ThothII/docs/superpowers/plans/2026-07-12-local-and-server-docker-deployment.md

Local and Server Docker Deployment Implementation Plan

For Codex: execute this plan in the current isolated worktree; keep runtime credentials out of Git.

Goal: Configure and verify a Docker Desktop deployment using GLM 5.2 and the existing PSD workspace, while retaining a portable server deployment contract.

Architecture: The base Compose file builds two applications and consumes only generic environment values and a Docker secret bundle. A tracked GLM Pi registry is mounted read-only in the core container. A Git-ignored local override supplies Mac-specific PSD workspace and CA mounts; server operators supply equivalent server runtime values separately.

Tech Stack: Docker Compose v2, Node 22, Python 3.12, Pi RPC, Fastify, nginx.

---

Task 1: Add the non-secret GLM Pi registry

Files:

• Create: deploy/pi/models.json
• Modify: docker/core.Dockerfile
• Modify: compose.yaml
• Test: Compose configuration and Pi model discovery

1. Define the zai/glm-5.2 OpenAI-compatible model registry without a credential.
2. Create the Pi user configuration directory in the core image and mount the registry read-only.
3. Verify that get_available_models returns zai/glm-5.2 when the bundle supplies the model key.

Task 2: Add generic PSD-compatible runtime templates

Files:

• Create: deploy/workspaces/psd.yaml.example
• Create: deploy/compose.psd-local.yaml.example
• Modify: deploy/env.example
• Modify: README.md

1. Define a relative /data/workspaces/psd workspace configuration with external REST DWH/vector adapters.
2. Document required non-secret environment values and the local/server boundary.
3. Keep host paths and credential values out of all tracked files.

Task 3: Materialize local runtime configuration securely

Files (ignored):

• Create: .env
• Create: deploy/secrets/thothii.secrets
• Create: deploy/compose.psd-local.yaml
• Create: deploy/workspaces/psd.yaml

1. Transfer only required values from the existing local configuration without writing them to logs.
2. Set PI_PROVIDER=zai, PI_MODEL=glm-5.2, and the Docker Desktop host gateway for Ollama.
3. Bind-mount the PSD workspace and private CA read-only where appropriate; sessions remain writable.
4. Enforce restricted modes on the secret bundle.

Task 4: Build and verify the Docker deployment

Commands:

• docker compose config --quiet
• docker compose build
• docker compose up -d
• health/API/model/session smoke checks

1. Validate rendered Compose configuration without exposing secrets.
2. Build the core and frontend images.
3. Verify secret mount, core and frontend health, and model listing.
4. Start a PSD session using GLM 5.2 and verify Pi emits a workflow event or gate.
5. Capture sanitized diagnostics and stop only disposable test resources; leave the validated local stack running unless it fails.

Task 5: Record the deployment result

Files:

• Modify: README.md or deployment documentation

1. Record the exact local startup command and server-equivalent configuration steps.
2. State verified endpoints, model, and session-start result without secret values.