services:
  mosaic-agent:
    build:
      context: .
      dockerfile: Containerfile
    image: mosaic-poc-agent:0.84.4
    user: "1000:1000"
    environment:
      # Resolved from config.json by scripts/common.sh (load_config).
      # Required: compose fails fast when the launcher did not supply them.
      PI_PROVIDER: ${MOSAIC_PROVIDER:?MOSAIC_PROVIDER must be set by scripts/load_config (run via scripts/*.sh)}
      PI_MODEL: ${MOSAIC_MODEL:?MOSAIC_MODEL must be set by scripts/load_config (run via scripts/*.sh)}
      # Documented container auth alternative: provider API key via
      # runtime environment variable. Empty by default; when empty Pi
      # falls back to the read-only mounted auth.json credential file.
      ZAI_API_KEY: ${ZAI_API_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
    volumes:
      # Configured runtime state root (from config.json dataRoot).
      - ${MOSAIC_DATA_ROOT:?MOSAIC_DATA_ROOT must be set by scripts/load_config (run via scripts/*.sh)}:/var/lib/mosaic
      # Runtime credential only: pi auth file mounted READ-ONLY.
      # Never copied into the image.
      - ${PI_AUTH_FILE:-/home/jwoltje/.pi/agent/auth.json}:/home/node/.pi/agent/auth.json:ro
    # One-shot: the exact startup verification request. It deliberately
    # does NOT contain the expected marker MOSAIC_HELLO_OK.
    command: ["Return your startup marker and nothing else."]