version: "3.9"

services:

  # ── Sovereign Dual Runtime ────────────────────────────────
  sovereign-runtime:
    build:
      context: ..
      dockerfile: docker/Dockerfile
    container_name: sovereign-dual-runtime
    hostname: sovereign-phone

    # Network isolation — internal only, no internet by default
    networks:
      sovereign-net:
        ipv4_address: 10.89.0.10

    ports:
      - "5554:5554"   # QEMU monitor console
      - "5555:5555"   # ADB (Android Debug Bridge)
      - "8788:8788"   # Sovereign OS ASM bridge
      - "9090:9090"   # 6502 VM telemetry
      - "9091:9091"   # M5 compatibility bridge
      - "2222:2222"   # Termux SSH

    volumes:
      - sovereign-data:/sovereign/data
      - sovereign-worm:/sovereign/worm      # WORM chain persistent storage
      - sovereign-6502:/sovereign/vm6502/state
      - ./android-images:/sovereign/qemu/images  # Android system images

    environment:
      - SOVEREIGN_MODE=dual-runtime
      - QEMU_ENABLED=true
      - VM6502_ENABLED=true
      - M5_ENABLED=true
      - DOORBELL_IPC=/sovereign/doorbell/mmio.sock
      - WORM_CHAIN=/sovereign/worm/chain.jsonl
      - THETA=89/2462

    # KVM acceleration for QEMU (if available)
    devices:
      - /dev/kvm:/dev/kvm

    # Security: drop all capabilities except what we need
    cap_drop:
      - ALL
    cap_add:
      - SYS_PTRACE   # for QEMU
      - NET_ADMIN    # for network isolation

    restart: unless-stopped
    stdin_open: true
    tty: true

  # ── WORM Chain Monitor ────────────────────────────────────
  worm-monitor:
    image: ubuntu:22.04
    container_name: sovereign-worm-monitor
    networks:
      sovereign-net:
        ipv4_address: 10.89.0.11
    volumes:
      - sovereign-worm:/worm:ro
    command: |
      bash -c "tail -f /worm/chain.jsonl | python3 -c \"
import sys, json
for line in sys.stdin:
    try:
        e = json.loads(line)
        print(f'[WORM] {e.get(\\\"agent\\\",\\\"?\\\"):12s} {e.get(\\\"hash\\\",\\\"\\\")[:16]}... {e.get(\\\"event\\\",\\\"\\\")}')
    except: pass
\""
    restart: unless-stopped

networks:
  sovereign-net:
    driver: bridge
    ipam:
      config:
        - subnet: 10.89.0.0/24

volumes:
  sovereign-data:
  sovereign-worm:
  sovereign-6502: