# Compose — product-managed services

**Status:** Optional stub. Not required for S3–S5 UAT attach path.

## Host vs container boundaries

| Layer | Owner | Managed by |
|-------|-------|------------|
| **Host** | Operator | `nemohermes` CLI, `openshell` CLI, product scripts |
| **Gateway** | OpenShell | `nemohermes` (sealed transactions) |
| **Hermes sandbox** | OpenShell | `nemohermes <name> start/stop/rebuild/destroy` |
| **Local MCP / webhooks** | Product | `docker compose` (this file) — optional |

**Key principle:** OpenShell owns the Hermes sandbox container. The product does NOT define the sandbox in `docker-compose.yml`. The sandbox is created and managed exclusively through `nemohermes` commands.

## What this compose file provides

An optional Docker Compose file for **product-managed services** that run alongside the Hermes sandbox:

- **QBO MCP** — local MCP server for QuickBooks Online (stdio or network-attached)
- **Vagaro webhooks** — REST endpoint for Vagaro webhook ingestion

These services share the `lumina` Docker network. The Hermes sandbox container is NOT part of this compose file.

## When to use

- **UAT attach (S3–S5):** Not needed. The sandbox runs via `nemohermes`; no local MCP or webhooks yet.
- **S7+ (SaaS connections):** Uncomment and configure the relevant service when connecting Square, QBO, or Vagaro.

## Usage

```bash
# When services are uncommented and configured:
cd deploy/compose
docker compose up -d

# Check status
docker compose ps

# Logs
docker compose logs -f
```

## Volumes

| Volume | Purpose |
|--------|---------|
| `qbo-mcp-data` | QBO MCP state (tokens, cache) |
| `vagaro-webhooks-data` | Webhook processing state |

## Design reference

- [design/DESIGN_PLAN.md §3](../../design/DESIGN_PLAN.md) — Hermes as NemoClaw-managed infrastructure
- [design/DESIGN_PLAN.md §6](../../design/DESIGN_PLAN.md) — MCP and SaaS integration
- [docs/ARCHITECTURE.md](../../docs/ARCHITECTURE.md) — overall architecture