docker-compose.yml

services:
  # =============================================================================
  # Anvil local blockchain node (from Foundry)
  # =============================================================================
  # Persists full chain state (blocks + contract storage) via --state.
  # On startup: loads /data/state.json if it exists, otherwise starts fresh.
  # On graceful exit and every --state-interval seconds: dumps to that file.
  # The wrapper maps Docker SIGTERM to SIGINT so Anvil actually dumps instead
  # of being SIGKILLed after the grace period with an empty/stale snapshot.
  # Use COMMONALITY_DATA_DIR to configure where data is stored.
  # Wipe this directory if you want a fresh chain.
  hardhat-node:
    image: ghcr.io/foundry-rs/foundry:latest
    container_name: commonality-hardhat-node
    user: "${UID:-1000}:${GID:-1000}"
    ports:
      - "8545:8545"
    volumes:
      # Persist chain data - set COMMONALITY_DATA_DIR to configure location
      - ${COMMONALITY_DATA_DIR:-./data}/hardhat:/data
      - ./scripts/anvil-docker-entrypoint.sh:/entrypoint.sh:ro
    entrypoint: ["/bin/sh", "/entrypoint.sh"]
    command:
      - "--host"
      - "0.0.0.0"
      - "--state"
      - "/data/state.json"
      - "--state-interval"
      - "15"
    stop_grace_period: 60s
    healthcheck:
      test: ["CMD-SHELL", "cast block-number --rpc-url http://localhost:8545 || exit 1"]
      interval: 2s
      timeout: 5s
      retries: 30
      start_period: 5s
    networks:
      - commonality

  # =============================================================================
  # One-shot service to deploy contracts
  # =============================================================================
  hardhat-deploy:
    image: commonality-hardhat-deploy:dev
    build:
      context: ./hardhat
      dockerfile: Dockerfile
    container_name: commonality-hardhat-deploy
    user: "${UID:-1000}:${GID:-1000}"
    volumes:
      # Mount project root so deploy script can write .env files
      - .:/workspace
      # /app/scripts/deploy-incremental.js imports ../../scripts/deployment-manifest.mjs
      - ./scripts/deployment-manifest.mjs:/scripts/deployment-manifest.mjs:ro
      # Access chain data for deployment
      - ${COMMONALITY_DATA_DIR:-./data}/hardhat:/data
    working_dir: /app
    command: node node_modules/hardhat/internal/cli/bootstrap.js run scripts/deploy-incremental.js --network localhost
    depends_on:
      hardhat-node:
        condition: service_healthy
    environment:
      # Point to the hardhat-node service using Docker networking
      - HARDHAT_NETWORK_URL=http://hardhat-node:8545
      - COMMONALITY_ROOT_DIR=/workspace
      - HOME=/tmp
    networks:
      - commonality

  # =============================================================================
  # Local IPFS node for testing
  # =============================================================================
  # Persists IPFS data to the configured COMMONALITY_DATA_DIR.
  # Wipe this directory if you want a fresh IPFS node (new peer ID).
  ipfs:
    image: ipfs/kubo:latest
    container_name: commonality-ipfs
    user: "${UID:-1000}:${GID:-1000}"
    ports:
      # Keep the operator API reachable by host-side tooling, but never expose it
      # beyond loopback. Browser product code uses PublishedData for writes.
      - "127.0.0.1:5001:5001"  # API port
      - "8080:8080"  # Gateway port
    volumes:
      # Use configurable data directory for IPFS storage
      - ${COMMONALITY_DATA_DIR:-./data}/ipfs:/data/ipfs
    # Custom entrypoint to configure IPFS for path-based gateway (no subdomain redirects).
    # The API intentionally has no browser CORS allowance: only operator tooling
    # and other compose services may write to Kubo.
    entrypoint: >
      sh -c "
      if [ ! -f /data/ipfs/config ]; then ipfs init --profile=test; fi &&
      ipfs config --json Gateway.PublicGateways '{\"localhost\": {\"Paths\": [\"/ipfs\", \"/ipns\"], \"UseSubdomains\": false}}' &&
      ipfs config Addresses.API /ip4/0.0.0.0/tcp/5001 &&
      ipfs config Addresses.Gateway /ip4/0.0.0.0/tcp/8080 &&
      ipfs config --json API.HTTPHeaders '{}' &&
      ipfs daemon --migrate=true
      "
    healthcheck:
      test: ["CMD-SHELL", "ipfs id || exit 1"]
      interval: 2s
      timeout: 5s
      retries: 30
      start_period: 5s
    networks:
      - commonality

  # Permissionless PublishedData calldata → IPFS durability mirror. The deploy
  # file is read after hardhat-deploy finishes so a fresh/recreated chain cannot
  # leave this worker pointed at a stale contract address.
  published-data-ipfs-mirror:
    image: commonality-published-data-ipfs-mirror:dev
    build:
      context: .
      dockerfile: published-data-ipfs-mirror/Dockerfile
    container_name: commonality-published-data-ipfs-mirror
    user: "${UID:-1000}:${GID:-1000}"
    depends_on:
      hardhat-node:
        condition: service_healthy
      hardhat-deploy:
        condition: service_completed_successfully
      ipfs:
        condition: service_healthy
    environment:
      RPC_URL: http://hardhat-node:8545
      CHAIN_ID: "31337"
      IPFS_API_URL: http://ipfs:5001
      DEPLOYMENT_ENV_FILE: /workspace/deployments/localhost.env
      STATE_FILE: /data/published-data-ipfs-mirror.local.json
      CONFIRMATIONS: "0"
    volumes:
      - ./deployments:/workspace/deployments:ro
      - ${COMMONALITY_DATA_DIR:-./data}/published-data-ipfs-mirror:/data
    restart: unless-stopped
    networks:
      - commonality

  # =============================================================================
  # One-shot services to publish each domain SPA to the local IPFS node
  # =============================================================================
  # Each service builds one domain in hash-routing mode and adds the resulting
  # dist/<domain>/ directory to the dockerized IPFS node. scripts/services.sh
  # runs these publishers sequentially to avoid exhausting Docker Desktop memory.
  # CIDs and gateway URLs are written to ./data/ui-ipfs/<domain>/ in the repo
  # workspace so scripts/services.sh can surface them.

  ui-ipfs-publisher-commonality:
    image: commonality-ui-ipfs-publisher:dev
    build:
      context: .
      dockerfile: ui/Dockerfile
    container_name: commonality-ui-ipfs-publisher-commonality
    user: "${UID:-1000}:${GID:-1000}"
    command: ["node", "scripts/publish-ui-to-ipfs.mjs"]
    working_dir: /workspace
    volumes:
      - ./.env:/workspace/.env:ro
      - ./ui/.env:/workspace/ui/.env:ro
      - ./data/ui-ipfs/commonality:/artifacts
    depends_on:
      ipfs:
        condition: service_healthy
      hardhat-deploy:
        condition: service_completed_successfully
    environment:
      - VITE_DOMAIN=commonality
      - VITE_DEFAULT_ALIGNMENT_TRUST_ROOT=${VITE_DEFAULT_ALIGNMENT_TRUST_ROOT:-0x23618e81E3f5cdF7f54C3d65f7FBc0aBf5B21E8f}
      - VITE_HASH_ROUTING=true
      - UI_IPFS_API_URL=http://ipfs:5001
      - UI_IPFS_GATEWAY_URL=http://localhost:8080/ipfs
      - VITE_ROUTER_MODE=hash
      - VITE_IPFS_GATEWAY=http://localhost:8080/ipfs
      - VITE_PLATFORM_API_URL=http://localhost:3001
      - VITE_ETH_RPC_URL=http://127.0.0.1:8545
      - UI_IPFS_ARTIFACT_DIR=/artifacts
      - HOME=/tmp
    networks:
      - commonality

  ui-ipfs-publisher-lazyGiving:
    image: commonality-ui-ipfs-publisher:dev
    build:
      context: .
      dockerfile: ui/Dockerfile
    container_name: commonality-ui-ipfs-publisher-lazyGiving
    user: "${UID:-1000}:${GID:-1000}"
    command: ["node", "scripts/publish-ui-to-ipfs.mjs"]
    working_dir: /workspace
    volumes:
      - ./.env:/workspace/.env:ro
      - ./ui/.env:/workspace/ui/.env:ro
      - ./data/ui-ipfs/lazyGiving:/artifacts
    depends_on:
      ipfs:
        condition: service_healthy
      hardhat-deploy:
        condition: service_completed_successfully
    environment:
      - VITE_DOMAIN=lazyGiving
      - UI_IPFS_API_URL=http://ipfs:5001
      - UI_IPFS_GATEWAY_URL=http://localhost:8080/ipfs
      - VITE_ROUTER_MODE=hash
      - VITE_IPFS_GATEWAY=http://localhost:8080/ipfs
      - VITE_PLATFORM_API_URL=http://localhost:3001
      - VITE_ETH_RPC_URL=http://127.0.0.1:8545
      - UI_IPFS_ARTIFACT_DIR=/artifacts
      - HOME=/tmp
    networks:
      - commonality

  ui-ipfs-publisher-alignment:
    image: commonality-ui-ipfs-publisher:dev
    build:
      context: .
      dockerfile: ui/Dockerfile
    container_name: commonality-ui-ipfs-publisher-alignment
    user: "${UID:-1000}:${GID:-1000}"
    command: ["node", "scripts/publish-ui-to-ipfs.mjs"]
    working_dir: /workspace
    volumes:
      - ./.env:/workspace/.env:ro
      - ./ui/.env:/workspace/ui/.env:ro
      - ./data/ui-ipfs/alignment:/artifacts
    depends_on:
      ipfs:
        condition: service_healthy
      hardhat-deploy:
        condition: service_completed_successfully
    environment:
      - VITE_DOMAIN=alignment
      - UI_IPFS_API_URL=http://ipfs:5001
      - UI_IPFS_GATEWAY_URL=http://localhost:8080/ipfs
      - VITE_ROUTER_MODE=hash
      - VITE_IPFS_GATEWAY=http://localhost:8080/ipfs
      - VITE_PLATFORM_API_URL=http://localhost:3001
      - VITE_ETH_RPC_URL=http://127.0.0.1:8545
      - UI_IPFS_ARTIFACT_DIR=/artifacts
      - HOME=/tmp
    networks:
      - commonality

  ui-ipfs-publisher-content-funding:
    image: commonality-ui-ipfs-publisher:dev
    build:
      context: .
      dockerfile: ui/Dockerfile
    container_name: commonality-ui-ipfs-publisher-content-funding
    user: "${UID:-1000}:${GID:-1000}"
    command: ["node", "scripts/publish-ui-to-ipfs.mjs"]
    working_dir: /workspace
    volumes:
      - ./.env:/workspace/.env:ro
      - ./ui/.env:/workspace/ui/.env:ro
      - ./data/ui-ipfs/content-funding:/artifacts
    depends_on:
      ipfs:
        condition: service_healthy
      hardhat-deploy:
        condition: service_completed_successfully
    environment:
      - VITE_DOMAIN=content-funding
      - UI_IPFS_API_URL=http://ipfs:5001
      - UI_IPFS_GATEWAY_URL=http://localhost:8080/ipfs
      - VITE_ROUTER_MODE=hash
      - VITE_IPFS_GATEWAY=http://localhost:8080/ipfs
      - VITE_PLATFORM_API_URL=http://localhost:3001
      - VITE_ETH_RPC_URL=http://127.0.0.1:8545
      - UI_IPFS_ARTIFACT_DIR=/artifacts
      - HOME=/tmp
    networks:
      - commonality

  ui-ipfs-publisher-civility:
    image: commonality-ui-ipfs-publisher:dev
    build:
      context: .
      dockerfile: ui/Dockerfile
    container_name: commonality-ui-ipfs-publisher-civility
    user: "${UID:-1000}:${GID:-1000}"
    command: ["node", "scripts/publish-ui-to-ipfs.mjs"]
    working_dir: /workspace
    volumes:
      - ./.env:/workspace/.env:ro
      - ./ui/.env:/workspace/ui/.env:ro
      - ./data/ui-ipfs/civility:/artifacts
    depends_on:
      ipfs:
        condition: service_healthy
      hardhat-deploy:
        condition: service_completed_successfully
    environment:
      - VITE_DOMAIN=civility
      - UI_IPFS_API_URL=http://ipfs:5001
      - UI_IPFS_GATEWAY_URL=http://localhost:8080/ipfs
      - VITE_ROUTER_MODE=hash
      - VITE_IPFS_GATEWAY=http://localhost:8080/ipfs
      - VITE_PLATFORM_API_URL=http://localhost:3001
      - VITE_ETH_RPC_URL=http://127.0.0.1:8545
      - UI_IPFS_ARTIFACT_DIR=/artifacts
      - HOME=/tmp
    networks:
      - commonality

  ui-ipfs-publisher-common-sense-majority:
    image: commonality-ui-ipfs-publisher:dev
    build:
      context: .
      dockerfile: ui/Dockerfile
    container_name: commonality-ui-ipfs-publisher-common-sense-majority
    user: "${UID:-1000}:${GID:-1000}"
    command: ["node", "scripts/publish-ui-to-ipfs.mjs"]
    working_dir: /workspace
    volumes:
      - ./.env:/workspace/.env:ro
      - ./ui/.env:/workspace/ui/.env:ro
      - ./data/ui-ipfs/common-sense-majority:/artifacts
    depends_on:
      ipfs:
        condition: service_healthy
      hardhat-deploy:
        condition: service_completed_successfully
    environment:
      - VITE_DOMAIN=common-sense-majority
      - UI_IPFS_API_URL=http://ipfs:5001
      - UI_IPFS_GATEWAY_URL=http://localhost:8080/ipfs
      - VITE_ROUTER_MODE=hash
      - VITE_IPFS_GATEWAY=http://localhost:8080/ipfs
      - VITE_PLATFORM_API_URL=http://localhost:3001
      - VITE_ETH_RPC_URL=http://127.0.0.1:8545
      - UI_IPFS_ARTIFACT_DIR=/artifacts
      - HOME=/tmp
    networks:
      - commonality

  ui-ipfs-publisher-tally:
    image: commonality-ui-ipfs-publisher:dev
    build:
      context: .
      dockerfile: ui/Dockerfile
    container_name: commonality-ui-ipfs-publisher-tally
    user: "${UID:-1000}:${GID:-1000}"
    command: ["node", "scripts/publish-ui-to-ipfs.mjs"]
    working_dir: /workspace
    volumes:
      - ./.env:/workspace/.env:ro
      - ./ui/.env:/workspace/ui/.env:ro
      - ./data/ui-ipfs/tally:/artifacts
    depends_on:
      ipfs:
        condition: service_healthy
      hardhat-deploy:
        condition: service_completed_successfully
    environment:
      - VITE_DOMAIN=tally
      - UI_IPFS_API_URL=http://ipfs:5001
      - UI_IPFS_GATEWAY_URL=http://localhost:8080/ipfs
      - VITE_ROUTER_MODE=hash
      - VITE_IPFS_GATEWAY=http://localhost:8080/ipfs
      - VITE_PLATFORM_API_URL=http://localhost:3001
      - VITE_ETH_RPC_URL=http://127.0.0.1:8545
      - UI_IPFS_ARTIFACT_DIR=/artifacts
      - HOME=/tmp
    networks:
      - commonality

  ui-ipfs-publisher-conceptspace:
    image: commonality-ui-ipfs-publisher:dev
    build:
      context: .
      dockerfile: ui/Dockerfile
    container_name: commonality-ui-ipfs-publisher-conceptspace
    user: "${UID:-1000}:${GID:-1000}"
    command: ["node", "scripts/publish-ui-to-ipfs.mjs"]
    working_dir: /workspace
    volumes:
      - ./.env:/workspace/.env:ro
      - ./ui/.env:/workspace/ui/.env:ro
      - ./data/ui-ipfs/conceptspace:/artifacts
    depends_on:
      ipfs:
        condition: service_healthy
      hardhat-deploy:
        condition: service_completed_successfully
    environment:
      - VITE_DOMAIN=conceptspace
      - UI_IPFS_API_URL=http://ipfs:5001
      - UI_IPFS_GATEWAY_URL=http://localhost:8080/ipfs
      - VITE_ROUTER_MODE=hash
      - VITE_IPFS_GATEWAY=http://localhost:8080/ipfs
      - VITE_PLATFORM_API_URL=http://localhost:3001
      - VITE_ETH_RPC_URL=http://127.0.0.1:8545
      - UI_IPFS_ARTIFACT_DIR=/artifacts
      - HOME=/tmp
    networks:
      - commonality

  # Commonality LLM helpers: statement suggestions + safety filter (Grok 4.5 / xAI).
  # Graceful without an API key (templates + heuristics). Key comes from root .env
  # (via .env.secrets + setup-env.sh) or the process environment.
  #
  # Always started with the local stack (services.sh / deploy-commonality.sh).
  # - Docker Commonality nginx proxies /api/cause-assist/ → cause-assist:3002
  # - Host Vite (npm run commonality:dev) proxies to loopback :3002
  cause-assist:
    image: commonality-cause-assist:dev
    build:
      context: .
      dockerfile: cause-assist/Dockerfile
    container_name: commonality-cause-assist
    ports:
      # Loopback only: Vite on the host needs this; do not expose beyond the machine.
      - "127.0.0.1:3002:3002"
    env_file:
      - path: .env
        required: false
    environment:
      PORT: "3002"
      XAI_API_KEY: ${XAI_API_KEY:-}
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
      CAUSE_ASSIST_API_BASE_URL: ${CAUSE_ASSIST_API_BASE_URL:-https://openrouter.ai/api/v1}
      CAUSE_ASSIST_SUGGEST_MODEL: ${CAUSE_ASSIST_SUGGEST_MODEL:-deepseek/deepseek-v4-flash-0731}
      CAUSE_ASSIST_SAFETY_MODEL: ${CAUSE_ASSIST_SAFETY_MODEL:-deepseek/deepseek-v4-flash-0731}
      CAUSE_ASSIST_IMPLICATION_MODEL: ${CAUSE_ASSIST_IMPLICATION_MODEL:-deepseek/deepseek-v4-flash-0731}
      CAUSE_ASSIST_COHERENCE_MODEL: ${CAUSE_ASSIST_COHERENCE_MODEL:-deepseek/deepseek-v4-flash-0731}
      # Public identity only. The private key lives exclusively in coherence-badge-worker.
      CAUSE_ASSIST_COHERENCE_ATTESTER_ADDRESS: ${CAUSE_ASSIST_COHERENCE_ATTESTER_ADDRESS:-0xa0Ee7A142d267C1f36714E4a8F75612F20a79720}
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3002/health >/dev/null || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 10s
    networks:
      - commonality
    restart: unless-stopped

  # Trusted roster coherence worker. It alone holds the operator hot key and
  # watches real RefUpdated logs; no browser-reachable route can request a write.
  coherence-badge-worker:
    image: commonality-coherence-badge-worker:dev
    build:
      context: .
      dockerfile: coherence-badge-worker/Dockerfile
    container_name: commonality-coherence-badge-worker
    user: "${UID:-1000}:${GID:-1000}"
    depends_on:
      hardhat-node:
        condition: service_healthy
      hardhat-deploy:
        condition: service_completed_successfully
      ipfs:
        condition: service_healthy
    env_file:
      - path: .env
        required: false
    environment:
      RPC_URL: http://hardhat-node:8545
      CHAIN_ID: "31337"
      DEPLOYMENT_ENV_FILE: /workspace/deployments/localhost.env
      STATE_FILE: /data/coherence-badge-worker.local.json
      CONFIRMATIONS: "0"
      CAUSE_ASSIST_COHERENCE_ATTESTER_PRIVATE_KEY: ${CAUSE_ASSIST_COHERENCE_ATTESTER_PRIVATE_KEY:-0x2a871d0798f97d79848a013d4936a73bf4cc922c825d33c1cf7073dff6d409c6}
      XAI_API_KEY: ${XAI_API_KEY:-}
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
      CAUSE_ASSIST_API_BASE_URL: ${CAUSE_ASSIST_API_BASE_URL:-https://openrouter.ai/api/v1}
      CAUSE_ASSIST_COHERENCE_MODEL: ${CAUSE_ASSIST_COHERENCE_MODEL:-deepseek/deepseek-v4-flash-0731}
      CAUSE_ASSIST_IPFS_GATEWAY_URL: http://ipfs:8080/ipfs
      EVENT_CACHE_URL: http://indexer:42069
    volumes:
      - ./deployments:/workspace/deployments:ro
      - ${COMMONALITY_DATA_DIR:-./data}/coherence-badge-worker:/data
    restart: unless-stopped
    networks:
      - commonality

  # Bootstrap spam-filter root for Commonality. It admits wallets that publish
  # project vouches and revokes any address added to the operator denylist.
  alignment-trust-bootstrap:
    image: commonality-alignment-trust-bootstrap:dev
    build:
      context: .
      dockerfile: alignment-trust-bootstrap/Dockerfile
    container_name: commonality-alignment-trust-bootstrap
    user: "${UID:-1000}:${GID:-1000}"
    depends_on:
      hardhat-node:
        condition: service_healthy
      hardhat-deploy:
        condition: service_completed_successfully
    env_file:
      - path: .env
        required: false
    environment:
      RPC_URL: http://hardhat-node:8545
      CHAIN_ID: "31337"
      DEPLOYMENT_ENV_FILE: /workspace/deployments/localhost.env
      STATE_FILE: /data/state.local.json
      DENYLIST_FILE: /data/denylist.txt
      PAUSE_FILE: /data/PAUSED
      CONFIRMATIONS: "0"
      ALIGNMENT_TRUST_BOOTSTRAP_PRIVATE_KEY: ${ALIGNMENT_TRUST_BOOTSTRAP_PRIVATE_KEY:-0xdbda1821b80551c9d65939329250298aa3472ba22feea921c0cf5d620ea67b97}
    volumes:
      - ./deployments:/workspace/deployments:ro
      - ${COMMONALITY_DATA_DIR:-./data}/alignment-trust-bootstrap:/data
    restart: unless-stopped
    networks:
      - commonality

  # Commonality — nginx static SPA (core founder surface).
  # Contract addresses / RPC URLs are injected at container start into config.json.
  # Prefer ./scripts/deploy-commonality.sh or services.sh (loads .env + localhost.env).
  # Statement content publish uses PublishedData (VITE_PUBLISHED_DATA_CONTRACT_ADDRESS).
  commonality-ui:
    image: commonality-ui:dev
    build:
      context: .
      dockerfile: commonality-ui/Dockerfile
      args:
        VITE_WALLETCONNECT_PROJECT_ID: ${VITE_WALLETCONNECT_PROJECT_ID:-}
    container_name: commonality-ui
    ports:
      - "${COMMONALITY_UI_PORT:-8090}:80"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      COMMONALITY_ENVIRONMENT: ${COMMONALITY_ENVIRONMENT:-local}
      # host:port override for nginx → indexer proxy (see docker-entrypoint.d/30-indexer-upstream.sh)
      INDEXER_UPSTREAM: ${INDEXER_UPSTREAM:-}
      VITE_EVENT_CACHE_URL: ${VITE_EVENT_CACHE_URL:-}
      VITE_IPFS_GATEWAY: ${VITE_IPFS_GATEWAY:-http://localhost:8080/ipfs}
      VITE_PLATFORM_API_URL: ${VITE_PLATFORM_API_URL:-http://localhost:3001}
      VITE_IMPLICATION_ATTESTER_URL: ${VITE_IMPLICATION_ATTESTER_URL:-}
      VITE_MAINNET_RPC_URL: ${VITE_MAINNET_RPC_URL:-}
      VITE_ETH_RPC_URL: ${VITE_ETH_RPC_URL:-http://127.0.0.1:8545}
      VITE_BELIEFS_CONTRACT_ADDRESS: ${VITE_BELIEFS_CONTRACT_ADDRESS:-}
      VITE_IMPLICATIONS_CONTRACT_ADDRESS: ${VITE_IMPLICATIONS_CONTRACT_ADDRESS:-}
      VITE_ASSURANCE_CONTRACT_FACTORY_ADDRESS: ${VITE_ASSURANCE_CONTRACT_FACTORY_ADDRESS:-}
      VITE_ERC1155_FACTORY_ADDRESS: ${VITE_ERC1155_FACTORY_ADDRESS:-}
      VITE_DELEGATABLE_NOTES_CONTRACT_ADDRESS: ${VITE_DELEGATABLE_NOTES_CONTRACT_ADDRESS:-}
      VITE_RECURRING_PLEDGES_CONTRACT_ADDRESS: ${VITE_RECURRING_PLEDGES_CONTRACT_ADDRESS:-}
      VITE_NOTE_INTENT_CONTRACT_ADDRESS: ${VITE_NOTE_INTENT_CONTRACT_ADDRESS:-}
      VITE_ALIGNMENT_ATTESTATIONS_CONTRACT_ADDRESS: ${VITE_ALIGNMENT_ATTESTATIONS_CONTRACT_ADDRESS:-}
      VITE_MUTABLE_REF_UPDATER_CONTRACT_ADDRESS: ${VITE_MUTABLE_REF_UPDATER_CONTRACT_ADDRESS:-}
      VITE_TRUST_REGISTRY_CONTRACT_ADDRESS: ${VITE_TRUST_REGISTRY_CONTRACT_ADDRESS:-}
      VITE_DEFAULT_ALIGNMENT_TRUST_ROOT: ${VITE_DEFAULT_ALIGNMENT_TRUST_ROOT:-0x23618e81E3f5cdF7f54C3d65f7FBc0aBf5B21E8f}
      VITE_NUDGE_PUBLICATIONS_CONTRACT_ADDRESS: ${VITE_NUDGE_PUBLICATIONS_CONTRACT_ADDRESS:-}
      VITE_DEFAULT_NUDGERS: ${VITE_DEFAULT_NUDGERS:-}
      VITE_PUBLISHED_DATA_CONTRACT_ADDRESS: ${VITE_PUBLISHED_DATA_CONTRACT_ADDRESS:-}
      VITE_CONTENT_REGISTRY_ADDRESS: ${VITE_CONTENT_REGISTRY_ADDRESS:-}
      VITE_BENEFICIARY_IDENTITY_ADDRESS: ${VITE_BENEFICIARY_IDENTITY_ADDRESS:-}
      VITE_BENEFICIARY_REGISTRY_ADDRESS: ${VITE_BENEFICIARY_REGISTRY_ADDRESS:-}
      VITE_BENEFICIARY_ESCROW_ADDRESS: ${VITE_BENEFICIARY_ESCROW_ADDRESS:-}
      VITE_CREATOR_CONTRACT_FACTORY_ADDRESS: ${VITE_CREATOR_CONTRACT_FACTORY_ADDRESS:-}
      VITE_PROSPECTIVE_CONTENT_ROUND_FACTORY_ADDRESS: ${VITE_PROSPECTIVE_CONTENT_ROUND_FACTORY_ADDRESS:-}
      VITE_PROJECT_FACTORY_CONTRACT_ADDRESS: ${VITE_PROJECT_FACTORY_CONTRACT_ADDRESS:-}
      VITE_PAYMENT_TOKEN_ADDRESS: ${VITE_PAYMENT_TOKEN_ADDRESS:-}
      VITE_CHAIN_ID: ${VITE_CHAIN_ID:-31337}
      VITE_PAYMENT_TOKEN_SYMBOL: ${VITE_PAYMENT_TOKEN_SYMBOL:-}
      VITE_PAYMENT_TOKEN_DECIMALS: ${VITE_PAYMENT_TOKEN_DECIMALS:-}
      VITE_COMMONALITY_URL: ${VITE_COMMONALITY_URL:-http://commonality.localhost:8088/#/}
      VITE_LAZYGIVING_URL: ${VITE_LAZYGIVING_URL:-http://lazygiving.localhost:8088/#/}
      VITE_ALIGNMENT_URL: ${VITE_ALIGNMENT_URL:-http://alignment.localhost:8088/#/}
      VITE_TALLY_URL: ${VITE_TALLY_URL:-http://tally.localhost:8088/#/}
      VITE_CONTENT_FUNDING_URL: ${VITE_CONTENT_FUNDING_URL:-http://content-funding.localhost:8088/#/}
      VITE_CIVILITY_URL: ${VITE_CIVILITY_URL:-http://civility.localhost:8088/#/}
      VITE_COMMON_SENSE_MAJORITY_URL: ${VITE_COMMON_SENSE_MAJORITY_URL:-http://common-sense-majority.localhost:8088/#/}
      VITE_CONCEPTSPACE_URL: ${VITE_CONCEPTSPACE_URL:-http://conceptspace.localhost:8088/#/}
    depends_on:
      cause-assist:
        condition: service_healthy
      alignment-trust-bootstrap:
        condition: service_started
    networks:
      - commonality
    restart: unless-stopped

  ui-local-gateway:
    image: node:24-alpine
    container_name: commonality-ui-local-gateway
    user: "${UID:-1000}:${GID:-1000}"
    command: ["node", "scripts/local-ui-gateway.mjs"]
    working_dir: /workspace
    volumes:
      - ./scripts/local-ui-gateway.mjs:/workspace/scripts/local-ui-gateway.mjs:ro
      - ./scripts/ui-domains.mjs:/workspace/scripts/ui-domains.mjs:ro
      - ./data/ui-ipfs:/workspace/data/ui-ipfs:ro
      - ./fake-data-generation/output:/workspace/fake-data-generation/output:ro
    # Publishers are started by scripts/services.sh for LOCAL_UI_DOMAINS.
    # Do not wait on every funding site here: a Conceptspace-only start must
    # be able to serve the domains that were actually published.
    depends_on:
      ipfs:
        condition: service_healthy
    environment:
      - PORT=8088
      - UI_IPFS_ARTIFACT_ROOT=/workspace/data/ui-ipfs
      - UI_IPFS_GATEWAY_INTERNAL=http://ipfs:8080/ipfs
      - UI_INDEXER_INTERNAL=http://indexer:42069
      - TEST_DATA_ARTIFACT_ROOT=/workspace/fake-data-generation/output/test-data
    ports:
      - "8088:8088"
    networks:
      - commonality

  # =============================================================================
  # Ponder indexer service
  # =============================================================================
  # Persists indexer sync state to the configured COMMONALITY_DATA_DIR.
  # Wipe this directory if you want to reindex from scratch.
  indexer:
    image: commonality-indexer:dev
    build:
      context: ./indexer
      dockerfile: Dockerfile
    container_name: commonality-indexer
    user: "${UID:-1000}:${GID:-1000}"
    ports:
      - "42069:42069"
    volumes:
      # Mount project root to access .env file
      - .:/workspace
      # Persist indexer database and sync state
      - ${COMMONALITY_DATA_DIR:-./data}/ponder:/app/.ponder
    working_dir: /app
    depends_on:
      hardhat-node:
        condition: service_healthy
      ipfs:
        condition: service_healthy
      hardhat-deploy:
        condition: service_completed_successfully
    environment:
      # Point to hardhat-node service
      - PONDER_RPC_URL_31337=http://hardhat-node:8545
      # Use ephemeral database if PONDER_EPHEMERAL=true is set
      - PONDER_EPHEMERAL=${PONDER_EPHEMERAL:-false}
      # all (default) indexes both families. conceptspace uses ponder.conceptspace.config.ts.
      - INDEXER_CONTRACTS=${INDEXER_CONTRACTS:-all}
      # Point to local IPFS gateway
      - IPFS_GATEWAY=http://ipfs:8080/ipfs
      - IPFS_API=http://ipfs:5001
      - HOME=/tmp
      # Ponder starts Vite/Chokidar. This host's inotify instance cap is 128,
      # and watching /app exhausts it (EMFILE). Match the Render blueprint.
      - CHOKIDAR_USEPOLLING=true
    healthcheck:
      test: |
        curl -f -X POST -H "Content-Type: application/json" \
        --data '{"query":"{ _meta { block { number } } }"}' \
        http://localhost:42069/graphql || exit 1
      interval: 2s
      timeout: 10s
      retries: 30
      start_period: 10s
    networks:
      - commonality

  # =============================================================================
  # Content-funding platform API service
  # =============================================================================
  # Exposes the channel-resolution/content-validation/challenge API on
  # http://localhost:3001 for local content-funding development.
  platform-api-service:
    image: commonality-platform-api-service:dev
    build:
      context: .
      dockerfile: platform-api-service/Dockerfile
    container_name: commonality-platform-api-service
    user: "${UID:-1000}:${GID:-1000}"
    ports:
      - "3001:3001"
    depends_on:
      hardhat-node:
        condition: service_healthy
    environment:
      - PORT=3001
      - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-*}
      - COMMONALITY_TWITTER_HANDLE=${COMMONALITY_TWITTER_HANDLE:-@commonality}
      - CLAIM_PAGE_BASE_URL=${CLAIM_PAGE_BASE_URL:-}
      - X_API_BEARER_TOKEN=${X_API_BEARER_TOKEN:-}
      - X_API_BASE_URL=${X_API_BASE_URL:-https://api.x.com}
      - YOUTUBE_API_KEY=${YOUTUBE_API_KEY:-}
      - YOUTUBE_API_BASE_URL=${YOUTUBE_API_BASE_URL:-https://www.googleapis.com/youtube/v3}
      - VERIFIER_PRIVATE_KEY=${VERIFIER_PRIVATE_KEY:-}
      - ETHEREUM_RPC_URL=${ETHEREUM_RPC_URL:-http://hardhat-node:8545}
      - BENEFICIARY_IDENTITY_ADDRESS=${BENEFICIARY_IDENTITY_ADDRESS:-}
      - BENEFICIARY_REGISTRY_ADDRESS=${BENEFICIARY_REGISTRY_ADDRESS:-}
      - BENEFICIARY_VERIFIER_ADDRESS=${BENEFICIARY_VERIFIER_ADDRESS:-}
      - CHAIN_ID=${CHAIN_ID:-31337}
      - SUBMIT_VERIFICATION_TX=${SUBMIT_VERIFICATION_TX:-false}
      - HOME=/tmp
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3001/health || exit 1"]
      interval: 2s
      timeout: 5s
      retries: 30
      start_period: 5s
    networks:
      - commonality

# =============================================================================
  # Bundled AI service host (Bundle A — Attesters)
  # =============================================================================
  # Runs the canonical implication-attester and content-attester together under
  # one shared Express listener for service-bundling.
  service-host-attesters:
    image: commonality-service-host:dev
    build:
      context: .
      dockerfile: service-host/Dockerfile
    container_name: commonality-service-host-attesters
    user: "${UID:-1000}:${GID:-1000}"
    ports:
      - "3006:3000"
    depends_on:
      hardhat-node:
        condition: service_healthy
      ipfs:
        condition: service_healthy
      hardhat-deploy:
        condition: service_completed_successfully
    environment:
      - SERVICE_HOST_PORT=3000
      # all (default) is the combined host. conceptspace refuses funding instance names.
      - SERVICE_HOST_CAPABILITY=${SERVICE_HOST_CAPABILITY:-all}
      - ETHEREUM_RPC_URL=http://hardhat-node:8545
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
      - OPENROUTER_MODEL=deepseek/deepseek-v4-flash-0731
      - IPFS_API=http://ipfs:5001
      - IPFS_GATEWAY=http://ipfs:8080
      - IMPLICATION_ATTESTER_PRIVATE_KEY=${IMPLICATION_ATTESTER_PRIVATE_KEY:-0x47e179ec197488593b187f80a00eb0da91f1b9d0b13f8733639f19c30a34926a}
      - IMPLICATION_ATTESTER_PAYMENT_ADDRESS=${IMPLICATION_ATTESTER_PAYMENT_ADDRESS:-0x15d34AAf54267DB7D7c367839AAf71A00a2C6A65}
      - IMPLICATION_ATTESTER_TRUSTED_FINDER_KEY=${IMPLICATION_ATTESTER_TRUSTED_FINDER_KEY:-local-finder-key}
      - IMPLICATIONS_CONTRACT_ADDRESS=${IMPLICATIONS_CONTRACT_ADDRESS:-}
      - CONTENT_ATTESTER_PRIVATE_KEY=${CONTENT_ATTESTER_PRIVATE_KEY:-0x8b3a350cf5c34c9194ca85829a2df0ec3153be0318b5e2d3348e872092edffba}
      - CONTENT_ATTESTER_PAYMENT_ADDRESS=${CONTENT_ATTESTER_PAYMENT_ADDRESS:-0x9965507D1a55bcC2695C58ba16FB37d819B0A4dc}
      - CONTENT_ATTESTER_TRUSTED_FINDER_KEY=${CONTENT_ATTESTER_TRUSTED_FINDER_KEY:-local-finder-key}
      - CONTENT_ATTESTER_NAME=perspective-neutral
      - CONTENT_ATTESTER_PROMPT_TEMPLATE_FILE=/app/services/content-attester/prompts/perspective-neutral.md
      # Off by default locally: content-attester requires ALIGNMENT_TOPIC_STATEMENT_CID,
      # which is a *published statement* CID rather than a deploy artifact, so a fresh
      # local chain has none and the whole bundle refuses to boot. That would take the
      # implication-attester down with it, and the bridge-cluster editor needs that one.
      # Set both vars to run it locally: CONTENT_ATTESTER_ENABLED=true.
      - CONTENT_ATTESTER_ENABLED=${CONTENT_ATTESTER_ENABLED:-false}
      - ALIGNMENT_ATTESTATIONS_CONTRACT_ADDRESS=${ALIGNMENT_ATTESTATIONS_CONTRACT_ADDRESS:-}
      - ALIGNMENT_TOPIC_STATEMENT_CID=${ALIGNMENT_TOPIC_STATEMENT_CID:-}
      - ETH_USD_PRICE=3000
      - GAS_PRICE_MULTIPLIER=1.2
      - SERVICE_MARGIN_PERCENT=20
      - IMPLICATION_ATTESTER_ESTIMATED_INPUT_TOKENS=1000
      - IMPLICATION_ATTESTER_ESTIMATED_OUTPUT_TOKENS=200
      - CONTENT_ATTESTER_ESTIMATED_INPUT_TOKENS=2500
      - CONTENT_ATTESTER_ESTIMATED_OUTPUT_TOKENS=400
      - RATE_LIMIT_WINDOW_MS=60000
      - RATE_LIMIT_MAX_REQUESTS=10
      - IMPLICATION_FINDER_ENABLED=false
      - CONTENT_FINDER_ENABLED=false
      - IMPLICATION_GRAPH_NUDGER_ENABLED=false
      - BRIDGE_CREATOR_ENABLED=false
      - EXPLORER_CURATOR_ENABLED=false
      - HOME=/tmp
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3000/health || exit 1"]
      interval: 2s
      timeout: 5s
      retries: 30
      start_period: 5s
    networks:
      - commonality

  # =============================================================================
  # Bundled AI service host (Bundle B — Workers)
  # =============================================================================
  # Runs both finders plus all three nudgers under one supervised host process.
  service-host-workers:
    image: commonality-service-host:dev
    build:
      context: .
      dockerfile: service-host/Dockerfile
    container_name: commonality-service-host-workers
    user: "${UID:-1000}:${GID:-1000}"
    ports:
      - "3005:3000"
    depends_on:
      service-host-attesters:
        condition: service_healthy
      hardhat-node:
        condition: service_healthy
      ipfs:
        condition: service_healthy
      indexer:
        condition: service_healthy
      platform-api-service:
        condition: service_healthy
    environment:
      - SERVICE_HOST_PORT=3000
      - SERVICE_HOST_CAPABILITY=${SERVICE_HOST_CAPABILITY:-all}
      - ETHEREUM_RPC_URL=http://hardhat-node:8545
      - INDEXER_URL=http://indexer:42069
      - IPFS_API=http://ipfs:5001
      - IPFS_GATEWAY=http://ipfs:8080
      - IPFS_GATEWAY_URL=http://ipfs:8080
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
      - OPENROUTER_MODEL=deepseek/deepseek-v4-flash-0731
      - NUDGE_PUBLICATIONS_CONTRACT_ADDRESS=${NUDGE_PUBLICATIONS_CONTRACT_ADDRESS:-}
      - PLATFORM_API_URL=http://platform-api-service:3000
      - CONTENT_FINDER_PLATFORM_API_URL=http://platform-api-service:3000
      - CONTENT_FINDER_SUBMISSIONS_API_URL=http://platform-api-service:3000/content-submission
      - CONTENT_FINDER_ATTESTER_URL=http://service-host-attesters:3000/content-attester
      - CONTENT_FINDER_ATTESTER_FINDER_KEY=${CONTENT_FINDER_ATTESTER_FINDER_KEY:-local-finder-key}
      - IMPLICATION_FINDER_EVENT_CACHE_URL=http://indexer:42069
      - IMPLICATION_FINDER_ATTESTER_URL=http://service-host-attesters:3000/implication-attester
      - IMPLICATION_FINDER_ATTESTER_FINDER_KEY=${IMPLICATION_FINDER_ATTESTER_FINDER_KEY:-local-finder-key}
      - BELIEFS_CONTRACT_ADDRESS=${BELIEFS_CONTRACT_ADDRESS:-}
      - IMPLICATIONS_CONTRACT_ADDRESS=${IMPLICATIONS_CONTRACT_ADDRESS:-}
      - IMPLICATION_GRAPH_NUDGER_PRIVATE_KEY=${IMPLICATION_GRAPH_NUDGER_PRIVATE_KEY:-0x92db14e403b83dfe3df233f83dfa3a0d7096f21ca9b0d6d6b8d88b2b4ec1564e}
      - BRIDGE_CREATOR_PRIVATE_KEY=${BRIDGE_CREATOR_PRIVATE_KEY:-0x4bbbf85ce3377467afe5d46f804f221813b2bb87f24d81f60f1fcdbf7cbf4356}
      - EXPLORER_CURATOR_PRIVATE_KEY=${EXPLORER_CURATOR_PRIVATE_KEY:-0xdbda1821b80551c9d65939329250298aa3472ba22feea921c0cf5d620ea67b97}
      - IMPLICATION_ATTESTER_ENABLED=false
      - CONTENT_ATTESTER_ENABLED=false
      - HOME=/tmp
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3000/health || exit 1"]
      interval: 2s
      timeout: 5s
      retries: 30
      start_period: 5s
    networks:
      - commonality

  # Seed Christianity cause mediator (featured anchors for Commonality).
  # Same image as service-host; runs the bridge-creator HTTP app with the
  # christian-secular-conservative example artifact. Browser fetches
  # http://127.0.0.1:3011/anchors?featured=true from the published roster.
  christian-bridge-creator:
    image: commonality-service-host:dev
    build:
      context: .
      dockerfile: service-host/Dockerfile
    container_name: commonality-christian-bridge-creator
    user: "${UID:-1000}:${GID:-1000}"
    command: ["node", "services/bridge-creator/dist/index.js"]
    ports:
      - "127.0.0.1:3011:3011"
    depends_on:
      hardhat-node:
        condition: service_healthy
    environment:
      - PORT=3011
      - HOME=/tmp
      - BRIDGE_CREATOR_MEDIATOR_CONFIG_PATH=/app/services/bridge-creator/config/christian-secular-conservative.example.json
      - CHRISTIAN_BRIDGE_MEDIATOR_PRIVATE_KEY=${CHRISTIAN_BRIDGE_MEDIATOR_PRIVATE_KEY:-0xdbda1821b80551c9d65939329250298aa3472ba22feea921c0cf5d620ea67b97}
      - ETHEREUM_RPC_URL=http://hardhat-node:8545
      - INDEXER_URL=http://indexer:42069
      - IPFS_API=http://ipfs:5001
      - IPFS_GATEWAY=http://ipfs:8080
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-sk-not-needed-for-featured-anchors}
      - NUDGE_PUBLICATIONS_CONTRACT_ADDRESS=${NUDGE_PUBLICATIONS_CONTRACT_ADDRESS:-0x0000000000000000000000000000000000000001}
      - BRIDGE_CREATOR_TICK_INTERVAL_MS=86400000
      - BRIDGE_CREATOR_PUBLIC_BASE_URL=http://127.0.0.1:3011
    healthcheck:
      test: ["CMD-SHELL", "curl -f 'http://127.0.0.1:3011/anchors?featured=true' || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 10s
    networks:
      - commonality
    restart: unless-stopped

  # =============================================================================
  # Data Storage
# =============================================================================
# All persistent data is stored in directories under COMMONALITY_DATA_DIR
# (defaults to ./data in the project root).
#
  # Directory structure:
#   ${COMMONALITY_DATA_DIR}/
#     ├── hardhat/          # Blockchain chain data
#     ├── ipfs/             # IPFS node data
#     └── ponder/           # Indexer sync state and database
#
# Published UI CID + gateway URL artifacts are written to ./data/ui-ipfs/<domain>/.
#
# To use a different location (e.g., for integration tests):
#   export COMMONALITY_DATA_DIR=/tmp/commonality-integration-tests-data
#   docker-compose up -d
#
# To wipe all data and start fresh:
#   rm -rf ${COMMONALITY_DATA_DIR:-./data}
#   docker-compose up -d
#
# Or use the provided scripts:
#   ./scripts/services.sh --start  # Local development (uses ./data)
#   ./scripts/run-integration-tests.sh  # Integration tests (uses /tmp/commonality-it)

networks:
  commonality:
    driver: bridge