pinchy/docker-compose.eval.yml at main · heypinchy/pinchy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
# docker-compose.eval.yml
#
# Overlay for Eval-v1 (pinchy#669), the model-reliability eval harness. Layers
# on top of the production compose chain (Dockerfile.pinchy / Dockerfile.openclaw
# — matching what end users deploy, same rationale as docker-compose.integration.yml)
# plus the Odoo mock (docker-compose.odoo-test.yml) and Graph mock
# (docker-compose.email-test.yml) needed for the Hetzner-invoice scenario:
# list inbox -> read invoice email -> download PDF attachment -> create an
# Odoo vendor bill.
#
# Port-isolated from the integration stack (7779/5435, see
# docker-compose.integration.yml + reference_local_integration_e2e_stack) and
# from the odoo-test/email-test overlays' own default ports (9002, 9005) so
# the eval stack can run standalone or alongside them without collisions.
#
# Usage:
#   docker compose -f docker-compose.yml \
#                  -f docker-compose.e2e.yml \
#                  -f docker-compose.eval.yml up --build -d
#
# In CI, set PINCHY_IMAGE / OPENCLAW_IMAGE from pre-built images, same as the
# integration job.
#
# Self-test (no key): pnpm -C packages/web eval:selftest
# Real model sweep:   OLLAMA_CLOUD_API_KEY=... pnpm -C packages/web eval:models

services:
  pinchy:
    # Override the default :7777 mapping so the eval stack (port 7781)
    # doesn't conflict with the integration suite (7779) or other E2E jobs
    # (7777/7778). Loopback-only: the harness reaches it via localhost.
    ports: !override
      - "127.0.0.1:7781:7777"
    environment:
      - AUDIT_HMAC_SECRET=deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef
      # Fixed test-only secrets (throwaway eval stack, mock data only — same
      # rationale as the baked AUDIT_HMAC_SECRET). ENCRYPTION_KEY must match the
      # value the eval:selftest/eval:models scripts pass: the Playwright setup
      # encrypts the seeded Microsoft mock credentials host-side and Pinchy
      # must decrypt them with the same key. 64 hex chars.
      - ENCRYPTION_KEY=00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff
      - BETTER_AUTH_SECRET=eval-v1-test-secret-not-for-production
      # Emit a dummy API-key SecretRef for the local Ollama provider so
      # OpenClaw authenticates when routing to host.docker.internal (fake-
      # ollama, selftest mode) — same intent as docker-compose.odoo-test.yml.
      - PINCHY_E2E_OLLAMA_LOCAL_API_KEY=1
      # Odoo mock reachability + attachment download round trips both go
      # through private/container-internal hosts.
      - ALLOW_PRIVATE_URLS=1
      # The web app performs the Microsoft OAuth token refresh (credentials
      # route), so it is the container that must talk to the mock's /token
      # endpoint.
      - MICROSOFT_OAUTH_BASE_URL=http://graph-mock:9005
      - GRAPH_API_BASE_URL=http://graph-mock:9005
      # Both overrides above only take effect alongside this explicit flag
      # (insecure-mock-base-url.ts). Pinchy holds the OAuth client secret and
      # the refresh tokens, so an unflagged *_OAUTH_BASE_URL left over in
      # production would redirect strictly more than the plugin side does.
      - PINCHY_INSECURE_MAIL_MOCK=1
      # Passed through so `models` mode can seed settings.ollama_cloud_api_key
      # without baking a real key into the image or compose file.
      - OLLAMA_CLOUD_API_KEY=${OLLAMA_CLOUD_API_KEY:-}
      # The run fingerprint (#799) reads `build` from /api/version, which is
      # `process.env.PINCHY_BUILD_SHA` at request time. A locally-built eval
      # image bakes the build-arg default "dev", so the fingerprint lands
      # `comparable:false` and the sweep can't anchor a cross-version regression
      # baseline. /api/version reads this at RUNTIME (not a NEXT_PUBLIC compile
      # inline), so overriding it here is enough — no rebuild. Launch the sweep
      # with `PINCHY_BUILD_SHA=$(git rev-parse HEAD)` to stamp the real commit;
      # unset it defaults to "dev" (unchanged behavior). A dirty tree still lands
      # comparable:false via the harness `harnessDirty` check, so a stamped-but-
      # dirty run is never mistaken for a clean baseline.
      - PINCHY_BUILD_SHA=${PINCHY_BUILD_SHA:-dev}
    extra_hosts:
      # Pinchy probes ollama_local_url from regenerateOpenClawConfig(); the
      # selftest's fake-ollama runs on the HOST (started by eval.spec.ts, same
      # pattern as the email/odoo dispatch-probe specs), reached via the
      # `ollama.local` alias.
      - "host.docker.internal:host-gateway"
      - "ollama.local:host-gateway"

  openclaw:
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      # The pinchy-email plugin (running inside OpenClaw) calls the Graph API
      # directly for attachment downloads.
      - GRAPH_API_BASE_URL=http://graph-mock:9005
      # GRAPH_API_BASE_URL above only takes effect alongside this explicit
      # flag (graph-adapter.ts), so a stray override left over in production
      # can never silently redirect an OAuth-authenticated API call. Same
      # convention as docker-compose.imap-test.yml's PINCHY_INSECURE_MAIL_MOCK.
      - PINCHY_INSECURE_MAIL_MOCK=1
      # #723 governed-tools comparison sweep: the pinchy-odoo write guards
      # (duplicate guard #721 + read-back #720) are read from this env at guard
      # time. Default "enforced" = governed arm; set PINCHY_ODOO_GOVERNANCE=off
      # on the host to run the ungoverned arm. ONE host var drives both this
      # container and the harness's RunResult.governance stamp, so the recorded
      # arm can never disagree with what the plugin did. Eval-only — never off
      # in production.
      - PINCHY_ODOO_GOVERNANCE=${PINCHY_ODOO_GOVERNANCE:-enforced}

  db:
    ports:
      !override # Playwright/setup helpers read/seed the DB directly from the host.
      - "127.0.0.1:5437:5432"
    tmpfs:
      - /var/lib/postgresql/data
    volumes: !reset []

  odoo-mock:
    build:
      context: config/odoo-mock
    ports:
      - "127.0.0.1:9502:9002"
      - "127.0.0.1:8169:8069"
    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "fetch('http://localhost:9002/control/health').then(r=>r.ok?process.exit(0):process.exit(1)).catch(()=>process.exit(1))",
        ]
      interval: 5s
      timeout: 3s
      retries: 10

  graph-mock:
    build:
      context: config/graph-mock
    ports:
      - "127.0.0.1:9505:9005"
    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "fetch('http://localhost:9005/control/health').then(r=>r.ok?process.exit(0):process.exit(1)).catch(()=>process.exit(1))",
        ]
      interval: 5s
      timeout: 3s
      retries: 10