Implement install stages S3–S5: package, policy, and skills sync.

Attach/onboard sandbox from agents/hermes, additive OpenShell policy overlays, and nemohermes skill install for scaffold skills. No doctor/connect and no push.
2026-07-27 12:13:25 -07:00
parent e5e179e541
commit 0198ab6881
38 changed files with 1422 additions and 51 deletions
@@ -1,5 +1,55 @@
-# Compose (scaffold)
+# Compose — product-managed services

-**Status:** No `docker-compose.yml` until **build**.
+**Status:** Optional stub. Not required for S3–S5 UAT attach path.

-Will host gateway/sandbox alignment, local QBO MCP, webhooks, volumes — per [design/DESIGN_PLAN.md](../../design/DESIGN_PLAN.md).
+## Host vs container boundaries
+
+| Layer | Owner | Managed by |
+|-------|-------|------------|
+| **Host** | Operator | `nemohermes` CLI, `openshell` CLI, product scripts |
+| **Gateway** | OpenShell | `nemohermes` (sealed transactions) |
+| **Hermes sandbox** | OpenShell | `nemohermes <name> start/stop/rebuild/destroy` |
+| **Local MCP / webhooks** | Product | `docker compose` (this file) — optional |
+
+**Key principle:** OpenShell owns the Hermes sandbox container. The product does NOT define the sandbox in `docker-compose.yml`. The sandbox is created and managed exclusively through `nemohermes` commands.
+
+## What this compose file provides
+
+An optional Docker Compose file for **product-managed services** that run alongside the Hermes sandbox:
+
+- **QBO MCP** — local MCP server for QuickBooks Online (stdio or network-attached)
+- **Vagaro webhooks** — REST endpoint for Vagaro webhook ingestion
+
+These services share the `lumina` Docker network. The Hermes sandbox container is NOT part of this compose file.
+
+## When to use
+
+- **UAT attach (S3–S5):** Not needed. The sandbox runs via `nemohermes`; no local MCP or webhooks yet.
+- **S7+ (SaaS connections):** Uncomment and configure the relevant service when connecting Square, QBO, or Vagaro.
+
+## Usage
+
+```bash
+# When services are uncommented and configured:
+cd deploy/compose
+docker compose up -d
+
+# Check status
+docker compose ps
+
+# Logs
+docker compose logs -f
+```
+
+## Volumes
+
+| Volume | Purpose |
+|--------|---------|
+| `qbo-mcp-data` | QBO MCP state (tokens, cache) |
+| `vagaro-webhooks-data` | Webhook processing state |
+
+## Design reference
+
+- [design/DESIGN_PLAN.md §3](../../design/DESIGN_PLAN.md) — Hermes as NemoClaw-managed infrastructure
+- [design/DESIGN_PLAN.md §6](../../design/DESIGN_PLAN.md) — MCP and SaaS integration
+- [docs/ARCHITECTURE.md](../../docs/ARCHITECTURE.md) — overall architecture