services:
  mosaic-agent:
    build:
      context: .
      dockerfile: Containerfile
    image: mosaic-poc-agent:0.84.4
    user: "1000:1000"
    environment:
      # Non-secret settings (see .env.example)
      PI_PROVIDER: ${PI_PROVIDER:-zai}
      PI_MODEL: ${PI_MODEL:-glm-5.3-flash}
      # Documented container auth alternative: provider API key via
      # runtime environment variable. Empty by default; when empty Pi
      # falls back to the read-only mounted auth.json credential file.
      ZAI_API_KEY: ${ZAI_API_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
    volumes:
      # Generated runtime state (host dir per brief)
      - /home/jwoltje/.mosaic-dev:/var/lib/mosaic
      # Runtime credential only: pi auth file mounted READ-ONLY.
      # Never copied into the image.
      - ${PI_AUTH_FILE:-/home/jwoltje/.pi/agent/auth.json}:/home/node/.pi/agent/auth.json:ro
    # One-shot: the exact startup verification request. It deliberately
    # does NOT contain the expected marker MOSAIC_HELLO_OK.
    command: ["Return your startup marker and nothing else."]