name: assistant
services:
  postgres:
    build:
      context: ..
      dockerfile: deploy/images/postgres.Dockerfile
      args: { SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" }
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-assistant}
      POSTGRES_USER: ${POSTGRES_SUPERUSER}
      POSTGRES_PASSWORD: ${POSTGRES_SUPERUSER_PASSWORD}
      CONTINUITY_DB_PASSWORD: ${CONTINUITY_DB_PASSWORD}
      IDENTITY_DB_PASSWORD: ${IDENTITY_DB_PASSWORD}
      AUTHORITY_DB_PASSWORD: ${AUTHORITY_DB_PASSWORD}
      SITUATION_DB_PASSWORD: ${SITUATION_DB_PASSWORD}
      WORK_DB_PASSWORD: ${WORK_DB_PASSWORD}
      CAPABILITY_DB_PASSWORD: ${CAPABILITY_DB_PASSWORD}
      COMMIT_DB_PASSWORD: ${COMMIT_DB_PASSWORD}
      EPISTEMICS_DB_PASSWORD_FILE: /run/secrets/epistemics_db_password
      INTERACTION_DB_PASSWORD_FILE: /run/secrets/interaction_db_password
    volumes:
      - assistant_pg:/var/lib/postgresql
      - assistant_core_secrets:/run/secrets:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_SUPERUSER} -d ${POSTGRES_DB:-assistant}"]
      interval: 10s
      timeout: 5s
      retries: 20

  nats:
    image: nats:2-alpine
    restart: unless-stopped
    command: ["-js", "-m", "8222"]
    volumes: ["assistant_nats:/data"]

  notification-receiver:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: notification-receiver, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8085"
      RECEIPT_DIRECTORY: /var/lib/notification-receiver
      RECEIVER_WRITE_TOKEN_FILE: /run/notification-writer/token
      RECEIVER_READ_TOKEN_FILE: /run/notification-reader/token
    ports: ["${NOTIFICATION_RECEIVER_PORT:-18081}:8085"]
    volumes:
      - assistant_notification_receipts:/var/lib/notification-receiver
      - assistant_notification_writer_secret:/run/notification-writer:ro
      - assistant_notification_reader_secret:/run/notification-reader:ro
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8085/healthz >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 10

  core-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: core-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8080"
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      POSTGRES_USER: situation_role
      POSTGRES_PASSWORD: ${SITUATION_DB_PASSWORD}
      IDENTITY_POSTGRES_USER: identity_role
      IDENTITY_POSTGRES_PASSWORD: ${IDENTITY_DB_PASSWORD}
      CREATOR_USERNAME: ${CREATOR_USERNAME}
      WORK_POSTGRES_USER: work_role
      WORK_POSTGRES_PASSWORD: ${WORK_DB_PASSWORD}
      CAPABILITY_POSTGRES_USER: capability_role
      CAPABILITY_POSTGRES_PASSWORD: ${CAPABILITY_DB_PASSWORD}
      EPISTEMICS_POSTGRES_USER: epistemics_role
      EPISTEMICS_POSTGRES_CREDENTIAL_REF: credential://domovoy/epistemics/db-password/v1
      INTERACTION_POSTGRES_USER: interaction_role
      INTERACTION_POSTGRES_CREDENTIAL_REF: credential://domovoy/interaction/db-password/v1
      SECRET_BACKEND_ROOT: /run/secrets
      COGNITIVE_ADMISSION_POLICY_ID: creator-advisory-local-v1
      COGNITIVE_ADMISSION_MAX_CONCURRENT: ${COGNITIVE_ADMISSION_MAX_CONCURRENT:-1}
      COGNITIVE_ADMISSION_MAX_ACCEPTED_PER_HOUR: ${COGNITIVE_ADMISSION_MAX_ACCEPTED_PER_HOUR:-60}
      COGNITIVE_ADMISSION_MAX_INPUT_BYTES: ${COGNITIVE_ADMISSION_MAX_INPUT_BYTES:-81920}
      COGNITIVE_ADMISSION_MAX_OUTPUT_BYTES: ${COGNITIVE_ADMISSION_MAX_OUTPUT_BYTES:-16384}
    depends_on: { postgres: { condition: service_healthy } }
    volumes:
      - assistant_core_secrets:/run/secrets:ro
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null && wget -qO- http://localhost:8080/readyz >/dev/null"]
      interval: 10s
      timeout: 20s
      retries: 20

  core-runtime-candidate:
    profiles: ["assistant-canary"]
    extends:
      service: core-runtime
    restart: "no"
    environment:
      RESEARCH_RUNTIME_URL: http://research-runtime-candidate:8087
    depends_on:
      postgres: { condition: service_healthy }
      research-runtime-candidate: { condition: service_started }

  agent-canary:
    profiles: ["agent-canary"]
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: agent-canary, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: "no"
    command: ["-enable-canary", "-postgres"]
    environment:
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      WORK_POSTGRES_USER: work_role
      WORK_POSTGRES_CREDENTIAL_REF: credential://domovoy/work/db-password/v1
      WORK_POSTGRES_PASSWORD_FILE: /run/secrets/work_db_password
      SECRET_BACKEND_ROOT: /run/secrets
    depends_on: { postgres: { condition: service_healthy } }
    volumes:
      - assistant_core_secrets:/run/secrets:ro

  agent-worker:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: agent-worker, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    command: ["-worker-id", "agent-worker-production", "-status-addr", ":8090"]
    environment:
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      WORK_POSTGRES_USER: work_role
      WORK_POSTGRES_CREDENTIAL_REF: credential://domovoy/work/db-password/v1
      WORK_POSTGRES_PASSWORD_FILE: /run/secrets/work_db_password
      SECRET_BACKEND_ROOT: /run/secrets
      TASK_VERIFIER_URL: http://task-verifier:8091
      AGENT_EXECUTION_BRIDGE_URL: http://agent-execution-bridge:8092
    depends_on:
      postgres: { condition: service_healthy }
      task-verifier: { condition: service_healthy }
      agent-execution-bridge: { condition: service_healthy }
    volumes:
      - assistant_core_secrets:/run/secrets:ro

  agent-execution-bridge:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: agent-execution-bridge, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: :8092
      COGNITIVE_WORKER_URL: http://cognitive-worker:8083
      WORK_GRAPH_RUNTIME_URL: http://work-graph-runtime:8088
      TASK_VERIFIER_URL: http://task-verifier:8091
    depends_on:
      cognitive-worker: { condition: service_started }
      task-verifier: { condition: service_healthy }
      work-graph-runtime: { condition: service_started }
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8092/healthz >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 10

  task-verifier:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: task-verifier, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: :8091
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8091/healthz >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 10

  work-graph-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: work-graph-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: :8088
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      WORK_POSTGRES_USER: work_role
      WORK_POSTGRES_CREDENTIAL_REF: credential://domovoy/work/db-password/v1
      WORK_POSTGRES_PASSWORD_FILE: /run/secrets/work_db_password
      SECRET_BACKEND_ROOT: /run/secrets
    depends_on: { postgres: { condition: service_healthy } }
    volumes:
      - assistant_core_secrets:/run/secrets:ro

  reflection-worker:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: reflection-worker, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    command: ["-worker-id", "reflection-worker-production"]
    environment:
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      EPISTEMICS_POSTGRES_USER: epistemics_role
      EPISTEMICS_POSTGRES_CREDENTIAL_REF: credential://domovoy/epistemics/db-password/v1
      SECRET_BACKEND_ROOT: /run/secrets
    depends_on: { postgres: { condition: service_healthy } }
    volumes:
      - assistant_core_secrets:/run/secrets:ro

  research-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: research-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: :8087
      RESEARCH_SOURCE_ROOT: /var/lib/research-sources
      RESEARCH_HTTP_ALLOWED_HOSTS: assistant.cin.su,git.cin.su
      RESEARCH_SEARCH_URL_TEMPLATE: ${RESEARCH_SEARCH_URL_TEMPLATE:-https://www.bing.com/search?q=%s}
      RESEARCH_SEARCH_ALLOWED_HOSTS: ${RESEARCH_SEARCH_ALLOWED_HOSTS:-www.bing.com}
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      EPISTEMICS_POSTGRES_USER: epistemics_role
      EPISTEMICS_POSTGRES_CREDENTIAL_REF: credential://domovoy/epistemics/db-password/v1
      SECRET_BACKEND_ROOT: /run/secrets
    depends_on: { postgres: { condition: service_healthy } }
    volumes:
      - assistant_core_secrets:/run/secrets:ro
      - assistant_research_sources:/var/lib/research-sources:ro
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8087/healthz >/dev/null && wget -qO- http://localhost:8087/readyz >/dev/null"]
      interval: 10s
      timeout: 10s
      retries: 20

  research-runtime-candidate:
    profiles: ["assistant-canary"]
    extends:
      service: research-runtime
    restart: "no"
    depends_on:
      postgres: { condition: service_healthy }

  continuity-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: continuity-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8081"
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      POSTGRES_USER: continuity_role
      POSTGRES_PASSWORD: ${CONTINUITY_DB_PASSWORD}
      CORE_RUNTIME_URL: http://core-runtime:8080
      COMMIT_EXECUTOR_TOKEN: ${COMMIT_EXECUTOR_TOKEN}

  commit-runtime:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: commit-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8082"
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
      POSTGRES_USER: commit_role
      POSTGRES_PASSWORD: ${COMMIT_DB_PASSWORD}
      AUTHORITY_POSTGRES_USER: authority_role
      AUTHORITY_POSTGRES_PASSWORD: ${AUTHORITY_DB_PASSWORD}
      CORE_RUNTIME_URL: http://core-runtime:8080
      CONTINUITY_RUNTIME_URL: http://continuity-runtime:8081
      COMMIT_EXECUTOR_TOKEN: ${COMMIT_EXECUTOR_TOKEN}
      NOTIFICATION_WRITE_TOKEN_FILE: /run/notification-writer/token
      NOTIFICATION_WRITE_SECRET_REF: domovoy-notification-write-v1
    # External mutation credentials belong here only via Portainer/Docker secrets/env injection.
    depends_on: [core-runtime, continuity-runtime, notification-receiver]
    volumes:
      - assistant_notification_writer_secret:/run/notification-writer:ro

  cognitive-worker:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: cognitive-worker, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8083"
      CORE_RUNTIME_URL: http://core-runtime:8080
      LOCAL_CPU_PROVIDER_URL: http://docker.cin.su:18082/v1
      LOCAL_CPU_PROVIDER_API_KEY_FILE: ${LOCAL_CPU_PROVIDER_API_KEY_FILE:-}
      LOCAL_CPU_PROVIDER_CREDENTIAL_REF: ${LOCAL_CPU_PROVIDER_CREDENTIAL_REF:-credential://domovoy/local-cpu/provider-api-key/v1}
      # The medium chat route is served by the authenticated local gateway.
      # llm-local-api is the embeddings service and must not be used for chat.
      LOCAL_MEDIUM_PROVIDER_URL: ${LOCAL_MEDIUM_PROVIDER_URL:-http://llm-local-gateway:8080/v1}
      LOCAL_MEDIUM_PROVIDER_API_KEY_FILE: ${LOCAL_MEDIUM_PROVIDER_API_KEY_FILE:-/run/secrets/llm_local_gateway_api_key}
      LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF: ${LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF:-credential://domovoy/local-medium/provider-api-key/v1}
      LOCAL_GPU_PROVIDER_TIMEOUT: ${LOCAL_GPU_PROVIDER_TIMEOUT:-60s}
      LOCAL_LIFEBOAT_PROVIDER_URL: http://cognitive-lifeboat:8086/v1
      LOCAL_IMAGE_PROVIDER_KIND: ${LOCAL_IMAGE_PROVIDER_KIND:-comfyui}
      LOCAL_IMAGE_PROVIDER_URL: ${LOCAL_IMAGE_PROVIDER_URL:-http://comfyui:8188}
      LOCAL_IMAGE_MODEL: ${LOCAL_IMAGE_MODEL:-z_image_turbo_bf16.safetensors}
      COGNITIVE_OWNER_PRINCIPAL_ID: domovoy-creator-principal
      COGNITIVE_ALLOW_CANARY: "true"
    volumes:
      - assistant_core_secrets:/run/secrets:ro
    networks: [default, llm-local]
    depends_on:
      core-runtime: { condition: service_started }
      cognitive-lifeboat: { condition: service_healthy }
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8083/healthz >/dev/null && wget -qO- http://localhost:8083/readyz >/dev/null"]
      interval: 10s
      timeout: 20s
      retries: 20

  cognitive-worker-candidate:
    profiles: ["assistant-canary"]
    extends:
      service: cognitive-worker
    restart: "no"
    environment:
      CORE_RUNTIME_URL: http://core-runtime-candidate:8080
    depends_on:
      core-runtime-candidate: { condition: service_started }
      cognitive-lifeboat: { condition: service_healthy }

  cognitive-lifeboat:
    image: ghcr.io/ggml-org/llama.cpp:server
    restart: unless-stopped
    command:
      - --host
      - 0.0.0.0
      - --port
      - "8086"
      - --model
      - /models/Qwen3.8-27B-UD-Q2_K_XL.gguf
      - --alias
      - domovoy-lifeboat
      - --jinja
      - --ctx-size
      - "8192"
      - --n-gpu-layers
      - "0"
      - --threads
      - "32"
      - --parallel
      - "1"
      - --reasoning
      - "off"
    volumes:
      - llm_local_models:/models:ro
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8086/health >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 10

  supervisor:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: supervisor, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8080"
      SUPERVISOR_CONTROL_ADDR: ":8095"
      SUPERVISOR_STATE_PATH: /var/lib/supervisor/release-state.json
      SUPERVISOR_STABLE_UPSTREAM: http://creator-web:8084
      SUPERVISOR_CANDIDATE_UPSTREAM: http://creator-web-candidate:8084
      SUPERVISOR_BASELINE_RELEASE: ${ASSISTANT_SOURCE_REVISION:-unknown}
    ports:
      - "${CREATOR_WEB_PORT:-18080}:8080"
      - "127.0.0.1:${SUPERVISOR_CONTROL_PORT:-18085}:8095"
    depends_on:
      creator-web: { condition: service_healthy }
    volumes:
      - assistant_supervisor_state:/var/lib/supervisor
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/healthz >/dev/null && wget -qO- http://localhost:8080/readyz >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 20

  creator-web:
    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: creator-web, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
    restart: unless-stopped
    environment:
      LISTEN_ADDR: ":8084"
      CORE_RUNTIME_URL: http://core-runtime:8080
      CONTINUITY_RUNTIME_URL: http://continuity-runtime:8081
      COMMIT_RUNTIME_URL: http://commit-runtime:8082
      COGNITIVE_RUNTIME_URL: http://cognitive-worker:8083
      AGENT_WORKER_URL: http://agent-worker:8090
      ASSISTANT_BUILD_REVISION: ${ASSISTANT_SOURCE_REVISION:-unknown}
    depends_on:
      core-runtime: { condition: service_started }
      continuity-runtime: { condition: service_started }
      commit-runtime: { condition: service_started }
      cognitive-worker: { condition: service_healthy }
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8084/healthz >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 10

  creator-web-candidate:
    profiles: ["assistant-canary"]
    extends:
      service: creator-web
    restart: "no"
    environment:
      CORE_RUNTIME_URL: http://core-runtime-candidate:8080
      CONTINUITY_RUNTIME_URL: http://continuity-runtime:8081
      COMMIT_RUNTIME_URL: http://commit-runtime:8082
      COGNITIVE_RUNTIME_URL: http://cognitive-worker-candidate:8083
      AGENT_WORKER_URL: http://agent-worker:8090
    depends_on:
      core-runtime-candidate: { condition: service_started }
      continuity-runtime: { condition: service_started }
      commit-runtime: { condition: service_started }
      cognitive-worker-candidate: { condition: service_healthy }
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8084/healthz >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 20

volumes:
  assistant_pg:
  assistant_nats:
  assistant_core_secrets:
    external: true
  assistant_notification_receipts:
  assistant_notification_writer_secret:
    external: true
  assistant_notification_reader_secret:
    external: true
  llm_local_models:
    name: llm-local-models
    external: true
  assistant_research_sources:
    name: assistant_research_sources
  assistant_supervisor_state:

networks:
  llm-local:
    external: true
    name: llm-local_default