Initial project import

core/deploy/docker/1c-agent/1c-agent.env.example

@@ -3,7 +3,11 @@ ONEC_AGENT_CONTAINER_NAME=onec-agent
 ONEC_AGENT_HOST_PORT=8090
 ONEC_AGENT_DEFAULT_BASE_URL=http://docker-gpu.cin.su:8000
 ONEC_AGENT_DEFAULT_MODEL=qwen3-4b-instruct-2507
-ONEC_ADAPTER_URL=http://docker-gpu.cin.su:8011
+ONEC_MCP_URL=http://docker.cin.su:8021
+
+# Keep false for ordinary coding agents; diagnostic storage routes stay in the
+# developer adapter/MCP surface.
+ONEC_AGENT_ALLOW_DIAGNOSTIC=false
 
 # Для интеграции с несколькими ИИ провайдерскими конечными точками
 # Формат JSON:

core/deploy/docker/1c-agent/compose.yaml

@@ -18,8 +18,8 @@ services:
       ONEC_AGENT_DB_PATH: /app/data/onec-agent.db
       ONEC_AGENT_DEFAULT_BASE_URL: ${ONEC_AGENT_DEFAULT_BASE_URL:-http://docker-gpu.cin.su:8000}
       ONEC_AGENT_DEFAULT_MODEL: ${ONEC_AGENT_DEFAULT_MODEL:-qwen3-4b-instruct-2507}
-      ONEC_ADAPTER_URL: ${ONEC_ADAPTER_URL:-http://docker-gpu.cin.su:8011}
-      ONEC_ADAPTER_TOKEN: ${ONEC_ADAPTER_TOKEN:-}
+      ONEC_MCP_URL: ${ONEC_MCP_URL:-http://docker.cin.su:8021}
+      ONEC_AGENT_ALLOW_DIAGNOSTIC: ${ONEC_AGENT_ALLOW_DIAGNOSTIC:-false}
       ONEC_AGENT_PROVIDERS: ${ONEC_AGENT_PROVIDERS:-}
 
 volumes:

core/deploy/docker/adapter-1c-mcp/.env.example

@@ -4,8 +4,12 @@ ADAPTER_1C_MCP_HOST_PORT=8021
 
 # REST 1C adapter endpoint. The MCP proxy forwards onec_request(method,payload)
 # to this service. Change it when the real adapter container is deployed.
-ONEC_ADAPTER_URL=http://docker-gpu.cin.su:8011
+ONEC_ADAPTER_URL=http://docker.cin.su:8011
 ONEC_ADAPTER_TIMEOUT_SECONDS=120
 
+# Keep false for ordinary coding agents. Enable only in a developer-only MCP
+# deployment that is allowed to expose storage diagnostics.
+ONEC_MCP_ALLOW_DIAGNOSTIC=false
+
 # Optional bearer token for the REST adapter. Do not commit real secrets.
 ONEC_ADAPTER_TOKEN=

core/deploy/docker/adapter-1c-mcp/compose.yaml

@@ -12,6 +12,29 @@ services:
       - "${ADAPTER_1C_MCP_HOST_PORT:-8021}:8021"
     environment:
       PORT: "8021"
-      ONEC_ADAPTER_URL: ${ONEC_ADAPTER_URL:-http://docker-gpu.cin.su:8011}
+      ONEC_ADAPTER_URL: ${ONEC_ADAPTER_URL:-http://docker.cin.su:8011}
       ONEC_ADAPTER_TOKEN: ${ONEC_ADAPTER_TOKEN:-}
       ONEC_ADAPTER_TIMEOUT_SECONDS: ${ONEC_ADAPTER_TIMEOUT_SECONDS:-240}
+      ONEC_MCP_ALLOW_DIAGNOSTIC: ${ONEC_MCP_ALLOW_DIAGNOSTIC:-false}
+      ONEC_MCP_DEBUG_DIAGNOSTICS: ${ONEC_MCP_DEBUG_DIAGNOSTICS:-false}
+    volumes:
+      - adapter-1c-mcp-data:/data
+
+  adapter-1c-mcp-audit:
+    image: ${ADAPTER_1C_MCP_IMAGE:-adapter-1c-mcp:latest}
+    container_name: ${ADAPTER_1C_MCP_AUDIT_CONTAINER_NAME:-adapter-1c-mcp-audit}
+    restart: unless-stopped
+    depends_on:
+      - adapter-1c-mcp
+    volumes:
+      - adapter-1c-mcp-data:/data
+    environment:
+      ONEC_MCP_AUDIT_INTERVAL_SECONDS: ${ONEC_MCP_AUDIT_INTERVAL_SECONDS:-900}
+    command: >-
+      sh -c 'mkdir -p /data/adapter-audit-reports;
+      while true; do python /app/analyze_audit.py > /data/adapter-audit-reports/latest.json.tmp
+      && mv /data/adapter-audit-reports/latest.json.tmp /data/adapter-audit-reports/latest.json;
+      sleep "$${ONEC_MCP_AUDIT_INTERVAL_SECONDS}"; done'
+
+volumes:
+  adapter-1c-mcp-data:

core/deploy/docker/adapter-1c/.env.example

@@ -0,0 +1,20 @@
+ADAPTER_1C_IMAGE=adapter-1c-rest:latest
+ADAPTER_1C_CONTAINER_NAME=adapter-1c-rest
+
+# Public REST port on docker.cin.su. Change it if 8011 is occupied, then use
+# the same value in ONEC_ADAPTER_URL for MCP and the 1C agent.
+ADAPTER_1C_HOST_PORT=8011
+
+# Live SQL connections. Keep real credentials outside git.
+# Example:
+# ONEC_SQL_BASES_JSON={"upo_test":{"server":"sql-host","database":"upo_test","user":"configured_login","password_env":"ONEC_SQL_PASSWORD_UPO_TEST"}}
+# ONEC_SQL_PASSWORD_UPO_TEST=put-this-only-in-a-real-non-committed-env-file
+ONEC_SQL_BASES_JSON=
+# Optional path inside the container to a JSON file with the same shape as ONEC_SQL_BASES_JSON.
+ONEC_SQL_BASES_JSON_FILE=/data/onec-sql-bases.json
+
+# Adapter-owned local SQLite state. Never point this at the 1C database.
+ONEC_ADAPTER_STATE_DB=/data/adapter-cache.sqlite
+ONEC_ADAPTER_JOB_PROCESS_ISOLATION=true
+ONEC_ADAPTER_JOB_MEMORY_LIMIT_MB=0
+ONEC_ADAPTER_JOB_CPU_LIMIT_SECONDS=0

core/deploy/docker/adapter-1c/compose.yaml

@@ -0,0 +1,63 @@
+name: adapter-1c
+
+services:
+  adapter-1c-rest:
+    build:
+      context: ../../../../plugins/1c
+      dockerfile: connector/Dockerfile
+    image: ${ADAPTER_1C_IMAGE:-adapter-1c-rest:latest}
+    container_name: ${ADAPTER_1C_CONTAINER_NAME:-adapter-1c-rest}
+    restart: unless-stopped
+    stop_grace_period: 5m
+    ports:
+      - "${ADAPTER_1C_HOST_PORT:-8011}:8011"
+    volumes:
+      - adapter-1c-data:/data
+    environment:
+      ONEC_ADAPTER_HOST: 0.0.0.0
+      ONEC_ADAPTER_PORT: 8011
+      ONEC_ADAPTER_SERVICE_TOKEN: ${ONEC_ADAPTER_SERVICE_TOKEN:-}
+      ONEC_ADAPTER_ALLOW_UNAUTHENTICATED_ADMIN: ${ONEC_ADAPTER_ALLOW_UNAUTHENTICATED_ADMIN:-true}
+      ONEC_SQL_BASES_JSON: ${ONEC_SQL_BASES_JSON:-}
+      ONEC_SQL_BASES_JSON_FILE: ${ONEC_SQL_BASES_JSON_FILE:-/data/onec-sql-bases.json}
+      ONEC_ADAPTER_CACHE_DB: ${ONEC_ADAPTER_CACHE_DB:-/data/adapter-cache.sqlite}
+      ONEC_ADAPTER_STATE_DB: ${ONEC_ADAPTER_STATE_DB:-/data/adapter-cache.sqlite}
+      ONEC_ADAPTER_JOB_STORE: ${ONEC_ADAPTER_JOB_STORE:-/data/adapter-jobs.json}
+      ONEC_REPOSITORY_STATE_FILE: ${ONEC_REPOSITORY_STATE_FILE:-/data/onec-repository-locks.json}
+      ONEC_ADAPTER_BACKUP_DIR: ${ONEC_ADAPTER_BACKUP_DIR:-/data/adapter-apply-backups}
+      ONEC_CONFIGURATION_ACTIVATION_STATE_FILE: ${ONEC_CONFIGURATION_ACTIVATION_STATE_FILE:-/data/onec-configuration-activation-requests.json}
+      ONEC_CONFIGURATION_ACTIVATION_REQUEST_TTL_SECONDS: ${ONEC_CONFIGURATION_ACTIVATION_REQUEST_TTL_SECONDS:-1800}
+      ONEC_ADAPTER_JOB_TIMEOUT_SECONDS: ${ONEC_ADAPTER_JOB_TIMEOUT_SECONDS:-240}
+      ONEC_ADAPTER_FULL_TIMEOUT_SECONDS: ${ONEC_ADAPTER_FULL_TIMEOUT_SECONDS:-600}
+      ONEC_ADAPTER_SECTION_TIMEOUT_SECONDS: ${ONEC_ADAPTER_SECTION_TIMEOUT_SECONDS:-180}
+      ONEC_ADAPTER_JOB_PROCESS_ISOLATION: ${ONEC_ADAPTER_JOB_PROCESS_ISOLATION:-true}
+      ONEC_ADAPTER_JOB_MEMORY_LIMIT_MB: ${ONEC_ADAPTER_JOB_MEMORY_LIMIT_MB:-0}
+      ONEC_ADAPTER_JOB_CPU_LIMIT_SECONDS: ${ONEC_ADAPTER_JOB_CPU_LIMIT_SECONDS:-0}
+      ONEC_ADAPTER_DEBUG_DIAGNOSTICS: ${ONEC_ADAPTER_DEBUG_DIAGNOSTICS:-false}
+      ONEC_INFOBASE_USER_ADMIN_BASES_JSON: ${ONEC_INFOBASE_USER_ADMIN_BASES_JSON:-}
+      ONEC_INFOBASE_USER_ADMIN_BASES_JSON_FILE: ${ONEC_INFOBASE_USER_ADMIN_BASES_JSON_FILE:-/data/onec-infobase-user-admin.json}
+      ONEC_INFOBASE_USER_ADMIN_TOKEN_UPO_TEST: ${ONEC_INFOBASE_USER_ADMIN_TOKEN_UPO_TEST:-}
+      ONEC_INFOBASE_USER_ADMIN_ALLOW_UNAUTHENTICATED: ${ONEC_INFOBASE_USER_ADMIN_ALLOW_UNAUTHENTICATED:-false}
+      ONEC_REPOSITORY_RUNNER_TOKEN: ${ONEC_REPOSITORY_RUNNER_TOKEN:-}
+      ONEC_ADAPTER_ENABLE_EXTERNAL_1C: ${ONEC_ADAPTER_ENABLE_EXTERNAL_1C:-false}
+      ONEC_REPOSITORY_REQUEST_TTL_SECONDS: ${ONEC_REPOSITORY_REQUEST_TTL_SECONDS:-86400}
+      ONEC_REPOSITORY_CONFIRMATION_TTL_SECONDS: ${ONEC_REPOSITORY_CONFIRMATION_TTL_SECONDS:-7200}
+
+  adapter-1c-audit:
+    image: ${ADAPTER_1C_IMAGE:-adapter-1c-rest:latest}
+    container_name: ${ADAPTER_1C_AUDIT_CONTAINER_NAME:-adapter-1c-audit}
+    restart: unless-stopped
+    depends_on:
+      - adapter-1c-rest
+    volumes:
+      - adapter-1c-data:/data
+    environment:
+      ONEC_ADAPTER_AUDIT_INTERVAL_SECONDS: ${ONEC_ADAPTER_AUDIT_INTERVAL_SECONDS:-900}
+    command: >-
+      sh -c 'mkdir -p /data/adapter-audit-reports;
+      while true; do python /app/analyze_audit.py --log /data/adapter-audit.jsonl > /data/adapter-audit-reports/latest.json.tmp
+      && mv /data/adapter-audit-reports/latest.json.tmp /data/adapter-audit-reports/latest.json;
+      sleep "$${ONEC_ADAPTER_AUDIT_INTERVAL_SECONDS}"; done'
+
+volumes:
+  adapter-1c-data:

core/deploy/docker/adapter-observer/.env.example

@@ -0,0 +1,12 @@
+ADAPTER_OBSERVER_IMAGE=adapter-observer:latest
+ADAPTER_OBSERVER_CONTAINER_NAME=adapter-observer
+ADAPTER_OBSERVER_HOST_PORT=8031
+# Only needed for a copied deployment package; repository deployment uses default.
+# ADAPTER_OBSERVER_BUILD_CONTEXT=./observer
+# Existing adapter volume: mount is read-only in this service.
+ADAPTER_OBSERVER_AUDIT_VOLUME=adapter-1c_adapter-1c-data
+ADAPTER_OBSERVER_MCP_AUDIT_VOLUME=adapter-1c-mcp_adapter-1c-mcp-data
+ADAPTER_OBSERVER_ADAPTER_NETWORK=adapter-1c_default
+ONEC_OBSERVER_ADAPTER_URL=http://adapter-1c-rest:8011
+ONEC_OBSERVER_COVERAGE_BASE_ID=upo_test
+ONEC_OBSERVER_COVERAGE_INTERVAL_SECONDS=900

core/deploy/docker/adapter-observer/compose.yaml

@@ -0,0 +1,42 @@
+name: adapter-observer
+
+services:
+  adapter-observer:
+    build:
+      context: ${ADAPTER_OBSERVER_BUILD_CONTEXT:-../../../../plugins/1c/observer}
+      dockerfile: Dockerfile
+    image: ${ADAPTER_OBSERVER_IMAGE:-adapter-observer:latest}
+    container_name: ${ADAPTER_OBSERVER_CONTAINER_NAME:-adapter-observer}
+    restart: unless-stopped
+    ports:
+      - "${ADAPTER_OBSERVER_HOST_PORT:-8031}:8031"
+    volumes:
+      - adapter-1c-data:/audit:ro
+      - adapter-1c-mcp-data:/mcp-audit:ro
+      - adapter-observer-state:/state
+    environment:
+      ONEC_OBSERVER_HOST: 0.0.0.0
+      ONEC_OBSERVER_PORT: 8031
+      ONEC_OBSERVER_AUDIT_DIR: /audit
+      ONEC_OBSERVER_MCP_AUDIT_DIR: /mcp-audit
+      ONEC_OBSERVER_STATE_DIR: /state
+      ONEC_OBSERVER_ADAPTER_URL: ${ONEC_OBSERVER_ADAPTER_URL:-http://adapter-1c-rest:8011}
+      ONEC_OBSERVER_COVERAGE_BASE_ID: ${ONEC_OBSERVER_COVERAGE_BASE_ID:-upo_test}
+      ONEC_OBSERVER_COVERAGE_INTERVAL_SECONDS: ${ONEC_OBSERVER_COVERAGE_INTERVAL_SECONDS:-900}
+    networks:
+      - default
+      - adapter-1c
+
+volumes:
+  adapter-1c-data:
+    external: true
+    name: ${ADAPTER_OBSERVER_AUDIT_VOLUME:-adapter-1c_adapter-1c-data}
+  adapter-1c-mcp-data:
+    external: true
+    name: ${ADAPTER_OBSERVER_MCP_AUDIT_VOLUME:-adapter-1c-mcp_adapter-1c-mcp-data}
+  adapter-observer-state:
+
+networks:
+  adapter-1c:
+    external: true
+    name: ${ADAPTER_OBSERVER_ADAPTER_NETWORK:-adapter-1c_default}