fix(docker): run real questions through trusted Pi gate

scripts/bootstrap-local-psd-docker-config.sh

@@ -0,0 +1,68 @@
+#!/bin/sh
+set -eu
+
+root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+source_env=${1:-"$root/../../harness/.env"}
+workspace=${2:-"$root/../../../tht-workspace-psd"}
+auth_file=${3:-"$HOME/.pi/agent/auth.json"}
+
+value() {
+  awk -F= -v key="$1" '$1 == key { sub(/^[^=]*=/, ""); sub(/[[:space:]].*$/, ""); print; exit }' "$source_env"
+}
+required() {
+  result=$(value "$1")
+  [ -n "$result" ] || { echo "missing $1 in local source configuration" >&2; exit 2; }
+  printf '%s' "$result"
+}
+
+test -f "$source_env"
+test -d "$workspace"
+test -f "$auth_file"
+ca=$(value THT_SSL_CA)
+[ -z "$ca" ] || test -f "$ca"
+model_key=$(jq -er '.zai.key' "$auth_file")
+test -n "$model_key"
+
+umask 077
+mkdir -p "$root/deploy/secrets" "$root/deploy/workspaces"
+cp "$root/deploy/compose.psd-local.yaml.example" "$root/deploy/compose.psd-local.yaml"
+cp "$root/deploy/workspaces/psd.yaml.example" "$root/deploy/workspaces/psd.yaml"
+cat >"$root/.env" <<EOF
+COMPOSE_FILE=compose.yaml:deploy/compose.psd-local.yaml
+COMPOSE_PROFILES=
+THT_SECRETS_FILE=deploy/secrets/thothii.secrets
+THOTH_HTTP_PORT=8080
+AUTH_MODE=none
+THOTH_PUBLIC_EXPOSURE=false
+MAX_PI_PROCESSES=4
+PI_PROVIDER=zai
+PI_MODEL=glm-5.2
+PI_THINKING=medium
+THT_PROFILE=workstation
+THT_DB_NAME=$(required THT_DB_NAME)
+THT_DWH_REST_URL=$(required THT_DWH_REST_URL)
+THT_VEC_REST_URL=$(required THT_VEC_REST_URL)
+THT_VEC_WRITE_REST_URL=$(required THT_VEC_WRITE_REST_URL)
+THT_OLLAMA_URL=http://host.docker.internal:11434
+THT_DOCS_ROOT=/data/workspaces/psd
+THT_PSD_WORKSPACE_HOST_PATH=$workspace
+EOF
+cat >"$root/deploy/secrets/thothii.secrets" <<EOF
+THT_MODEL_API_KEY=$model_key
+THT_DWH_API_KEY=$(required THT_DWH_API_KEY)
+THT_VEC_API_KEY=$(required THT_VEC_API_KEY)
+THT_VEC_WRITE_API_KEY=$(required THT_VEC_WRITE_API_KEY)
+EOF
+if [ -n "$ca" ]; then
+  cat >>"$root/deploy/compose.psd-local.yaml" <<EOF
+      - type: bind
+        source: $ca
+        target: /run/secrets/ca-chain.pem
+        read_only: true
+EOF
+  printf '%s\n' 'THT_CA=/run/secrets/ca-chain.pem' >>"$root/deploy/secrets/thothii.secrets"
+else
+  printf '%s\n' 'THT_CA=/etc/ssl/certs/ca-certificates.crt' >>"$root/deploy/secrets/thothii.secrets"
+fi
+chmod 600 "$root/.env" "$root/deploy/secrets/thothii.secrets"
+echo "Local PSD Docker configuration materialized without printing secret values."

scripts/test-container-deployment.sh

@@ -25,6 +25,9 @@ grep -q 'host_ip: 127.0.0.1' "$tmp/base.yaml"
 grep -q 'AUTH_MODE: none' "$tmp/base.yaml"
 grep -q 'THOTH_PUBLIC_EXPOSURE: "false"' "$tmp/base.yaml"
 grep -q 'THT_SECRETS_FILE: /run/secrets/thothii.secrets' "$tmp/base.yaml"
+grep -q 'target: /home/thoth/.pi/agent/models.json' "$tmp/base.yaml"
+grep -q 'source: .*/deploy/pi/models.json' "$tmp/base.yaml"
+grep -q 'target: /home/thoth/.pi/agent/settings.json' "$tmp/base.yaml"
 if grep -q 'THT_[A-Z0-9_]*_SECRET_FILE:' "$tmp/base.yaml"; then
   echo "base Compose must not require legacy secret-file variables" >&2
   exit 1