unoverse 0.1.111 → 0.1.112

package/operator/docker-compose.yml

@@ -0,0 +1,318 @@
+# =============================================================================
+# GRAVITY PLATFORM DOCKER COMPOSE
+# =============================================================================
+#
+# LAYER 1: CORE PLATFORM (Pre-compiled via GitHub Actions → DOCR)
+#   - unoverse (the platform runtime — engine in-process + node plane + native MCP),
+#     canvas, umap, memory. Code protected, pulled as images.
+#
+# LAYER 2: PLATFORM-DEV MOUNTS (monorepo only — sync-starter strips them)
+#   - apps/unoverse/nodes    — node manifests
+#   - apps/unoverse/rx       — design (components, templates, styles)
+#   - apps/unoverse/prompts  — behavior (skills + blocks)
+#   In a STARTER/customer universe these folders do not exist: authoring is
+#   Studio's (publish over the API) and content is DB-driven (marketplace).
+#   Everything else under apps/unoverse (engine, server, web, tools) is image-only.
+#
+# OBSERVABILITY (runs by default):
+#   - Dozzle — single-container live log viewer (http://localhost:8080)
+#
+# =============================================================================
+
+# Bounds the disk Docker's json-file driver uses per container: rotate at 10 MB,
+# keep 3 files → 30 MB ceiling each. Applied to every service via *default-logging.
+# This is what caps log growth on the host (Dozzle just views it; it stores nothing).
+x-logging: &default-logging
+  driver: json-file
+  options:
+    max-size: "10m"
+    max-file: "3"
+
+services:
+  # ===========================================================================
+  # LAYER 1: CORE PLATFORM (DigitalOcean Container Registry)
+  # ===========================================================================
+  # Images pulled from: registry.digitalocean.com/gravity-repo/
+
+  # ═══════════════════════════════════════════════════════════════════════════
+  # RETIRED at the One Engine completion (ONE_ENGINE.md step 5): the gateway has
+  # zero jobs — the unoverse container serves /api, /ws/gravity, /components,
+  # and the Content Engine. ROLLBACK: uncomment this block and repoint the
+  # ingress api.{domain} target back to :4100. Image still published by CI.
+  # ═══════════════════════════════════════════════════════════════════════════
+  # server:
+  #   image: registry.digitalocean.com/gravity-repo/server:latest
+  #   ports:
+  #     - "4100:4100"
+  #   volumes:
+  #     - ./packages/design-system:/app/packages/design-system
+  #   environment:
+  #     - NODE_ENV=production
+  #     - PORT=4100
+  #     - DESIGN_SYSTEM_PATH=/app/packages/design-system
+  #     - REDIS_HOST=${REDIS_HOST:-}
+  #     - REDIS_PORT=${REDIS_PORT:-}
+  #     - REDIS_PASSWORD=${REDIS_PASSWORD:-}
+  #     - REDIS_TLS=${REDIS_TLS:-}
+  #     - REDIS_NAMESPACE=${REDIS_NAMESPACE:-}
+  #     - AUTH_ISSUER=${AUTH_ISSUER:-}
+  #     - AUTH_AUDIENCE=${AUTH_AUDIENCE:-}
+  #     - WORKFLOW_SERVICE_URL=http://unoverse:4101
+  #     - UNOVERSE_SERVICE_URL=http://unoverse:4106
+  #   labels:
+  #     - "com.docker.compose.service=server"
+  #   restart: unless-stopped
+
+  # ═══════════════════════════════════════════════════════════════════════════
+  # RETIRED at the One Engine cutover (ONE_ENGINE.md step 5): the workflow engine
+  # now runs IN-PROCESS in the unoverse container, which serves the identical
+  # :4101 surface. ROLLBACK: uncomment this block, remove DATABASE_URL from the
+  # unoverse service (its capability gate — prevents double-boot), and point
+  # WORKFLOW_SERVICE_URL back to http://workflow:4101 everywhere. The
+  # gravity-workflow image is still published by CI for exactly this purpose.
+  # ═══════════════════════════════════════════════════════════════════════════
+  # workflow:
+  #   image: registry.digitalocean.com/gravity-repo/workflow:latest
+  #   ports:
+  #     - "4101:4101"
+  #   environment:
+  #     - NODE_ENV=production
+  #     - PORT=4101
+  #     - REDIS_HOST=${REDIS_HOST:-}
+  #     - REDIS_PORT=${REDIS_PORT:-}
+  #     - REDIS_PASSWORD=${REDIS_PASSWORD:-}
+  #     - REDIS_TLS=${REDIS_TLS:-}
+  #     - REDIS_NAMESPACE=${REDIS_NAMESPACE:-}
+  #     - DATABASE_URL=${DATABASE_URL:-}
+  #     - SERVER_WS_URL=ws://server:4100
+  #     - UMAP_SERVICE_URL=http://umap:5001
+  #     - UNOVERSE_SERVICE_URL=http://unoverse:4106
+  #   labels:
+  #     - "com.docker.compose.service=workflow"
+  #   depends_on:
+  #     unoverse:
+  #       condition: service_healthy
+  #   restart: unless-stopped
+
+  # Canvas UI - React frontend (lightweight - static files via nginx)
+  # Runtime config injected via docker-entrypoint.sh at container start
+  canvas:
+    image: registry.digitalocean.com/gravity-repo/canvas:latest
+    ports:
+      - "3001:80"
+    environment:
+      - VITE_API_URL=${API_URL:-${DOMAIN:+https://api.${DOMAIN:-}}}
+      - VITE_SERVER_WS_URL=${VITE_SERVER_WS_URL:-${DOMAIN:+wss://api.${DOMAIN:-}}}
+      - VITE_AUTH_ISSUER=${AUTH_ISSUER:-}
+      - VITE_AUTH_CLIENT_ID=${AUTH_CLIENT_ID:-}
+      - VITE_AUTH_AUDIENCE=${AUTH_AUDIENCE:-}
+      # Unoverse public URL (JWT-gated :4105) — the browser calls it directly for
+      # component/template defs (MCP), prompt-blocks, and plugin management. This is the
+      # SAME :4105 backend as api.<domain>, so default to the api host (one public entry,
+      # one cert, no extra DNS). UNOVERSE_URL can still override for a dedicated MCP host.
+      - VITE_UNOVERSE_SERVICE_URL=${UNOVERSE_URL:-${DOMAIN:+https://api.${DOMAIN:-}}}
+      - MEMORY_SERVICE_URL=http://memory:4114
+    depends_on:
+      - unoverse
+    logging: *default-logging
+    restart: unless-stopped
+
+  # Studio is NOT a platform image (removed 2026-07-28): it ships from npm and
+  # connects to a universe over the API with a publish key.
+
+  # UMAP Service - Python ML service
+  umap:
+    image: registry.digitalocean.com/gravity-repo/umap:latest
+    ports:
+      - "5001:5001"
+    volumes:
+      - umap_models:/app/models
+    logging: *default-logging
+    restart: unless-stopped
+
+  # Unoverse - node plane (author·distribute·execute): the relocated node runtime +
+  # workbench + MCP. TWO listeners:
+  #   :4105 = PUBLIC (MCP + workbench), JWT-gated — published below.
+  #   :4106 = INTERNAL node runtime (catalog + execute) + builder MCP, UNGATED —
+  #           published LOOPBACK-ONLY (127.0.0.1). The Docker network and the host
+  #           machine itself are the trust boundary: nothing off the machine can
+  #           reach it. This is how a dev's local Claude Code drives the workflow
+  #           builder (/mcp-builder); never widen it to "4106:4106".
+  unoverse:
+    image: registry.digitalocean.com/gravity-repo/unoverse:latest
+    # For local development, build from source instead:
+    # build:
+    #   context: .
+    #   dockerfile: apps/unoverse/Dockerfile
+    ports:
+      - "4105:4105" # PUBLIC port
+      - "127.0.0.1:4106:4106" # builder MCP + runtime, LOOPBACK ONLY — local Claude Code connects here; never "4106:4106"
+      # LOOPBACK ONLY. The engine surface is unauthenticated; a plain "4101:4101" is
+      # internet-reachable on a VM because Docker's iptables rules BYPASS ufw — the
+      # harden.yml firewall does not protect published ports. Host tooling (./unoverse key,
+      # health checks) still reaches it via 127.0.0.1. Never widen to "4101:4101".
+      - "127.0.0.1:4101:4101" # workflow surface (engine in-process)
+    environment:
+      - NODE_ENV=production
+      # Studio is a separate app, launched by the CLI from source. It is not in this image
+      # and has no switch here: the Docker runtime serves MCP + API only.
+      - UNOVERSE_PORT=4105
+      # PUBLIC origin the app's OWN /mcp + /stream live at — baked into each MCP app's
+      # widget CSP (openai/widgetCSP.connect_domains). MUST be the api.<domain> host, or
+      # the widget (running in ChatGPT's iframe) is CSP-blocked from calling back and renders
+      # blank. Derived from DOMAIN like every other HTTPS URL (set DOMAIN only); empty in dev,
+      # where the code falls back to localhost:4105.
+      - UNOVERSE_PUBLIC_URL=${DOMAIN:+https://api.${DOMAIN:-}}
+      - UNOVERSE_RUNTIME_PORT=4106
+      # The internal listeners (:4106 runtime, :4101 engine) bind LOOPBACK by default in
+      # code. Inside the container they must bind all interfaces (docker-proxy and sibling
+      # containers connect to the container IP); the loopback-only port mappings above and
+      # the Docker network are the boundary here.
+      - UNOVERSE_INTERNAL_BIND=0.0.0.0
+      - AUTH_ISSUER=${AUTH_ISSUER:-}
+      - AUTH_AUDIENCE=${AUTH_AUDIENCE:-}
+      # WHERE THE MARKETPLACE IS. The catalogue this universe can install from, served as
+      # static files (catalogue.json plus each item's own definition). No default: a baked
+      # URL ties the image to one deployment and hides a missing setting. Empty means no
+      # remote catalogue, and the universe offers only what is on its own disk, which is
+      # what the monorepo and an air-gapped install both want.
+      - UNOVERSE_MARKETPLACE_URL=${UNOVERSE_MARKETPLACE_URL:-}
+      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
+      # Optional: page-intelligence features (promote-page extraction).
+      - HYPERBROWSER_API_KEY=${HYPERBROWSER_API_KEY:-}
+      # TEMP test shim: SearchPlaces/SearchAPI env fallback when no credential is stored.
+      - SERVER_WS_URL=ws://server:4100
+      # In-process loopback: the engine runs IN THIS container and binds :4101.
+      - WORKFLOW_SERVICE_URL=http://127.0.0.1:4101
+      # Lifecycle bridge: subscribes gravity:client:* and projects WORKFLOW_STATE
+      # onto MCP /stream sessions (lifecycleBridge.ts).
+      - REDIS_HOST=${REDIS_HOST:-}
+      - REDIS_PORT=${REDIS_PORT:-}
+      - REDIS_PASSWORD=${REDIS_PASSWORD:-}
+      - REDIS_TLS=${REDIS_TLS:-}
+      # ── ONE_ENGINE CUTOVER ACTIVE: DATABASE_URL is the capability gate that boots
+      # the in-process engine (the retired workflow block above is the rollback).
+      - DATABASE_URL=${DATABASE_URL:-}
+      # Connection budget (INFRASTRUCTURE.md, Postgres law) — per-size values
+      # rendered by the infra Terraform; unset in local dev = code defaults (10).
+      - DB_POOL_ENGINE=${DB_POOL_ENGINE:-}
+      - DB_POOL_ENGINE_LEGACY=${DB_POOL_ENGINE_LEGACY:-}
+      # Encrypts stored credentials at rest. WITHOUT this the engine falls back to a
+      # key committed in source (SECURITY.md § Credential encryption at rest) — set it
+      # in every deployment: openssl rand -base64 32
+      - CREDENTIAL_ENCRYPTION_KEY=${CREDENTIAL_ENCRYPTION_KEY:-}
+      - REDIS_NAMESPACE=${REDIS_NAMESPACE:-}
+      - UMAP_SERVICE_URL=http://umap:5001
+      # Agent nodes POST conversation turns to the memory server (ingestConversationTurn).
+      # Without this the code falls back to http://localhost:4104 — nothing inside THIS
+      # container — so every ingest silently fails (fire-and-forget) and memory never
+      # updates on deployed envs. The memory server is the sibling `memory` container.
+      - MEMORY_SERVICE_URL=http://memory:4114
+      # Marketplace installs node packages here at runtime (npm) — nodes are NOT baked
+      # into the image; only the core workflow nodes ship with the platform (in the
+      # workflow image). This volume persists installs across restarts.
+      - PLUGINS_DIR=/app/plugins
+      # Dev-editable folders are mounted over the image below; NODE_PATH resolves
+      # their hoisted deps from the local workspace node_modules. The plugins dir is
+      # also on NODE_PATH so locally-built component nodes (apps/unoverse/nodes/*, which
+      # live OUTSIDE /app/plugins) can resolve @unoverse-platform/plugin-base — the only
+      # copy carrying a built dist. Without this the runtime hits MODULE_NOT_FOUND and
+      # the nodes show "Package not installed".
+      - NODE_PATH=/app/host_node_modules:/app/plugins/node_modules
+    volumes:
+      - unoverse_plugins:/app/plugins
+      # ── Platform-dev mounts (monorepo only; sync-starter strips these three
+      # lines from the starter's copy — a customer universe serves what the DB
+      # says). Local edits are picked up on restart; rx/prompts are data, no build.
+      - ./node_modules:/app/host_node_modules # Hoisted deps for locally-built nodes
+    healthcheck:
+      # Ready = internal runtime port up (nodes are loaded into memory BEFORE it binds).
+      test:
+        ["CMD", "node", "-e", "fetch('http://127.0.0.1:4106/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 5s
+      timeout: 3s
+      retries: 12
+      start_period: 10s
+    labels:
+      - "com.docker.compose.service=unoverse"
+    logging: *default-logging
+    restart: unless-stopped
+
+  # RETIRED (2026-07): the standalone mcp-server (external OpenAI-Apps/Claude MCP on
+  # :4103) is superseded by the unoverse server's NATIVE MCP — public :4105/mcp and
+  # internal :4106/mcp (the app-discovery/workflow-MCP path). Source moved to
+  # _legacy/mcp-server; the last gravity-repo/mcp-server image stays in DOCR as the
+  # rollback hatch. ROLLBACK: restore apps/mcp-server from _legacy, re-add to the CI
+  # matrix, uncomment this block.
+  # mcp-server:
+  #   image: registry.digitalocean.com/gravity-repo/mcp-server:latest
+  #   ports:
+  #     - "4103:4103"
+  #   environment:
+  #     - NODE_ENV=production
+  #     - DOMAIN=${DOMAIN:-}
+  #     - WORKFLOW_SERVICE_URL=http://unoverse:4101
+  #     - AUTH_ISSUER=${AUTH_ISSUER:-}
+  #     - AUTH_AUDIENCE=${AUTH_AUDIENCE:-}
+  #   labels:
+  #     - "com.docker.compose.service=mcp-server"
+  #   depends_on:
+  #     - unoverse
+  #   logging: *default-logging
+  #   restart: unless-stopped
+
+  # Memory Server - Evidence-based user memory system (ambient pub/sub, Redis Streams)
+  memory:
+    image: registry.digitalocean.com/gravity-repo/memory:${TAG:-latest}
+    ports:
+      - "4104:4104"
+    environment:
+      - NODE_ENV=production
+      - PORT=4104
+      - DATABASE_URL=${DATABASE_URL:-}
+      # Connection budget (INFRASTRUCTURE.md) — Terraform-rendered per size.
+      - DB_POOL_MEMORY=${DB_POOL_MEMORY:-}
+      - REDIS_HOST=${REDIS_HOST:-}
+      - REDIS_PORT=${REDIS_PORT:-}
+      - REDIS_PASSWORD=${REDIS_PASSWORD:-}
+      - REDIS_TLS=${REDIS_TLS:-}
+      - REDIS_NAMESPACE=${REDIS_NAMESPACE:-}
+      - AUTH_ISSUER=${AUTH_ISSUER:-}
+      - AUTH_AUDIENCE=${AUTH_AUDIENCE:-}
+      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
+      - WORKFLOW_SERVICE_URL=http://unoverse:4101
+    labels:
+      - "com.docker.compose.service=memory"
+    depends_on:
+      - unoverse
+    logging: *default-logging
+    restart: unless-stopped
+
+  # unoverse-runtime REMOVED 2026-07-28: WIP, excluded from the platform
+  # (docs/architecture/INFRASTRUCTURE.md). Returns when the user declares it ready.
+
+  # ===========================================================================
+  # OBSERVABILITY — log viewer (runs by default)
+  # ===========================================================================
+  # Dozzle: a single ~30 MB container that tails/searches every container's logs
+  # in a live web UI. Stores NOTHING (streams from the Docker socket on demand),
+  # needs no config, no datasource, no dashboards. Replaces the old
+  # Promtail→Loki→Grafana stack. Long-term retention is bounded by the json-file
+  # log rotation set on each service (x-logging anchor above).
+  #
+  # No `profiles:` — logs are core, so dozzle starts with a plain `up -d` and
+  # survives `unoverse update` (a profiled service is skipped by up -d and would
+  # silently stay down after every update).
+  dozzle:
+    image: amir20/dozzle:latest
+    container_name: gravity-dozzle
+    ports:
+      - "8080:8080"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    logging: *default-logging
+    restart: unless-stopped
+
+volumes:
+  umap_models:
+  unoverse_plugins: # Marketplace-installed node packages (persisted across restarts)

package/operator/operator.sh

@@ -77,6 +77,22 @@ case "${1:-}" in
       # The ground definitions first: they are code, and they update like code.
       # NO `local` HERE: a case branch in the dispatch is not a function body, and bash
       # errors "local: can only be used in a function" straight to the developer's screen.
+      # THE COMPOSE FILE UPDATES LIKE THE GROUND DOES. A universe's docker-compose.yml was
+      # written once at creation and never again, so every platform change to it — a new
+      # service, a new environment variable — reached the monorepo and the starter and
+      # stopped there. UNOVERSE_MARKETPLACE_URL was rendered into .env by the ground and
+      # shipped by the deploy, and the container still never saw it, because the compose on
+      # that universe had no line to pass it through.
+      #
+      # Their .env is untouched: compose reads values from it and holds none.
+      _vcompose="$GRAVITY_LIB/../docker-compose.yml"
+      if [ -f "$_vcompose" ] && [ -f "$ROOT/docker-compose.yml" ]; then
+        if ! cmp -s "$_vcompose" "$ROOT/docker-compose.yml"; then
+          cp "$_vcompose" "$ROOT/docker-compose.yml"
+          ok "Refreshed docker-compose.yml ${DIM}(your .env is untouched)${NC}"
+        fi
+      fi
+
       _vinfra="$GRAVITY_LIB/../infra"
       if [ -d "$_vinfra" ]; then
         for _g in digitalocean aws; do

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.111",
+  "version": "0.1.112",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",