fix: close deployment decoupling review

docker-compose.dev.yml

@@ -1,7 +1,7 @@
-# ThothII — deploy STANDALONE locale (dev / smoke test).
-# Rete propria + porte host per ispezione diretta.
-#   docker compose -f docker-compose.dev.yml up -d --build
-#   frontend: http://localhost:8090   backend: http://localhost:8787
+# ThothII standalone development/smoke stack.
+# Run with the canonical local env file:
+#   docker compose --env-file deploy/env/local.env -f docker-compose.dev.yml up -d --build
+# frontend: http://localhost:8090   backend: http://localhost:8787
 name: thothii-dev
 
 services:
@@ -10,19 +10,18 @@ services:
       context: .
       dockerfile: docker/core.Dockerfile
     image: thothii-core:local
-    env_file:
-      - path: deploy/thothii.env
-        required: false
     environment:
       HOST: 0.0.0.0
       PORT: "8787"
       THT_HARNESS_DIR: /app/harness
       THT_BIN: /opt/venv/bin/tht
       PI_BIN: pi
-      AUTH_MODE: ${AUTH_MODE:-none}
+      AUTH_MODE: none
       THT_SESSION_STORAGE: local
       THT_HOME: /data/local-home
+      THT_DATA_ROOT: /data
       SETTINGS_FILE: /data/settings/settings.json
+      THT_MAINTENANCE_FILE: /data/settings/maintenance.json
       THT_WORKSPACE_REGISTRY_ROOT: /data/workspace-registry
       THT_WORKSPACE_GIT_REMOTE: ${THT_WORKSPACE_GIT_REMOTE:?set THT_WORKSPACE_GIT_REMOTE}
       THT_WORKSPACE_GIT_BRANCH: ${THT_WORKSPACE_GIT_BRANCH:-main}
@@ -30,26 +29,35 @@ services:
       THT_WORKSPACE_GIT_AUTHOR_NAME: ${THT_WORKSPACE_GIT_AUTHOR_NAME:-Thoth Workspace Registry}
       THT_WORKSPACE_GIT_AUTHOR_EMAIL: ${THT_WORKSPACE_GIT_AUTHOR_EMAIL:-thoth-workspace-registry@localhost}
       THT_WORKSPACE_SECRET_ROOTS: /run/secrets
-      GIT_CONFIG_COUNT: "2"
-      GIT_CONFIG_KEY_0: credential.helper
-      GIT_CONFIG_VALUE_0: store --file=/run/secrets/workspace-registry-git-credentials
-      GIT_CONFIG_KEY_1: http.sslCAInfo
-      GIT_CONFIG_VALUE_1: /run/secrets/workspace-registry-git-ca
-      GIT_SSH_COMMAND: ssh -i /run/secrets/workspace-registry-git-ssh-key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/run/secrets/workspace-registry-git-known-hosts
+      THT_SECRETS_FILE: /run/secrets/thothii.secrets
+      THT_DB_NAME: ${THT_DB_NAME:-}
+      THT_DWH_REST_URL: ${THT_DWH_REST_URL:-}
+      THT_VEC_REST_URL: ${THT_VEC_REST_URL:-}
+      THT_VEC_WRITE_REST_URL: ${THT_VEC_WRITE_REST_URL:-}
+      THT_OLLAMA_URL: ${THT_OLLAMA_URL:-}
+      THT_LLM_URL: ${THT_LLM_URL:-}
       MAX_PI_PROCESSES: ${MAX_PI_PROCESSES:-4}
     extra_hosts:
       - "host.docker.internal:host-gateway"
     volumes:
       - dev-data:/data
-      - workspace-registry:/data/workspace-registry
       - dev-pi-state:/home/thoth/.pi
+      - ${PI_AUTH_FILE:?set PI_AUTH_FILE}:/home/thoth/.pi/agent/auth.json:ro
+      - ./deploy/pi/models.json:/home/thoth/.pi/agent/models.json:ro
+      - ./deploy/pi/settings.json:/home/thoth/.pi/agent/settings.json:ro
+      - workspace-registry:/data/workspace-registry
       - ${THT_DEV_EVIDENCE_HOST_PATH:-./evidence}:/data/evidence:ro
-      - ${THT_WORKSPACE_GIT_CREDENTIALS_FILE:-/dev/null}:/run/secrets/workspace-registry-git-credentials:ro
-      - ${THT_WORKSPACE_GIT_CA_FILE:-/etc/ssl/certs/ca-certificates.crt}:/run/secrets/workspace-registry-git-ca:ro
-      - ${THT_WORKSPACE_GIT_SSH_KEY_FILE:-/dev/null}:/run/secrets/workspace-registry-git-ssh-key:ro
-      - ${THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE:-/dev/null}:/run/secrets/workspace-registry-git-known-hosts:ro
+    secrets:
+      - source: thothii_secrets
+        target: thothii.secrets
     ports:
       - "127.0.0.1:8787:8787"
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8787/health"]
+      interval: 15s
+      timeout: 3s
+      retries: 5
+      start_period: 30s
     restart: "no"
     networks: [thothii-net]
 
@@ -64,7 +72,8 @@ services:
     ports:
       - "127.0.0.1:8090:8080"
     depends_on:
-      - core
+      core:
+        condition: service_healthy
     restart: "no"
     networks: [thothii-net]
 
@@ -76,3 +85,7 @@ volumes:
   dev-data:
   dev-pi-state:
   workspace-registry:
+
+secrets:
+  thothii_secrets:
+    file: "${THT_SECRETS_FILE:?set THT_SECRETS_FILE}"