Task 2 report — portable Compose contract

Status

Completed. The root Compose file is now a portable two-service base, with explicit local and server overrides. Workspace-registry configuration remains generic and continues to require an installation-provided Git remote.

Changed files

.env.example — shared non-secret, generic endpoint and registry examples.
compose.yaml — portable core and frontend base, owned thothii network, health checks, named settings/Pi/registry/session volumes, and generic external endpoint variables.
deploy/compose.local.yaml — loopback core/frontend ports, AUTH_MODE=none, local installation identity, and non-persistent restart policy.
deploy/compose.server.yaml — frontend-only configurable host bind, AUTH_MODE=upstream, server identity, host-root data/Pi/registry mounts, and restart policy.
deploy/env/local.env.example and deploy/env/server.env.example — safe profile-specific values using .example.invalid documentation domains.
scripts/test-default-compose.sh — default local portable Compose assertion.
scripts/test-unified-compose.sh — JSON structural assertions for base/local/server plus the required missing-remote failure checks.

RED evidence

Before changing Compose, bash scripts/test-unified-compose.sh exited 1 with:

Error: forbidden application coupling

The failure was raised by the required assertion while the rendered root config still contained the portal-specific networks and host paths.

GREEN evidence

The following fresh commands completed with exit status 0:

bash scripts/test-default-compose.sh
# default Compose contract passed.

bash scripts/test-unified-compose.sh
# unified Compose contract passed.

bash -lc 'set -a; source deploy/env/local.env.example; set +a; docker compose -f compose.yaml -f deploy/compose.local.yaml config --quiet'

bash -lc 'set -a; source deploy/env/server.env.example; set +a; docker compose -f compose.yaml -f deploy/compose.server.yaml config --quiet'

bash scripts/verify-line-endings.sh
git diff --check

The two config --quiet invocations source only their non-secret profile example so the requested commands can validate the required Git-remote interpolation without an operator .env file.

Self-review

The base renders exactly core and frontend; it has no portal, Chirone, local-LLM-network, or host-path coupling.
Local publishing is loopback-only; server has no core host port and publishes the frontend bind.
The core retains outbound access for configured external DWH, vector, Git, embedding, and LLM endpoints; the owned Compose network is private to this stack but is not marked Docker-internal.
The structural test validates the exact required service assertion, forbidden-coupling assertion, required base network/volumes, profile port policy, and THT_WORKSPACE_GIT_REMOTE failure.
All new YAML and shell files were checked by the repository line-ending verifier.

Commit

2595d35682a5200b877acb71764b4eb195a39ea4 — deploy: unify local and server compose stack

Concerns

None for Task 2. Git and connector secret transport remains intentionally outside this base/profile contract and is addressed by the next scoped task.

3.2 KiB Raw Blame History