services:
  mosaic-agent:
    build:
      context: .
      dockerfile: Containerfile
    image: ${MOSAIC_IMAGE_TAG:?MOSAIC_IMAGE_TAG must be set by scripts/load_release (run via scripts/*.sh)}
    user: "1000:1000"
    environment:
      # Resolved from config.json by scripts/common.sh (load_config).
      # Required: compose fails fast when the launcher did not supply them.
      PI_PROVIDER: ${MOSAIC_PROVIDER:?MOSAIC_PROVIDER must be set by scripts/load_config (run via scripts/*.sh)}
      PI_MODEL: ${MOSAIC_MODEL:?MOSAIC_MODEL must be set by scripts/load_config (run via scripts/*.sh)}
      # Adapter selection (resolved from config execution.adapter; default pi)
      MOSAIC_ADAPTER: ${MOSAIC_ADAPTER:-pi}
      # Mission directives injection point (set by the task runner when the
      # task references a mission; container path of the run snapshot)
      MOSAIC_MISSION_FILE: ${MOSAIC_MISSION_FILE:-}
      # Workspace + capabilities (set by the task runner; M5)
      MOSAIC_WORKSPACE: ${MOSAIC_WORKSPACE:-}
      MOSAIC_TOOLS: ${MOSAIC_TOOLS:-}
      # Persistent named session dir + optional fork source (M6/M11)
      MOSAIC_SESSION_DIR: ${MOSAIC_SESSION_DIR:-}
      MOSAIC_SESSION_FORK: ${MOSAIC_SESSION_FORK:-}
      # Interactive TUI mode + agent identity (M13, set by scripts/agent.sh)
      MOSAIC_INTERACTIVE: ${MOSAIC_INTERACTIVE:-}
      MOSAIC_AGENT_NAME: ${MOSAIC_AGENT_NAME:-}
      MOSAIC_AGENT_ROLE: ${MOSAIC_AGENT_ROLE:-}
      MOSAIC_AGENT_SOUL_FILE: ${MOSAIC_AGENT_SOUL_FILE:-}
      # mock adapter only: verbatim response for deterministic seam tests
      MOSAIC_MOCK_RESPONSE: ${MOSAIC_MOCK_RESPONSE:-}
      # Documented container auth alternative: provider API key via
      # runtime environment variable. Empty by default; when empty Pi
      # falls back to the read-only mounted auth.json credential file.
      ZAI_API_KEY: ${ZAI_API_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
    volumes:
      # Configured runtime state root (from config.json dataRoot).
      - ${MOSAIC_DATA_ROOT:?MOSAIC_DATA_ROOT must be set by scripts/load_config (run via scripts/*.sh)}:/var/lib/mosaic
      # Runtime credential only: pi auth file mounted READ-ONLY.
      # Never copied into the image.
      - ${PI_AUTH_FILE:-/home/jwoltje/.pi/agent/auth.json}:/home/node/.pi/agent/auth.json:ro
    # Headless runs: the request is passed as command args by the launchers
    # (run-task.sh) or defaults inside run-agent.sh (hello/verify). Never a
    # fixed command here - interactive runs (scripts/agent.sh) need no args.