fix: tighten internal semantic compose contracts

This commit is contained in:
2026-08-08 18:47:22 +02:00
parent 320d9ea74e
commit 8f4ec1e1a3
7 changed files with 106 additions and 6 deletions
+9
View File
@@ -75,12 +75,17 @@ for (const serviceName of ["qdrant", "embedding", "embedding-model-init"]) {
}
if ((config.services.qdrant.expose || []).join(",") !== "6333") throw new Error("qdrant must expose only 6333");
if ((config.services.embedding.expose || []).join(",") !== "11434") throw new Error("embedding must expose only 11434");
if (!config.services.qdrant.healthcheck) throw new Error("qdrant must define a healthcheck");
if (!config.services.embedding.healthcheck) throw new Error("embedding must define a healthcheck");
if (config.services.core.depends_on?.qdrant?.condition !== "service_healthy") {
throw new Error("core must wait for qdrant health");
}
if (config.services.core.depends_on?.["embedding-model-init"]?.condition !== "service_completed_successfully") {
throw new Error("core must wait for embedding-model-init success");
}
if (config.services["embedding-model-init"].depends_on?.embedding?.condition !== "service_healthy") {
throw new Error("embedding-model-init must wait for embedding health");
}
if (JSON.stringify(config.services.embedding).includes('"devices"')) {
throw new Error("base embedding service must stay CPU-only");
}
@@ -190,6 +195,10 @@ if (config.services.core.depends_on?.qdrant?.condition !== "service_healthy") {
if (config.services.core.depends_on?.["embedding-model-init"]?.condition !== "service_completed_successfully") {
throw new Error("core must wait for embedding-model-init success");
}
if (!config.services.embedding.healthcheck) throw new Error("embedding must define a healthcheck");
if (config.services["embedding-model-init"].depends_on?.embedding?.condition !== "service_healthy") {
throw new Error("embedding-model-init must wait for embedding health");
}
if (/docker\.sock|\/var\/run\/docker|docker[-_]?daemon/i.test(JSON.stringify(config.services))) {
throw new Error("Compose must not mount the Docker socket or daemon");
}