docker-compose.yml

# #1871: bound every container's json-file log. Docker's json-file driver has
# NO max-size and NO max-file by default, so each container's log under
# /var/lib/docker/containers/ grows forever — silently, until the Docker data
# root hits 100% and dockerd wedges. Agent containers are created through the
# Docker SDK, not compose, so they are capped separately by AGENT_LOG_CONFIG in
# src/backend/services/agent_service/capabilities.py.
x-logging: &default-logging
  driver: json-file
  options:
    max-size: "${CONTAINER_LOG_MAX_SIZE:-10m}"
    max-file: "${CONTAINER_LOG_MAX_FILE:-3}"

services:
  backend:
    build:
      context: .
      dockerfile: docker/backend/Dockerfile
      # Build-time provenance (#926). scripts/deploy/start.sh exports these
      # from the local repo (`git rev-parse HEAD` etc.) before compose builds.
      # Unset = Dockerfile defaults to "unknown" so an out-of-band build still
      # produces a well-typed /api/version response.
      args:
        VERSION: ${VERSION:-unknown}
        GIT_COMMIT: ${GIT_COMMIT:-unknown}
        GIT_COMMIT_SUBJECT: ${GIT_COMMIT_SUBJECT:-unknown}
        GIT_COMMIT_TIMESTAMP: ${GIT_COMMIT_TIMESTAMP:-unknown}
        GIT_BRANCH: ${GIT_BRANCH:-unknown}
        BUILD_DATE: ${BUILD_DATE:-unknown}
    container_name: trinity-backend
    logging: *default-logging
    # #2541: the platform half of the same bug the agent containers had. Both
    # prod and hosted already carried this; the BASE file — the one start.sh
    # uses without --hosted, i.e. the README quickstart and the source install
    # — did not, so a self-hosted Trinity's own control plane did not survive a
    # host reboot either. `unless-stopped`, so an operator `docker compose stop`
    # is still honoured.
    restart: unless-stopped
    ports:
      - "8000:8000"
    environment:
      # SECURITY: Set these in your .env file, not here
      - SECRET_KEY=${SECRET_KEY:-}  # Required - generate with: openssl rand -hex 32
      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-}  # Required - set a strong password
      - ADMIN_USERNAME=${ADMIN_USERNAME:-admin}
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-}
      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}
      # REDIS_URL embeds the `backend` ACL user — see docker-compose redis service.
      - "REDIS_URL=redis://backend:${REDIS_BACKEND_PASSWORD:?REDIS_BACKEND_PASSWORD must be set in .env}@redis:6379"
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
      - GOOGLE_API_KEY=${GOOGLE_API_KEY:-}  # For Gemini-powered agents
      - GEMINI_API_KEY=${GEMINI_API_KEY:-}  # For platform image generation (IMG-001)
      # Gemini model overrides (#1130) — non-empty defaults so an unset var doesn't inject "" (#1076)
      - GEMINI_TEXT_MODEL=${GEMINI_TEXT_MODEL:-gemini-3.5-flash}              # image-gen prompt refinement
      - GEMINI_TRANSCRIPTION_MODEL=${GEMINI_TRANSCRIPTION_MODEL:-gemini-3.5-flash}  # Telegram voice transcription
      - VOICE_MODEL=${VOICE_MODEL:-models/gemini-3.1-flash-live-preview}  # Gemini Live model override (#1076: non-empty default so an unset var doesn't inject "")
      - VOICE_ENABLED=${VOICE_ENABLED:-true}  # Voice mode (default on when GEMINI_API_KEY set)
      - WORKSPACE_VOICE_MAX_DURATION=${WORKSPACE_VOICE_MAX_DURATION:-1800}  # Workspace voice call cap, seconds (ent#534)
      # Brain Orb (#58 static render / scope) + voice tile (#60, needs GEMINI_API_KEY).
      # Both default OFF; must reach the container or the flags stay false (config.py).
      - BRAIN_ORB_ENABLED=${BRAIN_ORB_ENABLED:-false}
      - BRAIN_ORB_VOICE_ENABLED=${BRAIN_ORB_VOICE_ENABLED:-false}
      # KB-write surface (#61 Phase 4a) — owner-gated capture/link. Distinct kill-switch
      # so writes disable without downing read/voice. Default OFF (config.py).
      - BRAIN_ORB_WRITE_ENABLED=${BRAIN_ORB_WRITE_ENABLED:-false}
      # VoIP telephony (VOIP-001, #1056) — opt-in, default OFF. Master switch must
      # reach the container or voip_available stays false (read by config.py).
      - VOIP_ENABLED=${VOIP_ENABLED:-false}
      - VOIP_MAX_CALL_DURATION=${VOIP_MAX_CALL_DURATION:-600}      # per-call cap (s)
      - VOIP_DEFAULT_DAILY_CALL_CAP=${VOIP_DEFAULT_DAILY_CALL_CAP:-50}  # per-agent/day spend bound
      - VOIP_CALL_RATE_LIMIT=${VOIP_CALL_RATE_LIMIT:-5}           # calls per owner+destination window
      - VOIP_CALL_RATE_WINDOW=${VOIP_CALL_RATE_WINDOW:-60}        # rate-limit window (s)
      - VOIP_TICKET_TTL_SECONDS=${VOIP_TICKET_TTL_SECONDS:-180}   # Media Streams WSS ticket TTL
      - VOIP_INTENT_TTL_SECONDS=${VOIP_INTENT_TTL_SECONDS:-180}   # staged Gemini-intent TTL
      # Outbound A2A calls (#736) — a Trinity agent tasking an EXTERNAL A2A agent.
      # Opt-in, default OFF. The DB row (system_settings) is the primary leg, so a
      # gap here cannot make the feature unreachable — but the env leg still has to
      # be forwarded or an operator setting it in .env silently does nothing.
      - A2A_OUTBOUND_ENABLED=${A2A_OUTBOUND_ENABLED:-false}
      # AAuth prototype (trinity-enterprise#623 / #878 / #879). Default OFF and
      # fail-closed: system_settings wins, but the env leg must be forwarded or
      # the .env levers silently do nothing (#1056 class).
      # ent#862: the graduated agent identity (Flows 1-4). Empty default, so an
      # unset variable reads as unset and the Settings switch stays authoritative.
      - AAUTH_ENABLED=${AAUTH_ENABLED:-}
      - AAUTH_PROTOTYPE_ENABLED=${AAUTH_PROTOTYPE_ENABLED:-false}
      - AAUTH_ISSUER=${AAUTH_ISSUER:-}
      - AAUTH_PERSON_SERVER=${AAUTH_PERSON_SERVER:-}
      - AAUTH_RESOURCE_ALLOWLIST=${AAUTH_RESOURCE_ALLOWLIST:-}
      # Nevermined x402 facilitator concurrency (ent#679). The bound is enforced at
      # these defaults whether or not they are wired, so a gap here is an inert
      # tuning lever rather than a dead feature — but this service uses an explicit
      # environment list, so forward them or the .env knobs do nothing (#1056 class).
      - NEVERMINED_MAX_INFLIGHT=${NEVERMINED_MAX_INFLIGHT:-8}  # concurrent verify/settle calls, fleet-wide
      - NEVERMINED_FACILITATOR_WAIT_SECONDS=${NEVERMINED_FACILITATOR_WAIT_SECONDS:-5.0}  # wait for a slot before "busy, retry"
      # Outbound voice replies via shared TTS (epic #24; Telegram #25). The key
      # gates the feature (empty ⇒ adapters deliver text). Must reach the
      # container or the .env lever is inert (the #1056/#1039 packaging class).
      - ELEVENLABS_API_KEY=${ELEVENLABS_API_KEY:-}
      - ELEVENLABS_MODEL_ID=${ELEVENLABS_MODEL_ID:-eleven_multilingual_v2}  # non-empty default (#1076)
      - TTS_MAX_CHARS=${TTS_MAX_CHARS:-1500}                      # shared synth cost cap (chars)
      # Workspace / client portal (ent#356), now OSS core. Rate limits are enforced
      # at these defaults whether or not they are wired, so the gap is an inert
      # tuning lever rather than a dead feature — but inert is still the
      # #1056/#1039 packaging class, so wire them where the .env lever can reach.
      - PORTAL_CHAT_BURST_LIMIT=${PORTAL_CHAT_BURST_LIMIT:-20}     # portal chat sends per email+agent per 60s
      - PORTAL_CHAT_HOURLY_LIMIT=${PORTAL_CHAT_HOURLY_LIMIT:-300}  # ... per 3600s
      - PORTAL_UPLOAD_BURST_LIMIT=${PORTAL_UPLOAD_BURST_LIMIT:-20} # portal uploads per email per 60s
      - PORTAL_UPLOAD_HOURLY_LIMIT=${PORTAL_UPLOAD_HOURLY_LIMIT:-100}  # ... per 3600s
      - PORTAL_FILE_BURST_LIMIT=${PORTAL_FILE_BURST_LIMIT:-20}     # portal file downloads per email per 60s
      - PORTAL_FILE_HOURLY_LIMIT=${PORTAL_FILE_HOURLY_LIMIT:-100}  # ... per 3600s — the tier that actually bounds it
      - PORTAL_FILE_DELETE_BURST_LIMIT=${PORTAL_FILE_DELETE_BURST_LIMIT:-60}  # deletes per email per 60s
      - PORTAL_TITLE_MODEL=${PORTAL_TITLE_MODEL:-claude-haiku-4-5-20251001}  # thread-title model
      - PORTAL_TITLE_TIMEOUT_SECONDS=${PORTAL_TITLE_TIMEOUT_SECONDS:-15}
      # Agent structured reports (#918) — per-agent create-rate cap (60s window fixed in code).
      # Must reach the container or the .env lever is inert in prod (the #1039 packaging class).
      - REPORT_RATE_LIMIT=${REPORT_RATE_LIMIT:-30}               # reports per agent per 60s
      # trinity-enterprise#478 — metric write path. The two policy values are a
      # bootstrap fallback; a Settings row wins over them.
      # The three ENV-BACKED ops keys below (METRICS_RETENTION_DAYS,
      # METRICS_DAILY_POINT_CAP, INTER_AGENT_MAX_CHAIN_DEPTH) are forwarded with
      # an EMPTY default (ent#671): an unset variable must reach the container
      # unset, or GET /api/settings/retention reports `source: env` for a value
      # nobody chose and the Settings rows lock read-only. The code default is
      # the fallback. Pinned by tests/unit/test_ent671_env_backed_ops_forwarding.py.
      - METRICS_RATE_LIMIT=${METRICS_RATE_LIMIT:-60}             # record_metrics calls per agent per 60s
      - METRICS_RETENTION_DAYS=${METRICS_RETENTION_DAYS:-}    # recorded point retention (0 = forever)
      - METRICS_DAILY_POINT_CAP=${METRICS_DAILY_POINT_CAP:-}  # points per agent per UTC day (0 = unlimited)
      - INTER_AGENT_MAX_CHAIN_DEPTH=${INTER_AGENT_MAX_CHAIN_DEPTH:-}  # max agent-to-agent hops per call chain (#2806)
      - METRICS_READ_RATE_LIMIT=${METRICS_READ_RATE_LIMIT:-240}   # GET /metrics reads per agent per 60s (tiles, dashboard binds, get_metrics)
      - OBJECTIVES_READ_RATE_LIMIT=${OBJECTIVES_READ_RATE_LIMIT:-60}  # GET /objectives reads per agent per 60s (fans out into the agent container)
      # Agent canvases (ent#438/ent#553) — per-agent ceiling on the canvas pile.
      # The refusal names this number, so it must reach the container or the
      # operator is told to raise a lever that is inert (the #1039 class).
      - CANVAS_MAX_PER_AGENT=${CANVAS_MAX_PER_AGENT:-100}        # canvases per agent
      # Skills library lifecycle automation (ent#236). The reconcile cap is named in the
      # refusal alarm's own remediation text, so it must be tunable from .env or the
      # operator is told to raise a lever that never reaches the container.
      - SKILLS_RECONCILE_MAX_REMOVALS=${SKILLS_RECONCILE_MAX_REMOVALS:-10}   # per-agent blast-radius cap
      - SKILLS_FLEET_INJECT_CONCURRENCY=${SKILLS_FLEET_INJECT_CONCURRENCY:-5}  # parallel agents per sweep
      # Public webhook trigger hardening (#1023, #1424) — 60s windows fixed in code.
      # Must reach the container or the .env lever is inert (the #1056/#1039 packaging class).
      - WEBHOOK_RATE_LIMIT=${WEBHOOK_RATE_LIMIT:-10}             # triggers per token per 60s
      - WEBHOOK_IP_RATE_LIMIT=${WEBHOOK_IP_RATE_LIMIT:-60}       # pre-auth requests per IP per 60s
      - WEBHOOK_MAX_BODY_BYTES=${WEBHOOK_MAX_BODY_BYTES:-16384}  # request-body cap (413 over)
      # Agent self-reminders (#1296) — tunable caps (working code defaults).
      # Must reach the container or the .env lever is inert (the #1056/#1039 packaging class).
      - REMINDER_MESSAGE_MAX_CHARS=${REMINDER_MESSAGE_MAX_CHARS:-4000}          # max reminder message length
      - REMINDER_MIN_DELAY_SECONDS=${REMINDER_MIN_DELAY_SECONDS:-60}            # earliest fire (floor)
      - REMINDER_MAX_DELAY_SECONDS=${REMINDER_MAX_DELAY_SECONDS:-2592000}       # latest fire (30d ceiling)
      - MAX_PENDING_REMINDERS_PER_AGENT=${MAX_PENDING_REMINDERS_PER_AGENT:-25}  # concurrent pending per agent
      - MAX_REMINDERS_PER_AGENT_PER_DAY=${MAX_REMINDERS_PER_AGENT_PER_DAY:-100} # rolling 24h creation cap
      - REMINDER_RATE_LIMIT=${REMINDER_RATE_LIMIT:-30}                          # set_reminder calls per agent per 60s
      # Operator-queue agent ingestion caps (#1632) — bound a compromised/runaway
      # agent flooding the queue. Must reach the container or the .env lever is
      # inert (the #1039 packaging class).
      - OPERATOR_QUEUE_MAX_PENDING_PER_AGENT=${OPERATOR_QUEUE_MAX_PENDING_PER_AGENT:-25}       # per-agent pending-DEPTH cap (primary)
      - OPERATOR_QUEUE_CREATE_RATE_LIMIT=${OPERATOR_QUEUE_CREATE_RATE_LIMIT:-60}               # per-agent creates / window
      - OPERATOR_QUEUE_CREATE_RATE_WINDOW=${OPERATOR_QUEUE_CREATE_RATE_WINDOW:-60}             # rate-limit window (s)
      - OPERATOR_QUEUE_FLEET_CREATE_RATE_LIMIT=${OPERATOR_QUEUE_FLEET_CREATE_RATE_LIMIT:-300}  # fleet-wide creates / window
      - OPERATOR_QUEUE_MAX_SCAN_PER_CYCLE=${OPERATOR_QUEUE_MAX_SCAN_PER_CYCLE:-500}            # requests scanned / agent / cycle
      - OPERATOR_QUEUE_MAX_FILE_BYTES=${OPERATOR_QUEUE_MAX_FILE_BYTES:-2097152}                # skip a queue file over this (bytes)
      - OPERATOR_QUEUE_TITLE_MAX=${OPERATOR_QUEUE_TITLE_MAX:-300}                              # title char cap (truncate)
      - OPERATOR_QUEUE_QUESTION_MAX=${OPERATOR_QUEUE_QUESTION_MAX:-4000}                       # question char cap (truncate)
      - OPERATOR_QUEUE_CONTEXT_MAX_BYTES=${OPERATOR_QUEUE_CONTEXT_MAX_BYTES:-8192}             # context byte cap (marker over)
      - OPERATOR_QUEUE_OPTIONS_MAX_BYTES=${OPERATOR_QUEUE_OPTIONS_MAX_BYTES:-4096}             # options byte cap (dropped over)
      - OPERATOR_QUEUE_MAX_OPTIONS=${OPERATOR_QUEUE_MAX_OPTIONS:-5}             # #3243 options per agent ask
      - OPERATOR_QUEUE_OPTION_MAX_CHARS=${OPERATOR_QUEUE_OPTION_MAX_CHARS:-60}   # #3243 chars per option
      - OPERATOR_QUEUE_ASK_TITLE_MAX_CHARS=${OPERATOR_QUEUE_ASK_TITLE_MAX_CHARS:-120}  # #3243 agent ask title
      - OPERATOR_QUEUE_PROPOSAL_MAX_BYTES=${OPERATOR_QUEUE_PROPOSAL_MAX_BYTES:-8192}           # proposal byte cap (native asks; 422 over)
      - OPERATOR_QUEUE_ID_MAX=${OPERATOR_QUEUE_ID_MAX:-256}                                    # max agent-supplied id length
      - OPERATOR_QUEUE_EXECUTION_ID_MAX=${OPERATOR_QUEUE_EXECUTION_ID_MAX:-128}                # max execution_id kept in a marker
      - OPERATOR_QUEUE_EMAIL_MAX=${OPERATOR_QUEUE_EMAIL_MAX:-320}                               # ent#364: addressee email length clamp (RFC 5321)
      - OPERATOR_QUEUE_FLOOD_ALERT_COOLDOWN_SECONDS=${OPERATOR_QUEUE_FLOOD_ALERT_COOLDOWN_SECONDS:-300}  # one flood alert / agent / window
      - OPERATOR_ALERT_MAX_PENDING_PER_TYPE=${OPERATOR_ALERT_MAX_PENDING_PER_TYPE:-5}     # per-(agent,type) platform-alert budget (#1677)
      - OPERATOR_PLATFORM_ALERT_LIFETIME_DAYS=${OPERATOR_PLATFORM_ALERT_LIFETIME_DAYS:-14}   # #3246: platform alert expires N days after its last reading
      - OPERATOR_PLATFORM_ALERT_SNOOZE_DAYS=${OPERATOR_PLATFORM_ALERT_SNOOZE_DAYS:-7}        # #3246: a person's ending holds N days unless priority rises
      - GITHUB_PAT=${GITHUB_PAT:-}
      - HOST_TEMPLATES_PATH=${PWD}/config/agent-templates
      # First-run default system seed (trinity-enterprise#124): a path to an
      # operator manifest, or `disabled` to skip seeding. Empty = bundled
      # config/manifests/default-system.yaml.
      - TRINITY_DEFAULT_SYSTEM_MANIFEST=${TRINITY_DEFAULT_SYSTEM_MANIFEST:-}
      # ent#237 — the community skills catalog seed. BARE pass-through, NOT
      # `${VAR:-}`: an empty value is the DOCUMENTED disable for this setting
      # ("Set the URL to \"\" to disable the seed entirely"), so `${VAR:-}` would
      # send "" on every install and silently turn the catalog off for everyone.
      # `${VAR:-github.com/...}` is wrong the other way — it swallows the
      # operator's explicit disable. Rendered with `docker compose config`:
      #   bare, unset          -> null (not set) -> config.py default applies
      #   bare, set to a URL   -> the URL
      #   bare, set to ""      -> "" -> seed disabled, as documented
      - TRINITY_DEFAULT_SKILL_SOURCE
      - TRINITY_DEFAULT_SKILL_SOURCE_REF
      # #2380: install provenance marker, written by whatever
      # provisioned this box. Bare passthrough (not ${VAR:-}) so an
      # unset marker never reaches the container as an empty string.
      - TRINITY_INSTALL_SOURCE
      # ent#126: directory the bundled-manifest catalog
      # (GET /api/systems/manifests) reads. Empty = the image's own
      # config/manifests (already bind-mounted :ro below). Point it at another
      # bind-mounted directory to offer your own curated fleet manifests; an
      # unreadable path is an EMPTY catalog, not an error, so mount the
      # directory too — setting this alone silently lists nothing.
      - TRINITY_MANIFESTS_DIR=${TRINITY_MANIFESTS_DIR:-}
      # Agent /tmp tmpfs size (#1231) — read by capabilities.py to build the
      # agent container mount spec. noexec,nosuid stay fixed; only size tunes.
      # Existing agents pick up a change on recreate, not restart.
      - AGENT_TMP_SIZE=${AGENT_TMP_SIZE:-512m}
      # Agent container log cap (#1871) — read by capabilities.py to build the
      # agent container's json-file log_config. The x-logging anchor above bounds
      # the PLATFORM services; agents are SDK-created, so these must reach the
      # backend process itself or the knobs are inert (#1039 class).
      # Existing agents pick up a change on recreate, not restart.
      - AGENT_LOG_MAX_SIZE=${AGENT_LOG_MAX_SIZE:-10m}
      - AGENT_LOG_MAX_FILE=${AGENT_LOG_MAX_FILE:-3}
      # Headless per-tool stall-watchdog ceiling (#1369) — seconds; scoped to
      # mcp__* tools. Threaded into agent containers by crud.py/lifecycle.py, so
      # it must reach the backend here or the .env lever is inert (#1039 class).
      # Default (1800s) lives agent-side; 0/negative disables. Recreate to apply.
      - AGENT_TOOL_STALL_LIMIT_S=${AGENT_TOOL_STALL_LIMIT_S:-}
      - AGENT_IDLE_FINALIZE_S=${AGENT_IDLE_FINALIZE_S:-}
      # OpenTelemetry Configuration (Optional)
      - OTEL_ENABLED=${OTEL_ENABLED:-0}
      - OTEL_COLLECTOR_ENDPOINT=${OTEL_COLLECTOR_ENDPOINT:-http://trinity-otel-collector:4317}
      - OTEL_METRICS_EXPORTER=${OTEL_METRICS_EXPORTER:-otlp}
      - OTEL_LOGS_EXPORTER=${OTEL_LOGS_EXPORTER:-otlp}
      - OTEL_EXPORTER_OTLP_PROTOCOL=${OTEL_EXPORTER_OTLP_PROTOCOL:-grpc}
      - OTEL_METRIC_EXPORT_INTERVAL=${OTEL_METRIC_EXPORT_INTERVAL:-60000}
      # Email Service Configuration (for public link verification)
      - EMAIL_PROVIDER=${EMAIL_PROVIDER:-resend}
      - RESEND_API_KEY=${RESEND_API_KEY:-}
      - SMTP_FROM=${SMTP_FROM:-noreply@trinity.example.com}
      # SMTP transport (EMAIL_PROVIDER=smtp) — read by src/backend/config.py (#771)
      - SMTP_HOST=${SMTP_HOST:-}
      - SMTP_PORT=${SMTP_PORT:-587}
      - SMTP_USER=${SMTP_USER:-}
      - SMTP_PASSWORD=${SMTP_PASSWORD:-}
      # SendGrid transport (EMAIL_PROVIDER=sendgrid) — read by src/backend/config.py (#771)
      - SENDGRID_API_KEY=${SENDGRID_API_KEY:-}
      # Log Retention & Archival Configuration
      # #1039: 5-day community retention floor (was 90). Enterprise `retention`
      # license unlocks longer windows; this env is the self-host escape hatch.
      - LOG_RETENTION_DAYS=${LOG_RETENTION_DAYS:-5}
      - LOG_ARCHIVE_ENABLED=${LOG_ARCHIVE_ENABLED:-true}
      - LOG_CLEANUP_HOUR=${LOG_CLEANUP_HOUR:-3}
      - LOG_ARCHIVE_PATH=/data/archives  # Local path for archived logs
      # Automatic database backups (#2216) — daily job in the backend
      # (services/db_backup_service.py), default ON, artifacts under
      # /data/backups. This service uses an explicit environment list (no
      # env_file), so an unforwarded var is INERT (#1486/#1488 class) —
      # mirror any change into docker-compose.prod.yml.
      - DB_BACKUP_ENABLED=${DB_BACKUP_ENABLED:-true}
      - DB_BACKUP_HOUR=${DB_BACKUP_HOUR:-3}
      - DB_BACKUP_MINUTE=${DB_BACKUP_MINUTE:-30}
      - DB_BACKUP_PG_DUMP_TIMEOUT_SECONDS=${DB_BACKUP_PG_DUMP_TIMEOUT_SECONDS:-1800}
      # Git sync-health poll cadence (#2742). Default UNCHANGED at 60s; the knob
      # exists so an operator can cut the per-poll `git fetch` load on a large
      # fleet. Read at call time in sync_health_service, so it must reach the
      # container or the .env lever is inert (the #1056/#1039 packaging class).
      - SYNC_HEALTH_POLL_INTERVAL_SECONDS=${SYNC_HEALTH_POLL_INTERVAL_SECONDS:-60}  # seconds between fleet sync-health polls
      - TRINITY_DB_PATH=/data/trinity.db
      # Configurable database backend (#300). Unset → SQLite at TRINITY_DB_PATH
      # (default). Set to a postgresql:// URL (with the postgres profile up) to
      # use PostgreSQL: postgresql://trinity:${POSTGRES_PASSWORD}@postgres:5432/trinity
      - DATABASE_URL=${DATABASE_URL:-}
      - DB_POOL_SIZE=${DB_POOL_SIZE:-10}
      - DB_MAX_OVERFLOW=${DB_MAX_OVERFLOW:-20}
      # Credential Encryption
      - CREDENTIAL_ENCRYPTION_KEY=${CREDENTIAL_ENCRYPTION_KEY:-}
      - CREDENTIAL_ENCRYPTION_KEY_SECONDARY=${CREDENTIAL_ENCRYPTION_KEY_SECONDARY:-}  # #267 rotation fallback
      # Internal API shared secret (C-003) - for scheduler/agent communication
      - INTERNAL_API_SECRET=${INTERNAL_API_SECRET:-}
      # Agent auth master (#1159) - backend derives each agent's in-container
      # :8000 auth token from this. Backend hard-fails on first agent call if
      # unset, so it MUST be forwarded explicitly (.env alone is inert in prod).
      - AGENT_AUTH_SECRET=${AGENT_AUTH_SECRET:-}
      # Public access / OAuth callbacks
      - PUBLIC_CHAT_URL=${PUBLIC_CHAT_URL:-}
      - FRONTEND_URL=${FRONTEND_URL:-}
      # Backend's own public origin — used to build OAuth redirect URIs
      # ({BACKEND_URL}/api/oauth/{provider}/callback, read by config.py). Without
      # this line the .env value is inert (the #1039 packaging-gap class) and
      # callbacks fall back to the localhost default. The scheduler reads BACKEND_URL
      # too but keeps its own internal default (http://backend:8000); intentionally
      # not wired here so it still reaches the backend over the Docker network.
      - BACKEND_URL=${BACKEND_URL:-http://localhost:8000}
      # Self-signup + operator-intake privacy levers. Read by config.py; without
      # these lines the .env values are inert (the #1039 packaging-gap class).
      # PUBLIC_ACCESS_REQUESTS_ENABLED gates POST /api/access/request (secure
      # default false); OPERATOR_INTAKE_* / DO_NOT_TRACK is the air-gapped opt-out
      # for the first-run intake POST (#1486/#1488). OPERATOR_INTAKE_URL keeps its
      # FULL non-empty default — a bare :- would arrive set-but-empty and shadow
      # the code default (#1076 class).
      - PUBLIC_ACCESS_REQUESTS_ENABLED=${PUBLIC_ACCESS_REQUESTS_ENABLED:-false}
      - OPERATOR_INTAKE_ENABLED=${OPERATOR_INTAKE_ENABLED:-true}
      - DO_NOT_TRACK=${DO_NOT_TRACK:-0}
      - OPERATOR_INTAKE_URL=${OPERATOR_INTAKE_URL:-https://intake.abilityai.dev/v1/operator-intake}
      # Tier-2 opt-in fleet telemetry sharing (ent#12): consent-gated aggregate
      # egress. TELEMETRY_SHARING_ENABLED=false is the hard kill switch
      # (DO_NOT_TRACK also disables). URL keeps its FULL non-empty default —
      # a bare :- would arrive set-but-empty and shadow the code default (#1076).
      - TELEMETRY_SHARING_ENABLED=${TELEMETRY_SHARING_ENABLED:-true}
      - TELEMETRY_SHARING_URL=${TELEMETRY_SHARING_URL:-https://intake.abilityai.dev/v1/telemetry-share}
      - TELEMETRY_SHARING_INTERVAL_HOURS=${TELEMETRY_SHARING_INTERVAL_HOURS:-24}
      - TELEMETRY_SHARING_BACKFILL_DEFAULT_DAYS=${TELEMETRY_SHARING_BACKFILL_DEFAULT_DAYS:-30}
      # Remote template registry (ent#14): the GitHub half of the template
      # catalog, fetched at runtime. TEMPLATE_REGISTRY_ENABLED=false is the HARD
      # kill switch (no system_settings row can turn it back on) — without this
      # line it is inert, which is the #1039 class the config.py comment argues
      # against one paragraph above where it reads the var. URL keeps its FULL
      # non-empty default — a bare :- would arrive set-but-empty and shadow the
      # code default (#1076 class), pointing the registry at "".
      - TEMPLATE_REGISTRY_ENABLED=${TEMPLATE_REGISTRY_ENABLED:-true}
      - TEMPLATE_REGISTRY_URL=${TEMPLATE_REGISTRY_URL:-https://raw.githubusercontent.com/Abilityai/trinity-templates/main/registry.yaml}
      # CORS (comma-separated extra origins)
      - EXTRA_CORS_ORIGINS=${EXTRA_CORS_ORIGINS:-}
      # Slack channel adapter
      - SLACK_SIGNING_SECRET=${SLACK_SIGNING_SECRET:-}
      # Socket Mode concurrent WebSocket count (#244); clamped to [1,10], default 2
      - SLACK_SOCKET_CONNECTION_COUNT=${SLACK_SOCKET_CONNECTION_COUNT:-2}
      # Telegram group context bounds (ent#600); empty = code defaults (40 / 24h)
      - TELEGRAM_GROUP_CONTEXT_MAX_MESSAGES=${TELEGRAM_GROUP_CONTEXT_MAX_MESSAGES:-}
      - TELEGRAM_GROUP_CONTEXT_MAX_AGE_HOURS=${TELEGRAM_GROUP_CONTEXT_MAX_AGE_HOURS:-}
      # SSH access host override
      - SSH_HOST=${SSH_HOST:-}
      # Host telemetry (/api/telemetry) — container-stats cache freshness (s) and
      # max concurrent Docker stat fetches per refresh. Without these lines the
      # .env knobs are inert (the #1039 packaging-gap class).
      - TELEMETRY_CONTAINER_STATS_TTL=${TELEMETRY_CONTAINER_STATS_TTL:-10}
      - TELEMETRY_DOCKER_POOL_SIZE=${TELEMETRY_DOCKER_POOL_SIZE:-16}
      # Canary invariant harness (CANARY-001 / Issue #411).
      # When 1, services/canary_service.py runs the 5-min watcher loop on
      # staging/dev. Default 0 — production users see no canary activity.
      - CANARY_ENABLED=${CANARY_ENABLED:-0}
      # Slack alert sink for canary green→red transitions. URL is the
      # credential — leaking it lets anyone post to that one channel.
      # Unset = canary cycles run silently (still persists violations).
      - CANARY_SLACK_WEBHOOK_URL=${CANARY_SLACK_WEBHOOK_URL:-}
      # Optional label naming THIS instance in outbound alerts (#1987). Unset
      # is the norm — services/instance_identity.py then derives one from
      # FRONTEND_URL's host, so multiple instances sharing one webhook are
      # already distinguishable. Set it only to override that derivation.
      - TRINITY_INSTANCE_NAME=${TRINITY_INSTANCE_NAME:-}
      # Backend agent-call budget (#904 RC-1). Caps how many concurrent
      # outbound agent HTTP calls the backend will hold at once, plus
      # the per-acquire queue wait before returning 503. Default
      # timeout (3600s) matches the platform max execution_timeout —
      # any call that would have eventually succeeded pre-#904 still
      # succeeds; the cap exists to break deadlocks on deep
      # agent-to-agent chains (chain depth > global cap), not to fail
      # short-tail calls. Set queue timeout to 0 to disable (wait
      # forever — accepts deadlock risk for zero false 503s).
      - BACKEND_AGENT_CALL_LIMIT=${BACKEND_AGENT_CALL_LIMIT:-8}
      - BACKEND_AGENT_CALL_QUEUE_TIMEOUT_S=${BACKEND_AGENT_CALL_QUEUE_TIMEOUT_S:-3600}
      # Fire-and-forget dispatch (#1083). When true, eligible autonomous turns
      # ({schedule, webhook}) are dispatched 202 + finalized via callback so a
      # wedged turn holds zero backend coroutine/slot beyond its lease. Default
      # false; safe to flip early (non-202 agent responses fall back to sync).
      # Backend-only — the scheduler doesn't dispatch to agents.
      - DISPATCH_ASYNC=${DISPATCH_ASYNC:-false}
      # Dispatch circuit breaker global gate (RELIABILITY-007, #526). Producer-side
      # per-agent breaker; engages ONLY when this AND the per-agent
      # agent_ownership.circuit_breaker_enabled toggle are both on. Default false —
      # without this line the owner-facing PUT .../circuit-breaker toggle silently
      # no-ops (#1487, the #1039 packaging-gap class).
      - DISPATCH_BREAKER_ENABLED=${DISPATCH_BREAKER_ENABLED:-false}
      # ent#434: how many subscriptions the background headroom sweep probes
      # concurrently. Bounded so an N-subscription fleet x a 15s probe timeout
      # cannot outlive the sweep's leader lease. A real operator lever (fleet
      # size dependent), so it is forwarded rather than left inert.
      - SUBSCRIPTION_SWEEP_CONCURRENCY=${SUBSCRIPTION_SWEEP_CONCURRENCY:-4}
      # Issue #874: uvicorn --reload writes __pycache__/ next to source files
      # in the ./src/backend bind mount. On Linux dev hosts the host dir is
      # owned by the developer UID, not container UID 1000, so the writes
      # fail. macOS Docker Desktop masks the failure; set this for parity.
      - PYTHONDONTWRITEBYTECODE=1
      # #847 — force OSS-only mode even when the enterprise submodule
      # is mounted. With this set, EntitlementService.is_entitled()
      # returns False for every feature, and the /api/settings/feature-flags
      # `enterprise_features` list is empty. Default (unset = 0): allow
      # entitlements based on license (Phase 0 stub: all-entitled).
      - TRINITY_OSS_ONLY=${TRINITY_OSS_ONLY:-0}
      # #946 pull-pilot routing flag — backend reads it only to surface
      # mcp_agent_chat_pull_enabled in GET /api/settings/feature-flags
      # (observability). The actual routing gate is the mcp-server's read of the
      # SAME env key; keep both in sync via this single .env var.
      - MCP_AGENT_CHAT_PULL_ENABLED=${MCP_AGENT_CHAT_PULL_ENABLED:-false}
      # #848 inline email auth — read by BOTH processes from this one key. The
      # backend gates the /api/internal/mcp-auth/* surface on it (404 when off)
      # and gates the keyless connector snippet; the mcp-server gates the keyless
      # session tier. Must be wired in both services or the whole feature is
      # un-flippable on deploy (#1056/#1039 packaging-gap class).
      - MCP_INLINE_AUTH_ENABLED=${MCP_INLINE_AUTH_ENABLED:-false}
      # #1081 pull/work-stealing pilot allowlist — the SINGLE switch that opts an
      # agent into pull mode. Backend-only, process-env (needs a backend restart),
      # default empty = pull fully dark. Forwarded here (G1) because the backend
      # service uses an explicit environment list (not env_file), so a bare .env
      # entry otherwise never reached the container.
      - PULL_MODE_PILOT_AGENTS=${PULL_MODE_PILOT_AGENTS:-}
      # Lease-reaper poison-task cap (#1081 Phase 3 — #429/#1402): re-deliveries
      # of an expired pull lease before the row is poison-parked. Backend-only,
      # default 3. Inert until a PULL_MODE_PILOT_AGENTS agent is opted in.
      - MAX_REDELIVERY=${MAX_REDELIVERY:-3}
      # Correlated-failure / thundering-herd controls (#1085) — re-delivery
      # governor. Backend-only; all fail-open and inert until the master flag is
      # on. Wired here so the .env levers actually reach the container.
      - REDELIVERY_GOVERNOR_ENABLED=${REDELIVERY_GOVERNOR_ENABLED:-false}
      - REDELIVERY_FLEET_LIMIT=${REDELIVERY_FLEET_LIMIT:-600}
      - REDELIVERY_FLEET_WINDOW_SECONDS=${REDELIVERY_FLEET_WINDOW_SECONDS:-60}
      - REDELIVERY_AGENT_LIMIT=${REDELIVERY_AGENT_LIMIT:-20}
      - REDELIVERY_AGENT_WINDOW_SECONDS=${REDELIVERY_AGENT_WINDOW_SECONDS:-60}
      - CORRELATED_FAILURE_THRESHOLD=${CORRELATED_FAILURE_THRESHOLD:-20}
      - CORRELATED_FAILURE_WINDOW_SECONDS=${CORRELATED_FAILURE_WINDOW_SECONDS:-120}
      - CORRELATED_PAUSE_TTL_SECONDS=${CORRELATED_PAUSE_TTL_SECONDS:-300}
      - REDELIVERY_PAUSE_RETRY_AFTER_SECONDS=${REDELIVERY_PAUSE_RETRY_AFTER_SECONDS:-30}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./src/backend:/app
      - ./VERSION:/app/VERSION:ro  # Platform version for agent container labels
      - ./config/agent-templates:/agent-configs/templates:ro
      - ./config/process-templates:/agent-configs/process-templates:ro  # Process templates
      - ./config/hooks:/config/hooks:ro  # Read-only hooks (e.g., read-only-guard.py)
      - ./config/process-docs:/app/config/process-docs:ro  # Process documentation
      - ./config/manifests:/app/config/manifests:ro  # Bundled system manifests (first-run seed, ent#124)
      - agent-configs:/agent-configs
      - trinity-data:/data
      - trinity-logs:/data/logs  # rw: log_archive_service must delete archived originals (#1478); Vector is the sole writer of new lines
      - trinity-archives:/data/archives  # Log archives storage
    depends_on:
      redis:
        condition: service_healthy   # Wait for ACL load + auth-aware healthcheck
      vector:
        condition: service_healthy  # Ensure Vector is ready before backend starts agents
      logs-init:
        condition: service_completed_successfully  # #1478: dir owned by UID 1000 before retention runs
      archives-init:
        condition: service_completed_successfully  # #2205: same, for the archives volume
    networks:
      - trinity-platform   # Redis, scheduler, vector, OTel
      - trinity-agent      # Frontend, mcp-server, agent containers
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    # No cap_add: backend listens on 8000 (>=1024, no NET_BIND_SERVICE needed)
    # and reaches /var/run/docker.sock via group_add below — not capabilities.
    # Issue #874 / #1131: backend runs as UID 1000 (non-root) but still needs to
    # talk to /var/run/docker.sock. The GID to join is the socket's group as a
    # container sees it: a Linux bind mount exposes the host `docker` group
    # (Debian/Ubuntu 999, RHEL ~991, Arch 990); Docker Desktop / Colima / Rancher
    # present it root-group-owned (GID 0). Docker Desktop does NOT ignore
    # group_add — the wrong assumption it does was the #1131 regression.
    # start.sh auto-detects the right GID into DOCKER_GID; :-999 is the
    # Debian/Ubuntu fallback used only when .env carries no value.
    group_add:
      - "${DOCKER_GID:-999}"
    read_only: false
    tmpfs:
      - /tmp:noexec,nosuid,size=100m
    command: uvicorn main:app --host 0.0.0.0 --port 8000 --reload --no-server-header
    mem_limit: 4g
    cpus: 4

  frontend:
    build:
      context: ./src/frontend
      dockerfile: ../../docker/frontend/Dockerfile
    image: trinity-frontend:latest
    container_name: trinity-frontend
    logging: *default-logging
    restart: unless-stopped   # #2541
    ports:
      - "${FRONTEND_PORT:-80}:80"
    volumes:
      - ./src/frontend:/app
      - /app/node_modules
    environment:
      - VITE_API_URL=http://localhost:8000
      - DOCKER_ENV=true
    depends_on:
      - backend
    networks:
      - trinity-agent      # Frontend talks to backend on agent network
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    mem_limit: 2g
    cpus: 2

  redis:
    image: redis:7-alpine
    container_name: trinity-redis
    logging: *default-logging
    restart: unless-stopped   # #2541
    # Loopback-only host port (test suites connect from the dev machine).
    # External LAN cannot reach Redis even with auth — defense in depth.
    ports:
      - "127.0.0.1:6379:6379"
    volumes:
      - redis-data:/data
    networks:
      - trinity-platform   # Issue #589: Redis is NOT on agent network
    environment:
      # Two passwords by design: leaking the runtime password from a
      # compromised platform container does NOT grant admin (FLUSHALL,
      # CONFIG, SHUTDOWN). See docs/migrations/REDIS_AUTH.md.
      - "REDIS_PASSWORD=${REDIS_PASSWORD:?REDIS_PASSWORD must be set in .env (generate openssl rand -hex 24)}"
      - "REDIS_BACKEND_PASSWORD=${REDIS_BACKEND_PASSWORD:?REDIS_BACKEND_PASSWORD must be set in .env (generate openssl rand -hex 24)}"
    # Additive ACL — start from zero, allow only what the runtime needs.
    # `+@all -X` is rejected: it includes commands Redis hasn't shipped yet.
    # NB: each `--user` rule must be its own argv (Redis CLI parser).
    command:
      - redis-server
      - --appendonly
      - "yes"
      - --requirepass
      - ${REDIS_PASSWORD}
      # default — admin user, full access (used for ACL bootstrap and ad-hoc ops)
      - --user
      - default
      - "on"
      - ">${REDIS_PASSWORD}"
      - "~*"
      - "&*"
      - "+@all"
      # backend — runtime user for backend container
      - --user
      - backend
      - "on"
      - ">${REDIS_BACKEND_PASSWORD}"
      - "~*"
      - "&*"
      - "+@read"
      - "+@write"
      - "+@connection"
      - "+@keyspace"
      - "+@stream"
      - "+@list"
      - "+@set"
      - "+@sortedset"
      - "+@hash"
      - "+@scripting"
      - "+@transaction"
      - "+@pubsub"
      - "-@dangerous"
      # scheduler — same access pattern as backend; separate user for traceability
      - --user
      - scheduler
      - "on"
      - ">${REDIS_BACKEND_PASSWORD}"
      - "~*"
      - "&*"
      - "+@read"
      - "+@write"
      - "+@connection"
      - "+@keyspace"
      - "+@stream"
      - "+@list"
      - "+@set"
      - "+@sortedset"
      - "+@hash"
      - "+@scripting"
      - "+@transaction"
      - "+@pubsub"
      - "-@dangerous"
    # Healthcheck pings as the `backend` ACL user so a typo'd ACL keeps
    # Redis unhealthy and gates dependent services (broken-ACL caught at
    # boot, not after first user-facing failure).
    # Password passed via REDISCLI_AUTH env var (not -a flag) so it does
    # not appear in /proc/<pid>/cmdline during the healthcheck (CSO OBS-3).
    healthcheck:
      test:
        - CMD-SHELL
        - REDISCLI_AUTH="$$REDIS_BACKEND_PASSWORD" redis-cli --user backend --no-auth-warning ping | grep -q PONG
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s

  mcp-server:
    build:
      context: ./src/mcp-server
      dockerfile: Dockerfile
    container_name: trinity-mcp-server
    logging: *default-logging
    ports:
      - "8080:8080"
    environment:
      - NODE_ENV=production
      - MCP_PORT=8080
      - TRINITY_API_URL=http://backend:8000
      - TRINITY_USERNAME=${TRINITY_USERNAME:-admin}
      # #914: ceiling for the synchronous backend fetch in chat_with_agent
      # sync mode. On abort, the MCP server queries /executions and returns
      # a structured `queued_timeout` receipt instead of `fetch failed`.
      # Default 25000ms sits below the typical 30-60s MCP gateway ceiling.
      - MCP_CHAT_TIMEOUT_MS=${MCP_CHAT_TIMEOUT_MS:-25000}
      # #2661 ceiling for the executions lookup that recovery runs AFTER the
      # abort — whatever is left of the gateway ceiling is all it has, so it
      # must fail fast rather than hang into the same `fetch failed`.
      - MCP_RECOVERY_TIMEOUT_MS=${MCP_RECOVERY_TIMEOUT_MS:-5000}
      # MCP server authenticates to backend as ADMIN_USERNAME/ADMIN_PASSWORD.
      # Read directly from ADMIN_PASSWORD so devs do not have to set the same
      # secret twice (issue #692).
      - TRINITY_PASSWORD=${ADMIN_PASSWORD:-}
      - MCP_REQUIRE_API_KEY=true
      # #946 pull-pilot: the MCP server routes sequential agent→agent
      # chat_with_agent through the async /task path when ON. THIS is the routing
      # gate (the backend reads the same key only for feature-flags observability).
      # Must be wired here or the flag is un-flippable on deploy (#1056/#1039 class).
      - MCP_AGENT_CHAT_PULL_ENABLED=${MCP_AGENT_CHAT_PULL_ENABLED:-false}
      # #3232 report-back kill switch (default on): false stops every
      # chat_with_* call from sending parent_execution_id, default or typed.
      - MCP_REPORT_BACK_ENABLED=${MCP_REPORT_BACK_ENABLED:-true}
      # #848 inline email auth — THIS is the session-tier gate: with it OFF a
      # keyless MCP connection is refused outright and no login tools register.
      # The backend reads the same key to gate /api/internal/mcp-auth/*. Both
      # must be wired or the feature can never be switched on (#1056/#1039 class).
      - MCP_INLINE_AUTH_ENABLED=${MCP_INLINE_AUTH_ENABLED:-false}
      # #848 ceiling for the mcp-server's four backend relay fetches on the
      # inline-auth path (request/verify/playbooks/chat). Functional via its
      # 15000ms default; wired so the lever is not inert.
      - MCP_INLINE_AUTH_TIMEOUT_MS=${MCP_INLINE_AUTH_TIMEOUT_MS:-15000}
      # #736 ceiling for the mcp-server's own outbound-A2A fetches
      # (call_a2a_agent / get_a2a_task). It must stay BELOW the MCP client's
      # gateway abort so WE give up first and can return a pollable receipt
      # instead of an opaque `fetch failed` over a call that completed anyway.
      # Functional via its 40000ms default; wired so the lever is not inert.
      - MCP_A2A_TIMEOUT_MS=${MCP_A2A_TIMEOUT_MS:-40000}
      # ent#328: `ask_trinity` POSTs here for grounded Trinity docs answers.
      # Empty = the public Cloud Function default baked into the client. Wired
      # through compose because an env var the container never receives is not
      # actually configurable — the same "un-flippable on deploy" trap called
      # out for the flag above. Point it at an internal mirror, or at an
      # unreachable value to effectively disable the tool (it degrades to a
      # structured error, never a crash).
      - ASK_TRINITY_ENDPOINT=${ASK_TRINITY_ENDPOINT:-}
      - INTERNAL_API_SECRET=${INTERNAL_API_SECRET:-}  # SEC-001: for audit logging to backend
    depends_on:
      - backend
    networks:
      # MCP server straddles both networks: agents call http://mcp-server:8080/mcp
      # via Docker DNS on the agent network; backend reaches it on platform network.
      - trinity-platform
      - trinity-agent
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    restart: unless-stopped

  # Scheduler - dedicated service for cron-based agent task execution
  # Prevents duplicate executions that occurred with multiple backend workers
  scheduler:
    build:
      context: .
      dockerfile: docker/scheduler/Dockerfile
    container_name: trinity-scheduler
    logging: *default-logging
    restart: unless-stopped
    environment:
      - DATABASE_PATH=/data/trinity.db
      # #300: when set to a postgresql:// URL the scheduler reads/writes Postgres
      # (the same DB the backend uses); unset → shared SQLite at DATABASE_PATH.
      - DATABASE_URL=${DATABASE_URL:-}
      # Scheduler uses the same `backend` ACL user (identical access patterns).
      - "REDIS_URL=redis://backend:${REDIS_BACKEND_PASSWORD:?REDIS_BACKEND_PASSWORD must be set in .env}@redis:6379"
      - HEALTH_PORT=8001
      - LOG_LEVEL=${SCHEDULER_LOG_LEVEL:-INFO}
      - LOCK_TIMEOUT=600
      - AGENT_TIMEOUT=900
      # #1022: scheduler→backend dispatch + pre-check deadlines (operator-tunable).
      - DISPATCH_TIMEOUT=${DISPATCH_TIMEOUT:-30}
      - PRE_CHECK_TIMEOUT=${PRE_CHECK_TIMEOUT:-70}
      - READINESS_CHECK_TIMEOUT=${READINESS_CHECK_TIMEOUT:-5}
      - MISFIRE_GRACE_TIME=3600
      - PUBLISH_EVENTS=true
      - INTERNAL_API_SECRET=${INTERNAL_API_SECRET:-}
    volumes:
      - trinity-data:/data
    depends_on:
      redis:
        condition: service_healthy   # Wait for ACL load + auth-aware healthcheck
      backend:
        condition: service_started
    networks:
      - trinity-platform   # Scheduler talks only to Redis + backend; never to agents
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8001/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    mem_limit: 512m
    cpus: 1

  # #1478: one-shot that makes the shared logs volume dir owned by UID 1000 so the
  # backend (non-root) can unlink retention-archived originals. Vector writes new
  # log files as root; deleting a file needs write on the *directory*, not the file,
  # so chowning just the dir (fast, not -R) is enough. Runs as root (needs CAP_CHOWN,
  # so no cap_drop); exits immediately; backend waits on completion.
  logs-init:
    image: alpine:3.20
    container_name: trinity-logs-init
    logging: *default-logging
    command: ["sh", "-c", "chown 1000:1000 /data/logs && chmod 775 /data/logs"]
    volumes:
      - trinity-logs:/data/logs
    restart: "no"
    networks:
      - trinity-platform

  # #2205: the missed sibling of `logs-init`. `trinity-archives` is a NAMED volume,
  # and Docker creates those root-owned — so the UID-1000 backend could not write
  # `/data/archives` at all. `archive_storage.__init__` does
  # `mkdir(parents=True, exist_ok=True)`, which silently no-ops on the existing
  # root-owned directory, so nothing failed until the first WRITE: every archival
  # run died with `[Errno 13] Permission denied`, archived originals were never
  # unlinked, and `/data/logs` grew unbounded (measured on a real instance: 8.5 GB,
  # a single 4.6 GB file, failing since 2026-06-23).
  #
  # Why it hid: the ERROR is written into the very log files that are not being
  # pruned — symptom and diagnosis in the same unbounded file nobody tails. Same
  # class as #1478 and #1871.
  #
  # This also REPAIRS existing installs rather than only fixing fresh ones: the
  # one-shot runs on every `up`, and chowning the directory is idempotent.
  # `chmod 775` (not 755) so a future root-writing sibling can share it, exactly as
  # #1478 reasoned for the logs volume.
  archives-init:
    image: alpine:3.20
    container_name: trinity-archives-init
    logging: *default-logging
    command: ["sh", "-c", "chown 1000:1000 /data/archives && chmod 775 /data/archives"]
    volumes:
      - trinity-archives:/data/archives
    restart: "no"
    networks:
      - trinity-platform

  # Vector - centralized log aggregation from all containers
  vector:
    image: timberio/vector:0.43.1-alpine
    container_name: trinity-vector
    logging: *default-logging
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./config/vector.yaml:/etc/vector/vector.yaml:ro
      - trinity-logs:/data/logs
    ports:
      - "8686:8686"  # Vector API (health checks)
    networks:
      - trinity-platform   # Vector reads via Docker socket, not network — platform side
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    # #1799: #1478 chowns /data/logs to 1000:1000 (chmod 775) so the UID-1000
    # backend's retention sweep can delete archived originals. Vector runs as
    # root, but cap_drop: ALL strips CAP_DAC_OVERRIDE — the capability that lets
    # root ignore file permissions — so root is neither owner nor group and
    # falls through to "other" (r-x) on that 775 dir. EVERY sink write then
    # fails with "Permission denied", silently: a file-sink error does not fail
    # the :8686 healthcheck, so Vector reports healthy while writing nothing.
    #
    # Joining GID 1000 uses the dir's existing group-write bit instead of
    # restoring a capability, so the cap_drop posture is preserved. Vector must
    # stay ROOT for the uid: raw container logs under /var/lib/docker/containers
    # are 0640 root:root, so user: "1000:1000" would swap a write failure for a
    # read failure.
    group_add:
      - "1000"
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8686/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s  # Give Vector time to start before health checks

  # OpenTelemetry Collector - receives metrics from Claude Code agents
  # Using contrib image for deltatocumulative processor (required for Prometheus export)
  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.120.0
    container_name: trinity-otel-collector
    logging: *default-logging
    restart: unless-stopped
    ports:
      - "4317:4317"   # gRPC receiver (OTLP)
      - "4318:4318"   # HTTP receiver (OTLP)
      - "8889:8889"   # Prometheus metrics exporter
      - "13133:13133" # Health check endpoint
    volumes:
      - ./config/otel-collector.yaml:/etc/otelcol-contrib/config.yaml:ro
    networks:
      - trinity-platform
      - trinity-agent      # Agents push metrics directly to the collector
    labels:
      - "trinity.platform=infrastructure"
      - "trinity.service=otel-collector"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

  # PostgreSQL - optional production-grade database backend (#300).
  # OFF by default: SQLite (trinity-data volume) remains the zero-config
  # default. Opt in with `docker compose --profile postgres up`, then point
  # the backend at it via DATABASE_URL in .env:
  #   DATABASE_URL=postgresql://trinity:${POSTGRES_PASSWORD}@postgres:5432/trinity
  # Lives on the platform network only — agents NEVER reach it (Issue #589).
  postgres:
    image: postgres:16-alpine
    container_name: trinity-postgres
    logging: *default-logging
    restart: unless-stopped
    profiles: ["postgres"]
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-trinity}
      POSTGRES_USER: ${POSTGRES_USER:-trinity}
      # Default keeps `docker compose` parseable when the postgres profile is
      # OFF (the common case) and POSTGRES_PASSWORD is unset. Operators enabling
      # the profile should set a real POSTGRES_PASSWORD in .env.
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-trinity}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - trinity-platform
    labels:
      - "trinity.platform=infrastructure"
      - "trinity.service=postgres"
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-trinity} -d ${POSTGRES_DB:-trinity}"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s

volumes:
  agent-configs:
  redis-data:
  trinity-data:
  trinity-logs:  # Vector log storage
  trinity-archives:  # Compressed log archives
  postgres-data:  # PostgreSQL data (only used with --profile postgres, #300)

networks:
  # Platform-internal network: Redis, scheduler, backend, mcp-server, vector, otel.
  # Agents NEVER join this network — Issue #589 (Redis lockdown).
  trinity-platform:
    driver: bridge
    name: trinity-platform-network
    ipam:
      config:
        - subnet: 172.29.0.0/16
  # Agent-facing network: agents, frontend, plus the bridges that need to reach
  # them (backend, mcp-server, otel-collector). Name preserved so the three
  # agent-creation sites in services/agent_service/* and system_agent_service.py
  # need zero code changes.
  trinity-agent:
    driver: bridge
    name: trinity-agent-network
    ipam:
      config:
        - subnet: 172.28.0.0/16