated importers and all package snapshots are unchanged. All 58 tracked package files moved, with 56 non-documentation files preserved byte-for-byte. CI, current setup instructions and architecture/spec/plan references use the new location. The walkthrough points to that location and retains historical source links at their original immutable revision.
 
-Fresh qualification from the relocated package passed: root frozen offline installation, frozen application-filtered installation with Node 22, package selection, typecheck, build, all 24 server/packaging tests and 55 browser checks. The public-only isolated installation passed the same application checks, followed by an uncached Node 22 Docker build and no-network/no-mount runtime smoke. The smoke verified complete answer preservation, safe failure/recovery, content-addressed HTML and graceful shutdown. Existing root development commands and package-relative Docker context are unchanged.
+Fresh qualification from the relocated package passed: root frozen offline installation, frozen application-filtered installation with Node 22, package selection, typecheck, build, all 24 server/packaging tests and 55 browser checks. The public-only isolated installation passed the same application checks, followed by an uncached Node 22 Docker build and no-network/no-mount runtime smoke. The smoke verified complete answer preservation, safe failure/recovery, content-addressed HTML and graceful shutdown. Existing root development commands and the package-relative Docker context were unchanged by this move; the PR #323 repairs below moved the Docker context to the repository root.
 
 Separate independent Codex requirements and standards reviews found no actionable issues in the migration. Placement assertions failed against the old directory before the move and passed afterward; walkthrough JavaScript syntax and historical source targets were also checked. This path correction does not establish a new deployment or actual-host acceptance. The existing upstream contribution remains open for maintainer review; no merge, deployment or package release is included.