Review: ISS Makefile + docker-compose + doc updates

Verdict: READY

Template Completeness

• [x] Type — present (Feature)
• [x] Lineage — present (Sub-ticket of #77)
• [x] Repo — present (ldraney/intelligentstaffingsystems)
• [x] User Story — present
• [x] Context — present
• [x] File Targets — present (1 create, 5 modify, 4 exclusions)
• [x] Feature Flag — present (none — developer tooling)
• [x] Acceptance Criteria — present (7 criteria)
• [x] Test Expectations — present (4 expectations + run command)
• [x] Constraints — present (3 constraints)
• [x] Checklist — present (4 items)
• [x] Related — present

Traceability

• [x] story:project-setup label — verified in project-iss user-stories table (key: project-setup, backing: README + docs/architecture.md + docs/adoption-plan.md, role: Developer)
• [x] arch:infra label — acceptable: catch-all label per convention-architecture-ids ("General infrastructure"). No dedicated arch note expected for catch-all labels.
• [x] Forgejo issue — #80, state: open, repo: ldraney/intelligentstaffingsystems
• [x] decomp:1868 label — parent item #1868 (issue #77) exists on board-iss in todo column, labeled decomposed

File Targets

• [x] Makefile — verified: does not exist yet (to create). Targets: dev, test, lint, security, ci, console, migrate, setup, down.
• [x] docker-compose.yml — verified: exists (696 bytes). Currently runs web on port 9999 via harbor.tail5b443a.ts.net/library/ruby-rails-build:latest image.
• [x] docs/local-dev-setup.md — verified: exists (4.6k). No Makefile references yet.
• [x] docs/architecture.md — verified: exists (15k). To document overlay directories and deployment topology.
• [x] docs/pipeline.md — verified: exists (8.2k). To reference Makefile targets in local dev section.
• [x] config/environments/production.rb — verified: exists. Current config.hosts has intelligentstaffingsystems.ai and iss.tail5b443a.ts.net. dev.intelligentstaffingsystems.ai not yet present (conditional per AC #7).

Repo Placement

Dependencies

• #78 (pal-e-deployments overlays, board item #1869) — independent, no dependency. Makefile and docs work can proceed without overlays existing.
• #79 (DNS + Caddy for dev subdomain, board item #1870) — soft dependency for AC #7 (config.hosts conditional). The ticket correctly uses "if the dev overlay routes through production Rails" qualifier.
• #77 (parent, board item #1868) — in todo column, labeled decomposed. All three sub-tickets (#78, #79, #80) are in backlog.
• Constraints section documents out-of-scope Keycloak callback URL awareness (pal-e-services tfvars change). Good cross-repo awareness.

Acceptance Criteria

• AC 1-4: Makefile targets (make dev/test/ci/setup) — verifiable by execution
• AC 5: No host Ruby — verifiable by inspecting Makefile (docker compose run/exec)
• AC 6: docs/local-dev-setup.md updated — verifiable by reading doc
• AC 7: config.hosts conditional — verifiable by reading production.rb

Blast Radius

Decomposition Assessment

Recommendation