docker-compose.e2e.yml

# Local full-stack E2E compose: brings up Postgres, Redis, Exchange, Broker,
# Miniflare + Fastly + AWS edges, a mock publisher origin, one host serving the
# fixed identities' key directories, and the Identity service (Go MCP adapter)
# with its Zitadel + Vault + wildcard-DNS supporting cast.
#
#   make test-e2e     # a fresh stack under its own project name → pytest in `runner` → down
#   make e2e-up       # bring the stack up (project E2E_PROJECT, default <checkout>-e2e)
#   make e2e-down     # take it down, volumes and network included
#
# Self-contained by construction: no service publishes a host port, and the stack
# runs on a network of its own, so any number of stacks share one Docker daemon.
# The test runner is a container on that network and reaches every service by
# name, the demo-domain aliases and the wildcard zones included. A developer who
# wants to reach the stack from the host adds docker-compose.e2e.ports.yml (make
# e2e-up E2E_HOST_PORTS=1); nothing that grades a change does.
#
# Run it through scripts/e2e-stack.sh (the Makefile targets do), never with a bare
# `docker compose -f docker-compose.e2e.yml`: the network and its addresses are
# chosen per stack and handed to this file as two variables, see the address plan
# beside the `networks:` block at the bottom.

# The wildcard-DNS sidecar every FORA service resolves *.foramcp.org through.
# Anchored so the address has ONE owner in this file: it was previously written
# out at each consumer, and five copies of an IP is five places to miss when it
# moves. An overlay cannot read an anchor of this file, so a service an overlay
# adds writes the address again; tests/e2e/harness/test_guards_publisher_sites.py
# holds every such copy equal to this one.
x-wildcard-dns: &wildcard-dns
  - "${FORA_E2E_NET}.153"

# The identity service's OAuth issuer identifier. Anchored for the same reason as
# the DNS address above: three services name it, and three copies is three places
# to miss when it changes.
x-identity-issuer: &identity-issuer "http://identity"

# The console's own origin on this network. Three settings have to agree about
# it: the redirect address registered at the provider, the console's own
# CONSOLE_PUBLIC_ORIGIN, and the directory the Exchange reads this console's
# signing key from. One anchor is what keeps them agreeing.
x-console-origin: &console-origin "http://console:8085"

# The Identity Service's KV mount and its scoped Vault token. identity-vault-init
# writes the policy for this mount and creates the token with this fixed id; the
# identity service is given the same two values. The runner's
# test_identity_vault_scope.py reads them from the running identity container
# and checks what that token may do. The id is not a secret: the token reaches
# only agent keys in a throwaway dev-mode Vault.
x-identity-kv-mount: &identity-kv-mount "secret"
x-identity-vault-token: &identity-vault-token "e2e-identity-scoped-token"
# The dev-mode Vault's root token. identity-vault-init uses it to set up, and the
# runner uses it to arrange and check state the scoped token must not reach.
x-identity-vault-root-token: &identity-vault-root-token "root"

# The runner's address on this network, and the only source each Exchange's admin
# listener admits (ADMIN_ALLOWED_CIDRS). The admin plane has no request signing
# and no operator identity: the source address is its only gate (ADR-022), so it
# is opened to one address rather than to a range. The address sits in the
# upper half of the stack's /24, outside Docker's automatic range (see the
# address plan beside `networks:` at the bottom), so Docker never hands it to
# another container, and no other service declares it. Anchored so the runner's
# address and the four allowlists are one value.
# test_admin_plane.py checks that every running Exchange admits the runner and
# no other container in the stack.
x-runner-address: &runner-address "${FORA_E2E_NET}.220"

# The capture proxy's address, and the hosts-file entries that send a service's
# requests through it (ADR-028 D8 H12). A service given these entries resolves
# each name to the proxy, which records the request with its bytes and forwards
# it unchanged to the party the name names on the network's own DNS (see
# tests/e2e/capture-proxy/main.go). Nothing else about the service changes: it
# is configured with the same names, signs the same URLs and sends the same Host.
#
# The proxy is also the stack's one TLS endpoint. The Web Bot Auth profile names
# every signer by an https origin and serves every key directory over https, and
# every service here speaks plain http, so https to any name below reaches the
# proxy and is forwarded over http to the service: on the port it arrived on, or
# for 443 on the port CAPTURE_TLS_PORTS names. Every port the proxy listens on
# answers both. The names are every party that signs or serves a
# key directory: the Broker, the four Exchanges and the impostor, the console,
# the publisher edges and the static key-directory hosts. The wildcard zones
# (the identity service's agents, the suite's per-test agents and sites) reach
# the proxy through the wildcard-DNS sidecar instead, because a hosts file holds
# no wildcard.
#
# Every service that calls one of these parties carries the list, and so does
# the runner. An Exchange's admin listener admits the runner's own address only
# (x-runner-address), and a request forwarded by the proxy arrives from the
# proxy's, so the runner reaches each admin listener by its -admin alias, which
# no hosts file names. The address sits beside the sites service's and the
# Exchange impostor's, in the upper half of the stack's /24 that Docker never
# assigns on its own (see the address plan beside `networks:` at the bottom), so
# no container started without a static address can take it first.
# harness/test_capture_proxy.py proves that the legs the wire obligations read
# run through it, and that every name here answers https under the local CA.
x-capture-proxy-address: &capture-proxy-address "${FORA_E2E_NET}.187"
x-through-capture-proxy: &through-capture-proxy
  exchange: *capture-proxy-address
  exchange-b: *capture-proxy-address
  exchange-c: *capture-proxy-address
  exchange-d: *capture-proxy-address
  broker: *capture-proxy-address
  console: *capture-proxy-address
  misbehaving-exchange: *capture-proxy-address
  unapproved-exchange: *capture-proxy-address
  unlisted-exchange: *capture-proxy-address
  demo.fora-protocol.org: *capture-proxy-address
  music.demo.fora-protocol.org: *capture-proxy-address
  sfx.demo.fora-protocol.org: *capture-proxy-address
  archive.demo.fora-protocol.org: *capture-proxy-address
  examplenews: *capture-proxy-address
  catalog-contributor-e2e: *capture-proxy-address
  agent-nobilling-e2e: *capture-proxy-address
  test-signer-e2e.v1: *capture-proxy-address

# How a client trusts the local CA tls-keygen mints for the proxy. SSL_CERT_FILE
# is the setting Go and Python (OpenSSL and httpx) read, and it replaces the
# default bundle file, so it names the bundle that holds the system roots AND the
# local CA. NODE_EXTRA_CA_CERTS adds to Node's built-in roots, so it names the CA
# alone. Both files live on the tls-ca volume, which every client mounts
# read-only at /tls-ca.
x-tls-ca-file: &tls-ca-file "/tls-ca/ca.pem"
x-tls-ca-bundle: &tls-ca-bundle "/tls-ca/ca-bundle.pem"

# The two settings above, as one block, for the edge containers. Node reads
# NODE_EXTRA_CA_CERTS once, at process start; the Miniflare and Fastly runtimes
# do their outbound TLS outside Node, so they are given SSL_CERT_FILE as well.
x-tls-edge-trust: &tls-edge-trust
  NODE_EXTRA_CA_CERTS: *tls-ca-file
  SSL_CERT_FILE: *tls-ca-bundle

# A throwaway Postgres cluster, as one unit. `make e2e-down` runs `down -v` and
# every stack-up re-inits from scratch, so nothing in PGDATA has to survive.
# Keeping the data directory in RAM with the durability work switched off takes
# the stack's Postgres write traffic off the host disk entirely — on a laptop
# that traffic is what makes the machine unresponsive during a run. size= is a
# cap, not a reservation: tmpfs allocates only the pages actually written.
#
# OPTIMIZATION: Reduced tmpfs size from 2g to 1g for e2e tests.
# Test databases are small (few tables, minimal data), 1 GiB is more than sufficient.
# Saves ~1 GiB RAM. Production databases should use persistent storage.
#
# Anchored rather than repeated, for the same reason as everything else here:
# two services want it, and the second copy was coupled to the first by a
# comment saying "same reasoning as above", which nothing enforces.
x-ephemeral-postgres: &ephemeral-postgres
  command:
    ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off",
     "-c", "full_page_writes=off"]
  tmpfs:
    - /var/lib/postgresql/data:rw,size=1g

# The timing every health check in the stack shares. Docker runs a check every
# start_interval while its container is starting and still inside start_period,
# and every interval once it is healthy. A container that starts again, after a
# restart or after a test stops it, is starting again, so it is checked often
# until it answers. Readiness is still seen within 2 s, while a healthy stack
# runs about one check every three seconds in all instead of a dozen a second,
# each of them a process Docker starts inside a container.
#
# Failures inside start_period do not count against retries. The period is long
# so the frequent checks outlast a slow start on a loaded CI host. The cost: a
# service that never comes up turns unhealthy only after start_period plus
# retries x interval, so locally the up --wait timeout (E2E_WAIT_TIMEOUT) ends
# the wait first.
#
# The timeout is ten seconds, not three: six checks start a node process (the
# three edge runtimes, the two Lambda emulators and the WBA oracle), and on a
# loaded CI host node alone can take longer than three seconds to start. A long
# timeout costs nothing, because Docker starts the next check only after the
# previous one ends.
#
# start_interval needs Docker Engine 25 or later and a Compose that passes it
# on; scripts/check-compose-version.sh refuses older tools before e2e-up.
# Anchors cannot cross files, so an overlay that defines a service writes these
# values out, and tests/e2e/harness/test_guards_health_timing.py holds every
# check in every file the stack loads to them.
x-health-timing: &health-timing
  interval: 60s
  timeout: 10s
  retries: 3
  start_period: 300s
  start_interval: 2s

# The three edge runtimes' check: the edge's own /healthz answering 200, read
# through a node process because their images ship node but no curl or wget.
# Not the publisher's fora.json: the edge passes that address through to the
# origin, which has a healthcheck of its own.
x-edge-healthcheck: &edge-healthcheck
  <<: *health-timing
  test:
    - "CMD-SHELL"
    - 'node -e "require(''http'').get(''http://127.0.0.1:80/healthz'', r => process.exit(r.statusCode===200?0:1)).on(''error'', () => process.exit(1))"'

# Each demo publisher's origin: the publisher service on a port of its own. Every
# port serves the same content; the port picks whose discovery documents answer
# (/.well-known/fora.json and /rsl.txt, from tests/e2e/mock-publisher/documents/,
# routed in deploy/publisher/nginx.conf). The edge in front of each publisher
# forwards to its own port. test_guards_publisher_documents.py holds these ports,
# the nginx map and the documents to one another.
x-origin-philosophy: &origin-philosophy "http://publisher:8001"
x-origin-music: &origin-music "http://publisher:8002"
x-origin-sfx: &origin-sfx "http://publisher:8003"

# The billing settings every Exchange shares, the ledger's address included:
# every Exchange bills on the one TigerBeetle cluster (the tigerbeetle service),
# and adds only its own id namespace, EXCHANGE_BILLING_TB_ID_NAMESPACE (see that
# service for why). The address must be an IP and port: the TigerBeetle client
# does not resolve hostnames, so the ledger holds a static address on this
# network.
#
# EXCHANGE_BILLING_LEDGER lists the ISO 4217 numeric codes billed in, one ledger
# each: 840 is USD and 978 is EUR. The FIRST entry is what the manifest
# advertises as base_currency, so 840 stays first.
#
# EXCHANGE_DEFAULT_AGENT_CREDIT is the welcome credit an agent receives once per
# currency, at its first Register on an Exchange whose seat activates new
# agents. It is how every funded agent gets its money: a test registers its own
# agent through the SDK, and nothing writes a balance directly. The
# Exchange reads this value once at boot and grants from it.
# This is the only place the map is written.
x-exchange-billing: &exchange-billing
  FORA_BILLING_ADAPTER: "tigerbeetle"
  EXCHANGE_BILLING_TB_ADDRESS: "${FORA_E2E_NET}.211:3000"
  EXCHANGE_BILLING_LEDGER: "840,978"
  EXCHANGE_DEFAULT_AGENT_CREDIT: "USD=100.00,EUR=100.00"

# The denomination publishers' licensing is priced in: the currency and the
# metering unit of every arrangement registered through the console, and of every
# page the catalog importer imports. exchange-a (the seat the console registers
# publishers on) and the importer get this one value, as the production template
# gives both services the same two inputs: the price a publisher sets in the
# console is the price their imported pages carry.
#
# USD because it is the base currency this stack bills in (840 is first in
# EXCHANGE_BILLING_LEDGER above), and the console's revenue totals are read in
# the base currency: a sale priced in any other currency would settle and still
# show no amounts in the publisher's totals. Which currency the totals should
# default to when a deployment prices in another one is an open product
# question; this value does not answer it, it keeps the stack out of it.
x-terms-denomination: &terms-denomination
  EXCHANGE_TERMS_CURRENCY: "USD"
  EXCHANGE_TERMS_UNIT: "fetches"

# What an Exchange asks a registration to carry, published in its manifest.
#
# One value, two publishers: exchange-b is where the account suite registers,
# and exchange-c publishes the SAME schema so a refusal can be observed against
# an exchange no test ever opens an account at. Deliberately identical — the
# refusal under test is about a payload missing a published member, not about
# which members a given exchange asks for — and anchored so "identical" is a
# fact rather than a comment. The value is 269 characters as written here, 267
# once compose un-escapes the two $$ pairs; edit one copy of that and the suite
# does not notice, because the test that drives the refusal reads the schema from
# exchange-c's own manifest.
#
# $$schema, not $schema: compose interpolates $NAME in a value, so the
# single-dollar form is read as an unset variable and the member is served with
# an EMPTY key. The schema still compiles that way, which is what makes the
# mistake quiet — the document is simply not the one configured. $$ is compose's
# escape for a literal dollar. The trailing $ in the email pattern needs no
# escape: compose only interpolates $ followed by a name or a brace. Both
# escapes are now written once instead of twice each, which is exactly what a
# copy-edit gets wrong.
x-registration-schema: &registration-schema '{"$$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","required":["company_name","billing_email"],"properties":{"company_name":{"type":"string","minLength":1},"billing_email":{"type":"string","pattern":"^[^@]+@[^@]+$$"},"vat_id":{"type":"string"}}}'

# The bearer-token issuer and signing seed, as one unit. Both the identity service
# (which MINTS and verifies bearers) and the runner (whose harness mints its own,
# in tests/e2e/harness/test_mcp_endpoint.py) must agree on them exactly. Anchored
# rather than repeated because the failure mode of a second spelling is silent: a
# rotated seed on one side surfaces as an unexplained 401, not as a mismatch
# anything reports.
x-identity-auth: &identity-auth
  IDENTITY_AUTH_ISSUER: *identity-issuer
  # Deterministic token key so a bearer stays valid across a restart within a
  # run (32-byte Ed25519 seed, base64). e2e-only, not a real secret.
  IDENTITY_TOKEN_SIGNING_KEY: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="

# Build args passed to Go builder stages: concurrency cap, module proxy fallback, and sumdb.
x-go-build-args: &go-build-args
  - GO_BUILD_P
  - GOPROXY
  - GOSUMDB

services:
  postgres:
    image: postgres:16-alpine
    <<: *ephemeral-postgres
    environment:
      POSTGRES_USER: fora
      POSTGRES_PASSWORD: fora
      POSTGRES_DB: fora
    volumes:
      # Multi-exchange topology (ripdi): create exchange-b/c's separate catalog
      # databases (fora_b, fora_c) at cluster init, before the socket opens for
      # app connections. exchange-b/c gate on `condition: service_healthy`, so
      # they never race a missing DB. `down -v` wipes the volume → re-runs init.
      - ./deploy/storage/postgres/10-create-exchange-dbs.sql:/docker-entrypoint-initdb.d/10-create-exchange-dbs.sql:ro
    healthcheck:
      <<: *health-timing
      # -h 127.0.0.1 forces a TCP check: during first-boot init (creating the
      # extra databases) postgres listens only on the unix socket, and a
      # socket-based pg_isready would report healthy while TCP 5432 is still
      # closed — letting the exchanges start and hit connection-refused. Checking
      # TCP keeps the container unhealthy until it actually accepts app connections.
      test: ["CMD-SHELL", "pg_isready -U fora -d fora -h 127.0.0.1"]

  redis:
    image: redis:7-alpine
    command: ["redis-server", "--save", "", "--loglevel", "warning"]
    healthcheck:
      <<: *health-timing
      test: ["CMD", "redis-cli", "ping"]

  publisher:
    image: nginx:alpine
    volumes:
      - ./tests/e2e/mock-publisher/content:/usr/share/nginx/html:ro
      # Phase-2 demo content tree, served by PATH alongside the baseline tree.
      # Mounted under its OWN docroot (/usr/share/nginx/demo) — NOT under the
      # read-only baseline docroot, which the daemon cannot create child
      # mountpoints in. deploy/publisher/nginx.conf routes the demo path
      # prefixes (/articles, /lyrics, /tracks, /sfx) to this tree. The edge
      # forwards the signed-URL path verbatim to ORIGIN_URL (its publisher's
      # port, x-origin-*), so these mounts are what the canary fetch reads.
      - ./deploy/content/demo:/usr/share/nginx/demo:ro
      # Each demo publisher's own discovery documents, one directory per
      # publisher domain, answered on that publisher's port (x-origin-*).
      - ./tests/e2e/mock-publisher/documents:/usr/share/nginx/documents:ro
      - ./deploy/publisher/nginx.conf:/etc/nginx/nginx.conf:ro
    healthcheck:
      <<: *health-timing
      test: ["CMD-SHELL", "wget -q -O- http://127.0.0.1/premium/article-42.html || exit 1"]


  # ───── Static key directories: one host for every fixed identity ─────
  # One nginx (deploy/publisher-jwks) serves the discovery documents of every
  # identity the stack holds fixed: its Web Bot Auth key directory and its
  # fora.json overlay. There is no static key registry: every signing identity
  # publishes its own keys at its own host name, and the Exchanges and the Broker
  # learn a key only by fetching the signer's directory, the same path production
  # uses. So each identity keeps a host name of its own, one of the aliases below;
  # for an agent it equals the identity's kid, which the harness sends as the
  # covered Signature-Agent header. The entrypoint serves each identity's
  # documents under its own name only, and a request under any other name gets
  # 404 and no keys.
  #
  # Each key is mounted as its own read-only file at /keys/<host>.json, which is
  # how the entrypoint learns the hosts. Never mount the fixtures directory: it
  # would carry every private key in it, the broker relay key included, into a
  # container whose job is serving public documents. A key mounted under the wrong
  # host's name stops the container at start, because the entrypoint refuses a
  # key whose issuer is not its host.
  #
  # The identities:
  #   * examplenews: the demo subscription publisher (its key comes from
  #     scripts/gen-examplenews-publisher-key.sh). Its fora.json lists the
  #     harness contributor and advertises exchange-a, because the Broker's
  #     publisher probe refuses a resolve with NOT_IN_CATALOG when a publisher
  #     lists no exchanges, even though the contributor is listed;
  #   * catalog-contributor-e2e: the third-party catalog contributor. The
  #     Exchange's self-signup (agentreg.RegisterFromDirectory) fetches its
  #     directory to learn the contributor's key, with NO fora.agents pre-seed,
  #     and the demo publishers list it in the fora.json their origin serves. A
  #     self-hosting
  #     contributor authorizes no third party of its own, so its list is empty;
  #   * archive.demo.fora-protocol.org: the archive publisher (Lyceum Archive, a
  #     fictional cast member like the other demo publishers), the one site
  #     exchange-d sells. It has no edge and no content route. Its directory
  #     holds the publisher's self-publish key, which exchange-d fetches to
  #     verify the seed's catalog push, and its fora.json names exchange-d,
  #     which is what the Broker reads to route a resolve of an archive URI;
  #   * agent-nobilling-e2e: the deliberately-unfunded buyer for the billing
  #     deny-path obligations;
  #   * test-signer-e2e.v1: a static agent identity that stays served, although
  #     no current test signs as it. Its dotted kid is why the entrypoint takes
  #     each manifest's domain from the key's issuer and never from the kid.
  # PUBLISHER_HOSTS_JSON holds the manifest fields of the three publishers; a
  # host it does not name is served as an agent.
  key-directories:
    build:
      # Repo-root context (the same shape the service images use) so the
      # Dockerfile can copy scripts/lib/ed25519_keys.py — the entrypoint renders
      # each WBA directory through the same shared helpers the key-gen scripts
      # use, instead of a shell-side copy kept in sync by hand.
      context: .
      dockerfile: deploy/publisher-jwks/Dockerfile
    environment:
      PUBLISHER_HOSTS_JSON: >-
        {"examplenews": {"exchanges": [{"domain": "exchange:8081",
        "endpoint": "http://exchange:8081",
        "supported_profiles": ["fora-news-v1", "fora-comp-v1", "fora-music-v1"],
        "ext": {"resource_owner_id": "demo-resource-owner"}}]},
        "catalog-contributor-e2e": {"catalog_contributors": []},
        "archive.demo.fora-protocol.org": {"exchanges": [{"domain": "exchange-d:8081",
        "endpoint": "http://exchange-d:8081",
        "supported_profiles": ["fora-news-v1", "fora-comp-v1", "fora-music-v1"],
        "ext": {"resource_owner_id": "demo-resource-owner"}}]}}
    volumes:
      - ./deploy/publisher-keys/examplenews-subscription-key.json:/keys/examplenews.json:ro
      - ./tests/e2e/harness/fixtures/catalog_contributor_key.json:/keys/catalog-contributor-e2e.json:ro
      - ./tests/e2e/harness/fixtures/selfpub_archive_key.json:/keys/archive.demo.fora-protocol.org.json:ro
      - ./tests/e2e/harness/fixtures/agent_nobilling_e2e_key.json:/keys/agent-nobilling-e2e.json:ro
      - ./tests/e2e/harness/fixtures/test_signer_key.json:/keys/test-signer-e2e.v1.json:ro
    healthcheck:
      <<: *health-timing
      test: ["CMD-SHELL", "wget -q -O- http://127.0.0.1/healthz || exit 1"]
    networks:
      default:
        aliases:
          - examplenews
          - catalog-contributor-e2e
          - archive.demo.fora-protocol.org
          - agent-nobilling-e2e
          - test-signer-e2e.v1

  # One-shot: generate ephemeral signing keys into a shared volume at stack-up so
  # nothing is committed to git. Mints (a) the AWS_CLOUDFRONT_RSA tenant RSA pair —
  # the Exchange reads the private half (FORA_RSA_PRIVATE_PEM_FILE), the aws-edge
  # CloudFront shim the public half (FORA_CF_PUBLIC_PEM_FILE); and (b) the Ed25519
  # offer/URL signing key the Exchange reads via FORA_ED25519_PRIVATE_PEM_FILE.
  # The Exchange no longer generates keys in-process (it fails closed when unset),
  # so this one-shot is what provisions them for the stack. Mirrors the
  # cold-start key derivation of the key-directories service.
  rsa-keygen:
    image: alpine:3.20
    command:
      - sh
      - -c
      - |
        set -eu
        apk add --no-cache openssl >/dev/null
        # exchange-a keys (unchanged names — exchange-a's identity is preserved).
        openssl genrsa -out /rsa-keys/rsa-private.pem 2048
        openssl rsa -in /rsa-keys/rsa-private.pem -pubout -out /rsa-keys/rsa-public.pem
        openssl genpkey -algorithm ED25519 -out /rsa-keys/ed25519-private.pem
        # exchange-b / exchange-c keys (ripdi): distinct ed25519 offer keys +
        # distinct RSA URL-signing keys per exchange, so each /.well-known/fora.json
        # serves a DISTINCT offer key and an offer signed by one exchange cannot be
        # verified against another's manifest.
        openssl genrsa -out /rsa-keys/rsa-b-private.pem 2048
        openssl rsa -in /rsa-keys/rsa-b-private.pem -pubout -out /rsa-keys/rsa-b-public.pem
        openssl genpkey -algorithm ED25519 -out /rsa-keys/ed25519-b-private.pem
        openssl genrsa -out /rsa-keys/rsa-c-private.pem 2048
        openssl rsa -in /rsa-keys/rsa-c-private.pem -pubout -out /rsa-keys/rsa-c-public.pem
        openssl genpkey -algorithm ED25519 -out /rsa-keys/ed25519-c-private.pem
        # exchange-d: its own offer key, for the same reason. No RSA pair: its
        # seat sells only an ED25519 site, and the Exchange boots without an RSA
        # key, deferring the refusal to the first CloudFront-scheme mint.
        openssl genpkey -algorithm ED25519 -out /rsa-keys/ed25519-d-private.pem
        chmod 0444 /rsa-keys/rsa-private.pem /rsa-keys/rsa-public.pem /rsa-keys/ed25519-private.pem \
          /rsa-keys/rsa-b-private.pem /rsa-keys/rsa-b-public.pem /rsa-keys/ed25519-b-private.pem \
          /rsa-keys/rsa-c-private.pem /rsa-keys/rsa-c-public.pem /rsa-keys/ed25519-c-private.pem \
          /rsa-keys/ed25519-d-private.pem
        echo "rsa-keygen: wrote rsa+ed25519 keypairs for exchange a/b/c/d"
    volumes:
      - rsa-keys:/rsa-keys
    restart: "no"

  # One-shot: mint the local CA and the capture proxy's TLS certificate at
  # stack-up, the same way rsa-keygen mints signing keys, so no private key is
  # committed. The CA certificate goes to tls-ca, which every client mounts; the
  # proxy's certificate and key go to tls-proxy-keys, which only the proxy
  # mounts. See tests/e2e/capture-proxy/tls-keygen.sh.
  tls-keygen:
    image: alpine/openssl:3.3.2
    entrypoint: ["sh", "/tls-keygen.sh"]
    user: "0"
    volumes:
      - ./tests/e2e/capture-proxy/tls-keygen.sh:/tls-keygen.sh:ro
      - tls-ca:/tls-ca
      - tls-proxy-keys:/tls-proxy
    restart: "no"

  # ───── Billing ledger: one TigerBeetle for every Exchange ────────────
  # One single-replica TigerBeetle cluster, which all four Exchanges bill on.
  # TigerBeetle has no schemas: an account or transfer id is unique in the whole
  # cluster, not per ledger. The platform fee and liquidity accounts are derived
  # from fixed names, and a resource owner's revenue account from the owner's id
  # alone, and every seat here sells for the same owner, so two Exchanges that
  # derived the same ids would post into the same accounts, and every balance
  # test would still pass. Each Exchange therefore salts every id it derives
  # with its own namespace, EXCHANGE_BILLING_TB_ID_NAMESPACE, set to its own
  # service name. Only the e2e build reads that setting; a production build
  # refuses to start with it, so production ids stay unsalted.
  #
  # Every Exchange start registers a new client session, and the cluster keeps
  # at most 64: once it is full, it evicts the session that committed a request
  # longest ago. The suite's Exchange restarts stay far below that.
  #
  # The data file lives on a named volume that `make e2e-down` (`down -v`)
  # deletes, so every stack starts with an empty ledger. Not tmpfs, unlike
  # Postgres: `format` allocates the whole data file up front (about 1 GiB), and
  # on tmpfs that is RAM. The format step is skipped when the file exists, so a
  # restarted replica keeps its balances.
  #
  # seccomp=unconfined and IPC_LOCK are what TigerBeetle's Docker guide asks
  # for: Docker >= 25 blocks io_uring in its default seccomp profile, and the
  # capability lets the replica lock memory. --development relaxes the Direct IO
  # requirement a Docker volume cannot meet. --cache-grid is the one memory knob
  # that is not marked experimental, and the replica refuses a value of 32MiB or
  # less. It still holds about 1.5 GiB, most of it buffers allocated at start
  # whatever the load, which is why the stack runs one cluster and not one per
  # Exchange.
  #
  # The static address sits in the upper half of the stack's /24, outside
  # Docker's automatic range, so no dynamically addressed container can take it
  # first.
  #
  # The health check proves the replica accepts connections, and format runs
  # before start, so the port opening is the honest readiness edge. The
  # Exchanges connect at boot and refuse to start when the ledger does not
  # answer, which is why each waits for it to be healthy.
  tigerbeetle:
    image: ghcr.io/tigerbeetle/tigerbeetle:0.17.8
    entrypoint: ["sh", "-c"]
    command:
      - |
        set -e
        [ -f /data/0_0.tigerbeetle ] || /tigerbeetle format --cluster=0 --replica=0 --replica-count=1 --development /data/0_0.tigerbeetle
        exec /tigerbeetle start --addresses=0.0.0.0:3000 --cache-grid=64MiB --development /data/0_0.tigerbeetle
    security_opt:
      - "seccomp=unconfined"
    cap_add:
      - "IPC_LOCK"
    healthcheck:
      <<: *health-timing
      test: ["CMD", "nc", "-z", "127.0.0.1", "3000"]
    volumes:
      - tigerbeetle-data:/data
    networks:
      default:
        ipv4_address: ${FORA_E2E_NET}.211

  # ───── FORA services ─────────────────────────────────────────────────
  exchange:
    build:
      context: .
      dockerfile: src/exchange/Dockerfile
      # The e2e image: the binary is built with the e2e tag, so it carries the
      # e2e-only control service on its admin listener (ADR-028 D6). Production
      # builds the file's default target, which has no such route.
      target: e2e
      args: *go-build-args
    dns: *wildcard-dns
    # Its requests to the Broker and the Exchanges run through the capture
    # proxy; see x-through-capture-proxy.
    extra_hosts: *through-capture-proxy
    # The TigerBeetle client inside the Exchange uses io_uring too, so the
    # Exchange needs the same seccomp exception as its ledger, or the client
    # fails to initialize its IO at boot.
    security_opt:
      - "seccomp=unconfined"
    environment:
      EXCHANGE_DSN: "postgres://fora:fora@postgres:5432/fora?sslmode=disable"
      # Set explicitly (INFO is also the default) so every stack boot drives
      # the level parser in the real container; the same holds for the
      # Broker, Identity and the other Exchanges below.
      EXCHANGE_LOG_LEVEL: "INFO"
      # System-of-Record account registry. FORA_SOR_ADAPTER
      # defaults to "postgres", which requires a SEPARATE logical database
      # (distinct from EXCHANGE_DSN): the Exchange opens a second pool and runs
      # the SoR migrations at boot, but never CREATE DATABASEs — fora_sor is
      # pre-created by deploy/storage/postgres/10-create-exchange-dbs.sql at init.
      EXCHANGE_SOR_DSN: "postgres://fora:fora@postgres:5432/fora_sor?sslmode=disable"
      EXCHANGE_ADDR: ":8081"
      # Re-package: Offer.exchange (minted from EXCHANGE_DOMAIN) is the
      # broker's routing key — it must be a host the broker can fetch
      # /.well-known/fora.json from in the compose network, so it is the
      # service host:port (the well-known fetch URL carries no port). The manifest
      # advertises EXCHANGE_PUBLIC_ORIGIN as the top-level endpoint; it MUST equal
      # the endpoint the broker's registry and the demo publishers' fora.json
      # name for this Exchange, for the post-resolve SSRF equality gate.
      EXCHANGE_DOMAIN: "exchange:8081"
      # The seat whose "activate new agents automatically" policy a registration
      # reads. A tenant row is the Exchange seat, so its domain is this
      # exchange's own hostname and this value repeats EXCHANGE_DOMAIN above.
      # It is stated rather than left to the binary's EXCHANGE_DOMAIN fallback
      # so the seat the exchange reads is written where its boot fixture and
      # the compose guard can compare it. Point it at anything else — a
      # publisher's domain, the way it read before the seat existed — and it
      # matches no tenant row: every fora_register is then refused, and the
      # exchange says so only in a boot warning.
      EXCHANGE_DEFAULT_TENANT: "exchange:8081"
      # The rows this exchange creates at start-up when they are absent: its
      # seat, the second seat the tenant-isolation suite names, the payee, the
      # site it sells and that site's ACTIVE listing (ADR-029). The file and the
      # terms it names are mounted read-only below; the harness writes no row.
      EXCHANGE_BOOT_FIXTURE_FILE: "/boot/fixture.yml"
      EXCHANGE_PUBLIC_ORIGIN: "http://exchange:8081"
      # The admin listener (:8082) admits the runner only; see x-runner-address.
      ADMIN_ALLOWED_CIDRS: *runner-address
      # Billing on the stack's one TigerBeetle cluster, under this exchange's
      # own id namespace (see the tigerbeetle service and the
      # x-exchange-billing anchor). A buyer holds money only after it registers
      # here and receives the welcome credit; a buyer with no money is refused
      # INSUFFICIENT_BALANCE, which is the deny path the credit-less-buyer
      # obligation needs. The denomination is the console seat's (see
      # x-terms-denomination); only this exchange registers publishers.
      <<: [*exchange-billing, *terms-denomination]
      EXCHANGE_BILLING_TB_ID_NAMESPACE: "exchange"
      # Single scheme knob for the well-known / manifest-fetch resolver (HTTPS is
      # the default; the services here serve plain http).
      FORA_WELLKNOWN_SCHEME: "http"
      # The SSRF guard on every outbound .well-known fetch (agent registration,
      # contributor-authz, broker revocation poll) blocks private/loopback hosts
      # by default; the compose network is private + http, so permit it here.
      # MUST stay unset in production.
      SKIP_SSRF: "true"
      ALLOW_INSECURE: "true"
      # Revocation-aware key resolution: the Exchange polls the Broker's
      # well-known + invalidation_url so a Broker-revoked kid is rejected, and
      # resolves the Broker relay key from the same directory. The Broker's
      # directory is the revocation authority; when it is unreachable the
      # Exchange fails closed (rejects) rather than trusting any other source.
      EXCHANGE_BROKER_WELLKNOWN_URL: "https://broker/.well-known/fora.json"
      # Turns the publisher-registration routes on, and names the directory the
      # console's signing key is read from. The console serves it at its own
      # origin, so these two settings and the console's CONSOLE_PUBLIC_ORIGIN
      # name one place.
      EXCHANGE_CONSOLE_WELLKNOWN_URL: "https://console/.well-known/http-message-signatures-directory"
      # The catalogue contributor this deployment operates. Every manifest the
      # console generates names it, and a domain check does not pass until the
      # publisher's own file does.
      EXCHANGE_CATALOG_CONTRIBUTOR_HOST: "catalog-contributor-e2e"
      # Poll the Broker's revocation channel frequently so the revocation
      # obligations (harness/obligations/test_revocation_scope.py) observe a
      # freshly-published Broker list within a bounded wait. Production uses a
      # longer interval.
      EXCHANGE_REVOCATION_POLL_INTERVAL: "1s"
      # EXCHANGE_CATALOG_URI_SCHEME overrides the https:// default that
      # entryFromProto materializes into stored catalog URIs. The demo sites here
      # serve plain http; production leaves this unset.
      EXCHANGE_CATALOG_URI_SCHEME: "http"
      # RSA private key for the AWS_CLOUDFRONT_RSA tenant scheme, read from a file
      # the rsa-keygen one-shot writes into a shared volume at stack-up (the key
      # is no longer committed to git). The aws-edge CloudFront shim reads the
      # matching public half from the same volume — mirroring a CloudFront trusted
      # key group now that the cdn-keys.json route is retired (D4). Production
      # sources tenant signing keys from a secret store.
      FORA_RSA_PRIVATE_PEM_FILE: "/rsa-keys/rsa-private.pem"
      # Ed25519 offer/URL signing key, also written by the rsa-keygen one-shot.
      # The Exchange fails closed when no key is configured (it no longer mints an
      # ephemeral key in-process), so this file injection is mandatory for the
      # stack. Production wires FORA_ED25519_PRIVATE_PEM from Secrets Manager.
      FORA_ED25519_PRIVATE_PEM_FILE: "/rsa-keys/ed25519-private.pem"
      # Trusts the local CA tls-keygen mints (x-tls-ca-bundle).
      SSL_CERT_FILE: *tls-ca-bundle
    volumes:
      - rsa-keys:/rsa-keys:ro
      - tls-ca:/tls-ca:ro
      - ./tests/e2e/harness/fixtures/exchange-boot/exchange.yml:/boot/fixture.yml:ro
      - ./testdata/free-listing-terms.json:/boot/free-listing-terms.json:ro
    depends_on:
      capture-proxy:
        condition: service_healthy
      dns:
        condition: service_healthy
      postgres:
        condition: service_healthy
      key-directories:
        condition: service_healthy
      rsa-keygen:
        condition: service_completed_successfully
      tigerbeetle:
        condition: service_healthy
    # No healthcheck: distroless image ships only the /exchange binary — no
    # shell, no wget/curl. Downstream services use depends_on:service_started.
    # The name the runner reaches this Exchange's admin listener by. No hosts
    # file points it at the capture proxy, so the runner's admin calls arrive
    # from the runner's own address (see x-through-capture-proxy).
    networks:
      default:
        aliases:
          - exchange-admin

  # ───── exchange-b (music) — SEPARATE catalog DB fora_b (ripdi) ─────────────
  # A copy of `exchange` (= exchange-a) with its OWN catalog database, OWN
  # offer/URL signing keys, and OWN identity (EXCHANGE_DOMAIN/PUBLIC_ORIGIN). The
  # music publisher's fora.json (served by its origin, behind fastly-edge) names
  # exchange-b, so the broker routes music offers here. It bills on the shared ledger under
  # its OWN id namespace. The httpsig key set, fetch overrides and
  # broker-revocation poll are identical to exchange-a.
  exchange-b:
    build:
      context: .
      dockerfile: src/exchange/Dockerfile
      target: e2e
      args: *go-build-args
    dns: *wildcard-dns
    # Its requests to the Broker and the Exchanges run through the capture
    # proxy; see x-through-capture-proxy.
    extra_hosts: *through-capture-proxy
    # io_uring for the ledger client; see exchange-a.
    security_opt:
      - "seccomp=unconfined"
    environment:
      EXCHANGE_DSN: "postgres://fora:fora@postgres:5432/fora_b?sslmode=disable"
      EXCHANGE_LOG_LEVEL: "INFO"
      # Own SoR registry DB (see exchange-a). fora_sor_b is pre-created at init.
      EXCHANGE_SOR_DSN: "postgres://fora:fora@postgres:5432/fora_sor_b?sslmode=disable"
      EXCHANGE_ADDR: ":8081"
      EXCHANGE_DOMAIN: "exchange-b:8081"
      # This exchange's own seat (see exchange-a).
      EXCHANGE_DEFAULT_TENANT: "exchange-b:8081"
      # Its seat, the payee, the site it sells and that site's ACTIVE listing,
      # created at start-up when absent (ADR-029; see exchange-a).
      EXCHANGE_BOOT_FIXTURE_FILE: "/boot/fixture.yml"
      EXCHANGE_PUBLIC_ORIGIN: "http://exchange-b:8081"
      # The admin listener (:8082) admits the runner only; see x-runner-address.
      ADMIN_ALLOWED_CIDRS: *runner-address
      # Its own id namespace on the shared ledger; see exchange-a.
      <<: *exchange-billing
      EXCHANGE_BILLING_TB_ID_NAMESPACE: "exchange-b"
      FORA_WELLKNOWN_SCHEME: "http"
      SKIP_SSRF: "true"
      ALLOW_INSECURE: "true"
      EXCHANGE_BROKER_WELLKNOWN_URL: "https://broker/.well-known/fora.json"
      # The same one-second poll of the Broker's revocation list as exchange-a, so
      # a revocation of the Broker's key, and its withdrawal, reach every Exchange
      # within the revocation obligations' bounded waits.
      EXCHANGE_REVOCATION_POLL_INTERVAL: "1s"
      EXCHANGE_CATALOG_URI_SCHEME: "http"
      # One of the two exchanges in this stack that ask for registration details,
      # so the suites cover both contracts against something real: this one and
      # exchange-c publish a schema and a terms revision, exchange-a publishes
      # neither and keeps the pass-through behaviour every exchange had before
      # the block existed. exchange-a is left bare deliberately — it is what
      # every other suite transacts against, and changing it would change tests
      # this has nothing to do with.
      #
      # This one is where the account suite REGISTERS. exchange-c publishes the
      # same schema so a refusal can be observed against an exchange no test ever
      # opens an account at; see the note there.
      #
      # NOTE: publishing the schema is what turns enforcement on, so this exchange
      # refuses a payload that does not match it. The identity adapter also
      # pre-checks against the same schema before it signs, so in practice a
      # non-conforming payload is stopped there first and never reaches here.
      EXCHANGE_REGISTRATION_SCHEMA: *registration-schema
      EXCHANGE_TERMS_URI: "http://exchange-b:8081/terms/2026-04"
      # SHA-256 of the string "test" — a real digest of a real input, so it can
      # be reproduced rather than trusted.
      EXCHANGE_TERMS_DIGEST: "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
      # Distinct ed25519 + RSA key MATERIAL (per exchange) so the well-known
      # serves a distinct offer key. Key REF names are kept identical to
      # exchange-a so the per-DB seat rows, which each boot fixture declares with
      # the same refs, resolve.
      FORA_RSA_PRIVATE_PEM_FILE: "/rsa-keys/rsa-b-private.pem"
      FORA_ED25519_PRIVATE_PEM_FILE: "/rsa-keys/ed25519-b-private.pem"
      # Trusts the local CA tls-keygen mints (x-tls-ca-bundle).
      SSL_CERT_FILE: *tls-ca-bundle
    volumes:
      - rsa-keys:/rsa-keys:ro
      - tls-ca:/tls-ca:ro
      - ./tests/e2e/harness/fixtures/exchange-boot/exchange-b.yml:/boot/fixture.yml:ro
      - ./testdata/free-listing-terms.json:/boot/free-listing-terms.json:ro
    depends_on:
      capture-proxy:
        condition: service_healthy
      dns:
        condition: service_healthy
      postgres:
        condition: service_healthy
      key-directories:
        condition: service_healthy
      rsa-keygen:
        condition: service_completed_successfully
      tigerbeetle:
        condition: service_healthy
    # The name the runner reaches this Exchange's admin listener by. No hosts
    # file points it at the capture proxy, so the runner's admin calls arrive
    # from the runner's own address (see x-through-capture-proxy).
    networks:
      default:
        aliases:
          - exchange-b-admin

  # ───── exchange-c (sfx) — SEPARATE catalog DB fora_c (ripdi) ───────────────
  # A copy of `exchange` with its OWN catalog database (fora_c), OWN signing keys,
  # and OWN identity. The sfx publisher's fora.json (served by its origin, behind
  # aws-edge) names exchange-c, so the broker routes sfx offers here.
  exchange-c:
    build:
      context: .
      dockerfile: src/exchange/Dockerfile
      target: e2e
      args: *go-build-args
    dns: *wildcard-dns
    # Its requests to the Broker and the Exchanges run through the capture
    # proxy; see x-through-capture-proxy.
    extra_hosts: *through-capture-proxy
    # io_uring for the ledger client; see exchange-a.
    security_opt:
      - "seccomp=unconfined"
    environment:
      EXCHANGE_DSN: "postgres://fora:fora@postgres:5432/fora_c?sslmode=disable"
      EXCHANGE_LOG_LEVEL: "INFO"
      # Own SoR registry DB (see exchange-a). fora_sor_c is pre-created at init.
      EXCHANGE_SOR_DSN: "postgres://fora:fora@postgres:5432/fora_sor_c?sslmode=disable"
      EXCHANGE_ADDR: ":8081"
      EXCHANGE_DOMAIN: "exchange-c:8081"
      # This exchange's own seat (see exchange-a).
      EXCHANGE_DEFAULT_TENANT: "exchange-c:8081"
      # Its seat, the payee, the site it sells and that site's ACTIVE listing,
      # created at start-up when absent (ADR-029; see exchange-a).
      EXCHANGE_BOOT_FIXTURE_FILE: "/boot/fixture.yml"
      EXCHANGE_PUBLIC_ORIGIN: "http://exchange-c:8081"
      # The admin listener (:8082) admits the runner only; see x-runner-address.
      ADMIN_ALLOWED_CIDRS: *runner-address
      # Its own id namespace on the shared ledger; see exchange-a.
      <<: *exchange-billing
      EXCHANGE_BILLING_TB_ID_NAMESPACE: "exchange-c"
      FORA_WELLKNOWN_SCHEME: "http"
      SKIP_SSRF: "true"
      ALLOW_INSECURE: "true"
      EXCHANGE_BROKER_WELLKNOWN_URL: "https://broker/.well-known/fora.json"
      # The same one-second poll of the Broker's revocation list as exchange-a, so
      # a revocation of the Broker's key, and its withdrawal, reach every Exchange
      # within the revocation obligations' bounded waits.
      EXCHANGE_REVOCATION_POLL_INTERVAL: "1s"
      EXCHANGE_CATALOG_URI_SCHEME: "http"
      # THE ACCOUNT SUITE'S AGENT NEVER REGISTERS HERE. This exchange is that
      # agent's reserved never-registered target, and that reservation is what
      # lets a refusal be asserted as a TOTAL — "no account exists here" —
      # instead of as a before-and-after comparison that cannot fail. Other
      # agents do hold accounts here: the seed registers its credit-less buyer,
      # and tests register their own agents. Accounts are per agent, so none of them
      # touches the reservation.
      #
      # It cannot fail against an exchange the suite already holds an account at,
      # because Register is idempotent: a row that already carries a billing
      # reference takes a fast path and returns the same handle whether or not
      # the pre-check let the request through. So the comparison stays equal
      # either way, and the assertion proves nothing.
      #
      # The same schema exchange-b publishes; see the anchor for why one value
      # serves both. Publishing it turns enforcement on here too, but the identity
      # adapter pre-checks against the same schema before signing, so a
      # non-conforming payload is stopped there and never reaches this exchange.
      EXCHANGE_REGISTRATION_SCHEMA: *registration-schema
      EXCHANGE_TERMS_URI: "http://exchange-c:8081/terms/2026-04"
      # SHA-256 of the single byte "b", so this exchange's terms revision is a
      # different real digest from exchange-b's rather than a copy of it.
      EXCHANGE_TERMS_DIGEST: "sha256:3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"
      FORA_RSA_PRIVATE_PEM_FILE: "/rsa-keys/rsa-c-private.pem"
      FORA_ED25519_PRIVATE_PEM_FILE: "/rsa-keys/ed25519-c-private.pem"
      # Trusts the local CA tls-keygen mints (x-tls-ca-bundle).
      SSL_CERT_FILE: *tls-ca-bundle
    volumes:
      - rsa-keys:/rsa-keys:ro
      - tls-ca:/tls-ca:ro
      - ./tests/e2e/harness/fixtures/exchange-boot/exchange-c.yml:/boot/fixture.yml:ro
      - ./testdata/free-listing-terms.json:/boot/free-listing-terms.json:ro
    depends_on:
      capture-proxy:
        condition: service_healthy
      dns:
        condition: service_healthy
      postgres:
        condition: service_healthy
      key-directories:
        condition: service_healthy
      rsa-keygen:
        condition: service_completed_successfully
      tigerbeetle:
        condition: service_healthy
    # The name the runner reaches this Exchange's admin listener by. No hosts
    # file points it at the capture proxy, so the runner's admin calls arrive
    # from the runner's own address (see x-through-capture-proxy).
    networks:
      default:
        aliases:
          - exchange-c-admin

  # ───── exchange-d (archive) — the seat that REFUSES the Broker relay ────────
  # A copy of `exchange` with its OWN catalog database (fora_d), OWN offer key,
  # OWN identity and OWN id namespace on the shared ledger. It sells the archive
  # publisher's site, whose manifest (served by key-directories) names this
  # exchange.
  #
  # What sets it apart is in its boot fixture, not here: the fixture declares
  # its seat with allow_broker_relay false, so a purchase the Broker relays here
  # is refused with DENIAL_REASON_RELAY_NOT_ACCEPTED while the same offer bought
  # directly succeeds. The opt-out is declared rather than toggled by a test, so
  # no test can leave it flipped for the next one. Every other exchange's seat
  # opts in.
  exchange-d:
    build:
      context: .
      dockerfile: src/exchange/Dockerfile
      target: e2e
      args: *go-build-args
    dns: *wildcard-dns
    # Its requests to the Broker and the Exchanges run through the capture
    # proxy; see x-through-capture-proxy.
    extra_hosts: *through-capture-proxy
    # io_uring for the ledger client; see exchange-a.
    security_opt:
      - "seccomp=unconfined"
    environment:
      EXCHANGE_DSN: "postgres://fora:fora@postgres:5432/fora_d?sslmode=disable"
      EXCHANGE_LOG_LEVEL: "INFO"
      # Own SoR registry DB (see exchange-a). fora_sor_d is pre-created at init.
      EXCHANGE_SOR_DSN: "postgres://fora:fora@postgres:5432/fora_sor_d?sslmode=disable"
      EXCHANGE_ADDR: ":8081"
      EXCHANGE_DOMAIN: "exchange-d:8081"
      # This exchange's own seat (see exchange-a).
      EXCHANGE_DEFAULT_TENANT: "exchange-d:8081"
      # Its seat, the payee, the site it sells and that site's ACTIVE listing,
      # created at start-up when absent (ADR-029; see exchange-a).
      EXCHANGE_BOOT_FIXTURE_FILE: "/boot/fixture.yml"
      EXCHANGE_PUBLIC_ORIGIN: "http://exchange-d:8081"
      # The admin listener (:8082) admits the runner only; see x-runner-address.
      ADMIN_ALLOWED_CIDRS: *runner-address
      # Its own id namespace on the shared ledger; see exchange-a.
      <<: *exchange-billing
      EXCHANGE_BILLING_TB_ID_NAMESPACE: "exchange-d"
      FORA_WELLKNOWN_SCHEME: "http"
      SKIP_SSRF: "true"
      ALLOW_INSECURE: "true"
      EXCHANGE_BROKER_WELLKNOWN_URL: "https://broker/.well-known/fora.json"
      # The same one-second poll of the Broker's revocation list as exchange-a, so
      # a revocation of the Broker's key, and its withdrawal, reach every Exchange
      # within the revocation obligations' bounded waits.
      EXCHANGE_REVOCATION_POLL_INTERVAL: "1s"
      EXCHANGE_CATALOG_URI_SCHEME: "http"
      # No RSA key: the archive site is an ED25519 site (see rsa-keygen).
      FORA_ED25519_PRIVATE_PEM_FILE: "/rsa-keys/ed25519-d-private.pem"
      # Trusts the local CA tls-keygen mints (x-tls-ca-bundle).
      SSL_CERT_FILE: *tls-ca-bundle
    volumes:
      - rsa-keys:/rsa-keys:ro
      - tls-ca:/tls-ca:ro
      - ./tests/e2e/harness/fixtures/exchange-boot/exchange-d.yml:/boot/fixture.yml:ro
      - ./testdata/free-listing-terms.json:/boot/free-listing-terms.json:ro
    depends_on:
      capture-proxy:
        condition: service_healthy
      dns:
        condition: service_healthy
      postgres:
        condition: service_healthy
      # Among the directories it serves is the archive publisher's: the seed's
      # ingest signs as that publisher, and this exchange learns the key only by
      # fetching it.
      key-directories:
        condition: service_healthy
      rsa-keygen:
        condition: service_completed_successfully
      tigerbeetle:
        condition: service_healthy
    # The name the runner reaches this Exchange's admin listener by. No hosts
    # file points it at the capture proxy, so the runner's admin calls arrive
    # from the runner's own address (see x-through-capture-proxy).
    networks:
      default:
        aliases:
          - exchange-d-admin

  # ───── Fake Bedrock Runtime ──────────────────────────────────────
  # Answers the Broker's Converse calls from a fixed script keyed on the query,
  # so the catalog search runs through the real adapter and AWS SDK without a
  # model. See tests/e2e/fake-bedrock/server.py for the script format.
  fake-bedrock:
    image: python:3.12-alpine
    command: ["python", "/app/server.py"]
    environment:
      FAKE_BEDROCK_SCRIPT: "/app/script.json"
    volumes:
      - ./tests/e2e/fake-bedrock/server.py:/app/server.py:ro
      - ./tests/e2e/harness/fixtures/bedrock_script.json:/app/script.json:ro
    healthcheck:
      <<: *health-timing
      test: ["CMD-SHELL", "wget -q -O- http://127.0.0.1:8090/healthz || exit 1"]

  broker:
    build:
      context: .
      dockerfile: src/broker/Dockerfile
      args: *go-build-args
    dns: *wildcard-dns
    extra_hosts:
      # Its requests to the Exchanges run through the capture proxy; see
      # x-through-capture-proxy.
      <<: *through-capture-proxy
      # On Linux, Docker doesn't auto-wire this; make it explicit so the
      # Broker can probe edge URIs authored with host.docker.internal.
      host.docker.internal: host-gateway
    environment:
      BROKER_DSN: "postgres://fora:fora@postgres:5432/fora?sslmode=disable"
      BROKER_LOG_LEVEL: "INFO"
      # The Exchanges the Broker routes to, upserted into its registry at every
      # boot. The registry has no write API, so its configuration file is how
      # this stack, like any deployment, tells the Broker which Exchanges exist.
      BROKER_REGISTRY_FILE: "/registry/exchanges.yml"
      REDIS_URL: "redis://redis:6379/0"
      BROKER_ADDR: ":8082"
      BROKER_ID: "broker-e2e"
      BROKER_DOMAIN: "broker:8082"
      # The https origin every request the Broker signs names as its
      # Signature-Agent. The capture proxy answers https for "broker" and
      # forwards to this service, so the Exchanges fetch the relay key there.
      BROKER_PUBLIC_ORIGIN: "https://broker"
      # Single scheme knob for every broker well-known fetch: the publisher
      # probe, the Offer.exchange endpoint resolver (that exchange's
      # /.well-known/fora.json), and the per-agent well-known key resolver
      # (v1.1 lazy/just-in-time registration). The services here serve plain
      # http, so override the default https scheme.
      FORA_WELLKNOWN_SCHEME: "http"
      # The SSRF guard on the publisher-probe fetch blocks private/loopback hosts
      # by default; the compose publisher (and host.docker.internal probe target)
      # are internal http hosts, so permit it here. MUST stay unset in production.
      SKIP_SSRF: "true"
      ALLOW_INSECURE: "true"
      # The Broker refuses to boot without a persistent identity key, because the
      # key it publishes in its own WBA directory is cached by verifiers for 90
      # days and a per-restart key invalidates every cached copy. The e2e stack
      # is torn down between runs and nothing caches across it, so a throwaway
      # key is correct here. MUST stay unset in production.
      BROKER_ALLOW_EPHEMERAL_KEY: "true"
      # Publish the revocation channel: after the WBA split the Broker's WBA
      # directory advertises this URL as its revocation_url and serves a
      # KeyRevocationList (keyed by RFC 7638 thumbprint) at that route
      # (forawellknown.RevocationPath).
      BROKER_REVOCATION_URL: "https://broker/.well-known/fora-key-revocations.json"
      # BROKER_REVOCATION_FILE points at a writable file, on a volume the runner
      # also mounts, that the Broker re-reads on mtime change. Absent/empty → the
      # nothing-revoked baseline; the revocation obligations write a
      # KeyRevocationList here (harness/broker_revocations.py), naming the
      # Broker's own key or an agent's key, and withdraw it with a newer empty
      # list.
      BROKER_REVOCATION_FILE: "/revocations/revocations.json"
      # Broker-relay signing key — without this the Broker ships unsigned
      # Exchange calls and the Exchange's httpsig middleware rejects them.
      # The keypair is a generated harness fixture (gen-e2e-keys.sh; gitignored
      # as private material). The Broker publishes the relay pubkey in its OWN
      # WBA directory at boot, which is where the Exchange's broker well-known
      # resolver learns it — no pre-shared key file anywhere.
      BROKER_RELAY_KEY_FILE: "/relay/broker-key.json"
      # EXA_API_KEY deliberately empty — pytest drives with direct URIs.
      # Catalog search: a free-text query is matched against the e2e music feed,
      # the same file the seed ingests into exchange-b, so the matched URIs are
      # the ones that Exchange sells. The model is the fake above, reached
      # through the SDK's per-service endpoint override with throwaway
      # credentials. URIs are http because the Exchanges here use
      # EXCHANGE_CATALOG_URI_SCHEME=http.
      BROKER_QUERY_DISCOVERY: "on"
      BROKER_QUERY_CATALOG_FILE: "/catalog/music.jsonl"
      BROKER_QUERY_MODEL: "amazon.nova-lite-v1:0"
      BROKER_QUERY_URI_SCHEME: "http"
      AWS_REGION: "us-east-1"
      AWS_ACCESS_KEY_ID: "e2e-fake"
      AWS_SECRET_ACCESS_KEY: "e2e-fake"
      AWS_EC2_METADATA_DISABLED: "true"
      AWS_ENDPOINT_URL_BEDROCK_RUNTIME: "http://fake-bedrock:8090"
      # Trusts the local CA tls-keygen mints (x-tls-ca-bundle).
      SSL_CERT_FILE: *tls-ca-bundle
    volumes:
      - tls-ca:/tls-ca:ro
      - ./tests/e2e/harness/fixtures/broker_relay_key.json:/relay/broker-key.json:ro
      - ./tests/e2e/harness/fixtures/catalog/music.jsonl:/catalog/music.jsonl:ro
      - ./tests/e2e/harness/fixtures/broker_registry.yml:/registry/exchanges.yml:ro
      # Writable dir the revocation e2e writes revocations.json into; the Broker
      # re-reads it on mtime change (see BROKER_REVOCATION_FILE above).
      # A named volume, so it belongs to this stack alone: a host directory would
      # be shared by every stack started from one checkout, and one stack's
      # revocation would reach another's Broker.
      - revocations:/revocations
    depends_on:
      capture-proxy:
        condition: service_healthy
      dns:
        condition: service_healthy
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      exchange:
        condition: service_started
      # Multi-exchange topology (ripdi): the broker resolves music offers to
      # exchange-b, sfx offers to exchange-c and archive offers to exchange-d,
      # so all three must be up before it.
      exchange-b:
        condition: service_started
      exchange-c:
        condition: service_started
      exchange-d:
        condition: service_started
      # The impostor is in the registry too. Healthy before the Broker starts,
      # so the Broker's first probe finds it live rather than leaving it
      # unroutable until the next pass.
      misbehaving-exchange:
        condition: service_healthy
      fake-bedrock:
        condition: service_healthy

  edge:
    build:
      context: src/edge
      dockerfile: Dockerfile.miniflare
      # The edge installs @fora-protocol/sdk during the image build, at the
      # protocol commit or release its package.json pins, so no sibling
      # build-context is mirrored in. How it is fetched is the Dockerfile's business and is
      # explained there.
    # WBA_KEYS_JSON for this publisher's self-publish key (no kid; named by
    # thumbprint) is generated by scripts/gen-e2e-keys.sh into this env_file (the
    # served JWK is derived from the same private fixture the demo ingest signs
    # with, so they cannot drift). Served in the WBA directory's keys[] so the
    # Exchange learns the key via the well-known fetch — no DB pre-seed (fcrk7).
    env_file:
      - ./deploy/edge-keys/edge.env
    # Cloudflare edge listens on port 80 so the demo publisher domain alias
    # (demo.fora-protocol.org) resolves natively for BOTH the port-80
    # /.well-known/fora.json fetch (Exchange Gate 2 + Broker probe), which the
    # edge passes through to the publisher's origin, and the port-80 signed-URL
    # content fetch — no Host-override, no port rewrite.
    # Root user so node can bind the privileged port inside the container.
    user: "0:0"
    # Its calls to the Exchange, including the https fetch of its key
    # directory, run through the capture proxy; see x-through-capture-proxy.
    extra_hosts: *through-capture-proxy
    environment:
      # Trusts the local CA tls-keygen mints (x-tls-edge-trust).
      <<: *tls-edge-trust
      PORT: "80"
      EXCHANGE_URL: "http://exchange:8081"
      # After the WBA split the exchange's offer-signing key lives in its WBA
      # directory; the edge resolves the delivery-URL verify key by thumbprint
      # from there, not from fora.json.
      EXCHANGE_WBA_URL: "https://exchange/.well-known/http-message-signatures-directory"
      ORIGIN_URL: *origin-philosophy
      # Delivery-URL binding enforcement, stated explicitly rather than left to
      # the default: this is the property the MCP end-to-end test exercises, and
      # a test whose subject is implied by a default proves less than one whose
      # subject is written down. A custodied registry agent satisfies the check
      # because the identity service fetches on its behalf with the bound key.
      FORA_ENFORCE_BINDING: "true"
      # No document settings: this edge fronts the Stoa Press philosophy
      # catalog, whose fora.json (with its exchanges and its authorized catalog
      # pusher, the harness's catalog-contributor-e2e) and rsl.txt the
      # publisher's origin serves (x-origin-philosophy).
    volumes:
      - tls-ca:/tls-ca:ro
    networks:
      default:
        aliases:
          # Stoa Press philosophy publisher → Cloudflare ed25519 edge.
          - demo.fora-protocol.org
    depends_on:
      exchange:
        condition: service_started
      publisher:
        condition: service_healthy
    healthcheck: *edge-healthcheck

  fastly-edge:
    # Fastly Compute runtime via Viceroy (`fastly compute serve`). Same
    # Hono app as the Miniflare edge, compiled to WASM via
    # @fastly/js-compute.
    build:
      context: .
      dockerfile: tests/e2e/fastly-edge/Dockerfile
      platforms:
        - linux/amd64
      # Same SDK source as the edge service: @fora-protocol/sdk at the pin its
      # package.json names, fetched during the build, no sibling context.
    # WBA_KEYS_JSON for the music publisher's self-publish key (no kid; named by
    # thumbprint), generated by scripts/gen-e2e-keys.sh. The Fastly entrypoint
    # hoists it into the fora_edge config_store so the WASM worker serves it in
    # the WBA directory's keys[] (fcrk7).
    env_file:
      - ./deploy/edge-keys/fastly-edge.env
    # Its calls to the Exchange, including the https fetch of its key
    # directory, run through the capture proxy; see x-through-capture-proxy.
    extra_hosts: *through-capture-proxy
    environment:
      # Trusts the local CA tls-keygen mints (x-tls-edge-trust).
      <<: *tls-edge-trust
      # Viceroy listens on port 80 so the music demo domain alias resolves
      # natively for the port-80 manifest fetch (passed through to the origin)
      # + signed-URL content fetch.
      FASTLY_SERVE_ADDR: "0.0.0.0:80"
      # Multi-exchange topology (ripdi): the music publisher is fronted by
      # exchange-b. Its fora.json names exchange-b so the broker routes music
      # offers there, and the music catalog is ingested into exchange-b's DB.
      # After the WBA split the edge resolves the delivery-URL verify key by
      # thumbprint from exchange-b's WBA directory, not from fora.json.
      EXCHANGE_URL: "http://exchange-b:8081"
      EXCHANGE_WBA_URL: "https://exchange-b/.well-known/http-message-signatures-directory"
      ORIGIN_URL: *origin-music
      # Binding enforcement stated explicitly; see the cloudflare edge above.
      FORA_ENFORCE_BINDING: "true"
      # No document settings: the music publisher's fora.json and rsl.txt are
      # served by its origin (x-origin-music).
    volumes:
      - tls-ca:/tls-ca:ro
    networks:
      default:
        aliases:
          # Harmonia Records music publisher → Fastly ed25519 edge.
          - music.demo.fora-protocol.org
    depends_on:
      # Music publisher fronts exchange-b (ripdi).
      exchange-b:
        condition: service_started
      publisher:
        condition: service_healthy
    # Viceroy can report "Listening" before the TCP socket accepts
    # connections cleanly. Poll until the server answers so downstream
    # services (Exchange manifestcache, runner) don't race it. Image ships
    # node but no curl/wget, so the probe uses node's http.
    healthcheck: *edge-healthcheck

  aws-edge:
    # CloudFront canned-policy signed-URL verifier stand-in. Proves the
    # RSA chain round-trip locally without a real CloudFront distro. Built from
    # the repo root so the shared src/edge/src/well-known.mjs module can
    # be copied into the image (the shim imports it rather than duplicating it).
    build:
      context: .
      dockerfile: tests/e2e/aws-edge/Dockerfile
    # WBA_KEYS_JSON for the sfx publisher's self-publish key (no kid; named by
    # thumbprint), generated by scripts/gen-e2e-keys.sh. The raw-Node shim reads
    # it from env and serves it in the WBA directory's keys[] (fcrk7).
    env_file:
      - ./deploy/edge-keys/aws-edge.env
    # AWS CloudFront RSA edge shim listens on port 80 so the sfx demo domain
    # alias resolves natively for the port-80 manifest + content fetches. Root
    # user so node can bind the privileged port.
    user: "0:0"
    # Its calls to the Exchange, including the https fetch of its key
    # directory, run through the capture proxy; see x-through-capture-proxy.
    extra_hosts: *through-capture-proxy
    environment:
      # Trusts the local CA tls-keygen mints (x-tls-edge-trust).
      <<: *tls-edge-trust
      # Multi-exchange topology (ripdi): the sfx publisher is fronted by
      # exchange-c. Its fora.json names exchange-c so the broker routes sfx
      # offers there, and the sfx catalog is ingested into exchange-c's DB.
      EXCHANGE_URL: "http://exchange-c:8081"
      # The sfx publisher's fora.json is served by its origin, which the shim
      # forwards the address to like the content (x-origin-sfx).
      ORIGIN_URL: *origin-sfx
      PORT: "80"
      # CloudFront RSA verify key, read from the file the rsa-keygen one-shot
      # writes into the shared volume — the matching public half of the Exchange's
      # FORA_RSA_PRIVATE_PEM_FILE (trusted key group model; the cdn-keys.json
      # route is retired, D4). No longer committed to git.
      # Multi-exchange topology (ripdi): the sfx publisher is fronted by
      # exchange-c, which signs URLs with rsa-c-private.pem — so this shim must
      # verify against rsa-c-public.pem (exchange-c's RSA public half), not
      # exchange-a's.
      FORA_CF_PUBLIC_PEM_FILE: "/rsa-keys/rsa-c-public.pem"
    volumes:
      - rsa-keys:/rsa-keys:ro
      - tls-ca:/tls-ca:ro
    networks:
      default:
        aliases:
          # FoleyWorks SFX publisher → AWS CloudFront RSA edge.
          - sfx.demo.fora-protocol.org
    depends_on:
      # SFX publisher fronts exchange-c (ripdi).
      exchange-c:
        condition: service_started
      publisher:
        condition: service_healthy
      rsa-keygen:
        condition: service_completed_successfully
    healthcheck: *edge-healthcheck

  # ───── Lambda@Edge (AWS Lambda runtime emulator) ─────────────────────
  # The REAL src/edge worker running inside the AWS Lambda runtime image, as the
  # Lambda@Edge package a deployment would upload: built by
  # src/edge/scripts/build-lambda-edge.mjs, with the per-deployment config in
  # the package's index.mjs (Lambda@Edge has no environment variables, which is
  # why nothing is configured here — see tests/e2e/lambda-edge/write-configs.mjs).
  #
  # This is NOT the aws-edge service above. That one is a hand-written
  # CloudFront-RSA verifier stand-in covering a different signature chain and it
  # never executes src/edge code; this one is the Ed25519 worker itself on the
  # third runtime it ships for.
  #
  # Reached ONLY through the Lambda invoke endpoint
  # (POST /2015-03-31/functions/function/invocations, port 8080), so it takes no
  # publisher-domain network alias: ordinary HTTP is not a thing this runtime
  # speaks. The harness builds CloudFront viewer-request events and reads the
  # returned JSON — a pass-through comes back as the request object, a denial as
  # a generated response.
  #
  # No ORIGIN_URL is baked, which is the CloudFront-native posture: CloudFront
  # owns the origin fetch and the function hands an authorized request back to
  # it. EXCHANGE_WBA_URL points at exchange-a, so delivery-URL verify keys are
  # resolved by fetching that directory over this network, the same way
  # production resolves them.
  lambda-edge:
    build:
      context: .
      dockerfile: tests/e2e/lambda-edge/Dockerfile
    # Its calls to the Exchange, including the https fetch of its key
    # directory, run through the capture proxy; see x-through-capture-proxy.
    extra_hosts: *through-capture-proxy
    # The function's configuration is baked into its package; this is the
    # runtime's own trust store, which the container sets.
    environment:
      # Trusts the local CA tls-keygen mints (x-tls-edge-trust).
      <<: *tls-edge-trust
    volumes:
      - tls-ca:/tls-ca:ro
    depends_on:
      exchange:
        condition: service_started
    # The probe opens a TCP connection to the emulator's invoke port and closes
    # it. It deliberately does NOT invoke the function: the emulator serves one
    # invocation at a time, and a probe that lands on top of the harness's
    # invocation makes the emulator abort that request and exit, taking the
    # container down in the middle of a suite. Docker runs this for the
    # container's whole life (see x-health-timing), so an invoking probe would
    # collide eventually. That the bundle actually answers is proven at image build
    # (each bundle is smoke-invoked) and once per service by the harness before
    # any test runs; the probe script says more about what that leaves open.
    healthcheck:
      <<: *health-timing
      test: ["CMD", "node", "/opt/healthcheck.mjs"]

  # The same image, running the package built WITHOUT a publisher signing key,
  # which the image keeps in no-wba/ (its own index.mjs beside its own bundle).
  # The WBA directory route has two answers — the JWK Set above, 404 here — and a
  # Lambda container serves exactly one handler, so covering both postures
  # takes two containers. Everything else about the two configs is identical.
  lambda-edge-no-wba:
    build:
      context: .
      dockerfile: tests/e2e/lambda-edge/Dockerfile
    command: ["no-wba/index.handler"]
    # Its calls to the Exchange, including the https fetch of its key
    # directory, run through the capture proxy; see x-through-capture-proxy.
    extra_hosts: *through-capture-proxy
    # The function's configuration is baked into its package; this is the
    # runtime's own trust store, which the container sets.
    environment:
      # Trusts the local CA tls-keygen mints (x-tls-edge-trust).
      <<: *tls-edge-trust
    volumes:
      - tls-ca:/tls-ca:ro
    depends_on:
      exchange:
        condition: service_started
    healthcheck:
      <<: *health-timing
      test: ["CMD", "node", "/opt/healthcheck.mjs"]

  # Wildcard DNS for the two agent zones. Each agent gets a random subdomain
  # that the Broker/Exchange must resolve to fetch the agent's WBA directory and
  # verify its signature. The slug is random, so no static per-agent alias is
  # possible; this resolves each whole zone to the capture proxy, which routes
  # the zone on to the one service that serves it (CAPTURE_ZONES), and forwards
  # everything else to Docker's embedded DNS (127.0.0.11), which answers the
  # compose service names and the demo-domain aliases. dnsmasq is installed
  # at start from the alpine mirror (no bespoke image to pull/pin).
  #
  # Each zone is named twice: --address gives its A answer, and --local keeps
  # every other query for it inside this sidecar. dnsmasq 2.90 answers only the
  # record type an --address gives, so without --local an AAAA query for a zone
  # name is forwarded through Docker's DNS to the box's resolvers and out to the
  # public internet. foramcp.org is a real public domain, so that AAAA lookup
  # took a round trip to its public servers and sometimes stalled for a full
  # resolver timeout (4 to 5 s), long enough to run out an Exchange's agent-
  # directory fetch. With --local, the AAAA query gets an immediate answer with
  # no address, and no zone name can pick up an IPv6 address from outside.
  #   * <slug>.foramcp.org: agents the identity service registers;
  #   * <slug>.agents.example: the e2e suite's per-test agents, served by
  #     agent-directory;
  #   * <slug>.sites.example: the e2e suite's per-test publisher sites, served
  #     by sites.
  # The sidecar answers all three with the capture proxy's address
  # (x-capture-proxy-address). test_guards_identity_lists.py fails when the
  # agents.example answer here is not the proxy's address, or when the proxy
  # does not route that zone to agent-directory; test_guards_publisher_sites.py
  # does the same for sites.example and the sites service.
  # test_guards_identity_lists.py also fails when a zone with an --address has
  # no matching --local.
  dns:
    image: alpine:3.20
    command:
      - sh
      - -c
      - "apk add --no-cache dnsmasq >/dev/null 2>&1 && exec dnsmasq -k --log-facility=- --no-resolv --server=127.0.0.11 --local=/foramcp.org/ --local=/agents.example/ --local=/sites.example/ --address=/foramcp.org/${FORA_E2E_NET}.187 --address=/agents.example/${FORA_E2E_NET}.187 --address=/sites.example/${FORA_E2E_NET}.187"
    cap_add:
      - NET_ADMIN
    networks:
      default:
        ipv4_address: ${FORA_E2E_NET}.153
    # Ready once dnsmasq answers (the apk install adds a few seconds of startup);
    # backends gate on this so they never start before their resolver is up.
    healthcheck:
      <<: *health-timing
      test: ["CMD-SHELL", "nslookup ready.foramcp.org 127.0.0.1 >/dev/null 2>&1 || exit 1"]

  # The key directories of the e2e suite's per-test agents (ADR-028 D7). A test
  # mints an agent with its own key and a random host under agents.example,
  # registers the agent's directory here over HTTP, and signs as that host. The
  # wildcard-DNS sidecar above resolves every agents.example name to the capture
  # proxy, which routes it to this container, and this container answers each
  # host with the directory registered for it.
  # The registry is in memory: nothing is shared through a database or a volume.
  # See tests/e2e/agent-directory/server.py.
  agent-directory:
    image: python:3.12-alpine
    command: ["python", "/app/server.py"]
    environment:
      AGENT_ZONE: "agents.example"
    volumes:
      - ./tests/e2e/agent-directory/server.py:/app/server.py:ro
    networks:
      default:
        ipv4_address: ${FORA_E2E_NET}.184
    healthcheck:
      <<: *health-timing
      test: ["CMD-SHELL", "wget -q -O- http://127.0.0.1/healthz || exit 1"]

  # The origins of the e2e suite's per-test publisher sites. A publisher test
  # claims a fresh host under sites.example, registers the files that site
  # serves here over HTTP (its home page, the discovery document the console
  # handed it, its sitemap and its pages), and registers the domain in the
  # console. The wildcard-DNS sidecar above resolves every sites.example name to
  # the capture proxy, which routes it to this container, and this container
  # answers each host with the files registered for it, under the response
  # header the console's CDN detection reads as Cloudflare.
  # The registry is in memory, like agent-directory's. See
  # tests/e2e/sites/server.py.
  #
  # The address sits in the upper half of the stack's /24, outside Docker's
  # automatic range, so no container started without a static address can be
  # handed it first.
  sites:
    image: python:3.12-alpine
    command: ["python", "/app/server.py"]
    environment:
      SITE_ZONE: "sites.example"
    volumes:
      - ./tests/e2e/sites/server.py:/app/server.py:ro
    networks:
      default:
        ipv4_address: ${FORA_E2E_NET}.185
    healthcheck:
      <<: *health-timing
      test: ["CMD-SHELL", "wget -q -O- http://127.0.0.1/healthz || exit 1"]

  # The e2e suite's Exchange impostor, for the Broker's fault paths. The
  # reference Exchanges never refuse a whole sub-request, drop a connection,
  # stall past the Broker's deadline or answer with the wrong number of items,
  # so the relay obligations that describe what the Broker does then need a
  # party that does. It answers as three identities, each a network alias of
  # this container:
  #   * misbehaving-exchange:8081, in the Broker's registry as VERIFIED, so the
  #     Broker sends it purchases; a test picks how it answers its own agent's
  #     sub-requests through the impostor's control routes;
  #   * unapproved-exchange:8081, in the registry as DISCOVERED: live, but not
  #     approved for purchases;
  #   * unlisted-exchange:8081, in no registry at all.
  # Each identity issues offers it signs with its own key, so an agent's SDK
  # verifies them like any Exchange's. The registry entries are in
  # tests/e2e/harness/fixtures/broker_registry.yml. See
  # tests/e2e/misbehaving-exchange/main.go.
  #
  # Its address is static, beside the sites service's, in the upper half of the
  # stack's /24 where every static address in this file sits (see the address
  # plan beside `networks:` at the bottom).
  misbehaving-exchange:
    build:
      context: .
      dockerfile: tests/e2e/misbehaving-exchange/Dockerfile
      args: *go-build-args
    environment:
      IMPOSTOR_IDENTITIES: "misbehaving-exchange:8081,unapproved-exchange:8081,unlisted-exchange:8081"
    networks:
      default:
        ipv4_address: ${FORA_E2E_NET}.186
        aliases:
          - unapproved-exchange
          - unlisted-exchange
    healthcheck:
      <<: *health-timing
      test: ["CMD", "/misbehaving-exchange", "healthcheck"]

  # The capture proxy (ADR-028 D8 H12): every request a service carrying the
  # x-through-capture-proxy entries sends the Broker or an Exchange arrives here,
  # is recorded with its bytes, and goes on unchanged to the party its Host
  # names. It listens on the ports those parties listen on (CAPTURE_PORTS) and
  # serves the record to the harness on its control listener
  # (harness/capture_proxy.py). It holds no state outside its own memory, and
  # needs no other service to start: it resolves each party when a request for
  # it arrives. See tests/e2e/capture-proxy/main.go.
  capture-proxy:
    build:
      context: .
      dockerfile: tests/e2e/capture-proxy/Dockerfile
      args: *go-build-args
    # Root, for the two privileged ports it listens on (80 and 443) and the TLS
    # key tls-keygen leaves readable by root only.
    user: "0"
    environment:
      # Every port a party listens on: the Exchanges (8081), the Broker and the
      # Exchanges' admin listeners (8082), the console (8085), the edges and
      # key-directory hosts (80), and 443 for https to a name with no port. Each
      # answers plain http and https alike: an Exchange named exchange:8081
      # serves its key directory at https://exchange:8081.
      CAPTURE_PORTS: "80,443,8081,8082,8085"
      CAPTURE_CONTROL_ADDR: ":9090"
      # The certificate every port answers https with, minted by tls-keygen.
      CAPTURE_TLS_CERT: "/tls-proxy/proxy.crt"
      CAPTURE_TLS_KEY: "/tls-proxy/proxy.key"
      # The service behind each wildcard zone the DNS sidecar points here.
      CAPTURE_ZONES: "foramcp.org=identity,agents.example=agent-directory,sites.example=sites"
      # The plain-http port behind https for each party that does not serve on
      # 80. Every other name is forwarded to port 80.
      CAPTURE_TLS_PORTS: "broker=8082,exchange=8081,exchange-b=8081,exchange-c=8081,exchange-d=8081,console=8085,misbehaving-exchange=8081,unapproved-exchange=8081,unlisted-exchange=8081"
    volumes:
      - tls-proxy-keys:/tls-proxy:ro
    depends_on:
      tls-keygen:
        condition: service_completed_successfully
    networks:
      default:
        ipv4_address: *capture-proxy-address
    healthcheck:
      <<: *health-timing
      test: ["CMD", "/capture-proxy", "healthcheck"]

  # ───── Identity Service (registry / MCP adapter) ──────────────────
  # The Go service that replaced the Python shim. It custodies each agent's key
  # (identity-vault), provisions agents through real OIDC sign-up (zitadel), hosts
  # each agent's WBA directory on its subdomain, and exposes the MCP endpoint the
  # harness drives. See tests/e2e/harness/test_mcp_endpoint.py.
  identity-vault:
    image: hashicorp/vault:1.20
    cap_add:
      - IPC_LOCK
    environment:
      VAULT_DEV_ROOT_TOKEN_ID: *identity-vault-root-token
      VAULT_DEV_LISTEN_ADDRESS: 0.0.0.0:8200
    # Dev mode auto-unseals and enables a KV v2 mount at `secret/`, which the
    # identity KeyStore uses (IDENTITY_KV_MOUNT=secret). Not for production; the
    # real deploy runs a sealed Vault with a real auth method. The root token
    # goes only to identity-vault-init below and to the test runner, never to
    # the identity service.
    command: ["server", "-dev"]
    healthcheck:
      <<: *health-timing
      test: ["CMD", "vault", "status", "-address=http://127.0.0.1:8200"]

  # One-shot: writes the Identity Service's policy from the shared template and
  # creates the scoped token the identity service uses, then checks that the
  # token carries only that policy. See tests/e2e/identity-vault-init.sh.
  identity-vault-init:
    image: hashicorp/vault:1.20
    entrypoint: ["sh", "/identity-vault-init.sh"]
    environment:
      VAULT_ADDR: "http://identity-vault:8200"
      VAULT_TOKEN: *identity-vault-root-token
      IDENTITY_KV_MOUNT: *identity-kv-mount
      IDENTITY_VAULT_TOKEN_ID: *identity-vault-token
    volumes:
      - ./tests/e2e/identity-vault-init.sh:/identity-vault-init.sh:ro
      - ./deploy/storage/vault/identity-policy.hcl:/identity-policy.hcl:ro
    depends_on:
      identity-vault:
        condition: service_healthy

  zitadel-db:
    image: postgres:17-alpine
    # It matters more here than for the `postgres` service: Zitadel's event store
    # writes hard through start-from-init, and none of it outlives the stack.
    <<: *ephemeral-postgres
    environment:
      POSTGRES_USER: zitadel
      POSTGRES_PASSWORD: zitadel
      POSTGRES_DB: zitadel
    healthcheck:
      <<: *health-timing
      test: ["CMD-SHELL", "pg_isready -U zitadel -d zitadel"]

  # In-network OIDC provider. ExternalDomain=zitadel so the issuer is
  # http://zitadel:8080 — resolvable by identity over the compose network (the dev
  # stack in docker-compose.yml bakes localhost instead, for a laptop browser).
  zitadel:
    image: ghcr.io/zitadel/zitadel:v3.4.9
    command:
      - start-from-init
      - --masterkey
      - MasterkeyNeedsToHave32Characters
      - --tlsMode
      - disabled
      - --steps
      - /etc/zitadel/init-steps.yaml
    environment:
      ZITADEL_EXTERNALDOMAIN: zitadel
      ZITADEL_EXTERNALPORT: "8080"
      ZITADEL_EXTERNALSECURE: "false"
      ZITADEL_PORT: "8080"
      ZITADEL_TLS_ENABLED: "false"
      ZITADEL_DATABASE_POSTGRES_HOST: zitadel-db
      ZITADEL_DATABASE_POSTGRES_PORT: "5432"
      ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
      ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: zitadel
      ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: zitadel
      ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
      # The System API user that creates the publisher instance. Zitadel reads
      # the public key at the user's first call, so the key one-shot below may
      # write it after Zitadel has started.
      ZITADEL_SYSTEMAPIUSERS: '{"fora-instance-admin":{"Path":"/systemapi/public.pem"}}'
      # Every instance's mail goes to mailpit. Zitadel reads these settings
      # when it creates an instance: the developer one at its first start, the
      # publisher one when the System API creates it.
      ZITADEL_DEFAULTINSTANCE_SMTPCONFIGURATION_SMTP_HOST: mailpit:1025
      ZITADEL_DEFAULTINSTANCE_SMTPCONFIGURATION_SMTP_USER: ""
      ZITADEL_DEFAULTINSTANCE_SMTPCONFIGURATION_SMTP_PASSWORD: ""
      ZITADEL_DEFAULTINSTANCE_SMTPCONFIGURATION_TLS: "false"
      ZITADEL_DEFAULTINSTANCE_SMTPCONFIGURATION_FROM: noreply@zitadel.example
      ZITADEL_DEFAULTINSTANCE_SMTPCONFIGURATION_FROMNAME: FORA
    user: "0"
    volumes:
      - ./deploy/zitadel/init-steps.yaml:/etc/zitadel/init-steps.yaml:ro
      - zitadel-bootstrap:/bootstrap
      - zitadel-systemapi:/systemapi:ro
    networks:
      default:
        # The publisher instance's address. Zitadel picks the instance from
        # the Host header, so this second name reaches the second instance.
        aliases: [zitadel-publishers]
    depends_on:
      zitadel-db:
        condition: service_healthy
      mailpit:
        condition: service_healthy

  # Catches every email both Zitadel instances send, so the sign-up suites can
  # read the codes in them: SMTP on 1025, its API on 8025, in-network only.
  mailpit:
    image: axllent/mailpit:v1.31.4
    healthcheck:
      <<: *health-timing
      test: ["CMD", "/mailpit", "readyz"]

  # One-shot: provisions the developer instance — the `fora` project, the
  # confidential `fora-identity` OIDC client with redirect URI
  # http://identity/callback, and the local login users; writes the minted
  # client id/secret to the shared bootstrap volume, which identity reads via
  # IDENTITY_OIDC_CLIENT_ID/SECRET_FILE.
  zitadel-init:
    image: curlimages/curl:8.11.1
    entrypoint: ["sh", "/zitadel/bootstrap.sh"]
    user: "0"
    environment:
      ZITADEL_INSTANCE_ROLE: developers
      ZITADEL_BASE_URL: http://zitadel:8080
      ZITADEL_INSTANCE_HOST: zitadel
      ZITADEL_ISSUER: http://zitadel:8080
      IDENTITY_AUTH_ISSUER: *identity-issuer
      # Zitadel migrations can take over a minute under Docker-in-Docker.
      WAIT_SECONDS: 180
    volumes:
      - ./deploy/zitadel/bootstrap:/zitadel:ro
      - zitadel-bootstrap:/bootstrap
    depends_on:
      zitadel:
        condition: service_started

  # One-shot: the System API key this stack's Zitadel trusts, and a token from
  # it that lives five minutes. It runs once the developer instance is up, so
  # the token is fresh when the next step uses it.
  zitadel-system-key:
    image: alpine/openssl:3.3.2
    entrypoint: ["sh", "/zitadel/local-system-key.sh"]
    user: "0"
    environment:
      AUDIENCE: http://zitadel:8080
      KEY_DIR: /systemapi
    volumes:
      - ./deploy/zitadel/bootstrap:/zitadel:ro
      - zitadel-systemapi:/systemapi
    depends_on:
      zitadel-init:
        condition: service_completed_successfully

  # One-shot (publishers.sh): creates the publisher instance at
  # zitadel-publishers through the System API (or finds it), then provisions
  # it — the console's OIDC client, the admin and alice — and writes the
  # console's client id/secret to the console's own volume.
  zitadel-publishers-init:
    image: curlimages/curl:8.11.1
    entrypoint: ["sh", "/zitadel/publishers.sh"]
    user: "0"
    environment:
      ZITADEL_BASE_URL: http://zitadel:8080
      ZITADEL_INSTANCE_HOST: zitadel-publishers
      ZITADEL_PAT_FILE: /publishers/bootstrap.pat
      ZITADEL_SYSTEM_TOKEN_FILE: /systemapi/token
      ZITADEL_ISSUER: http://zitadel-publishers:8080
      CONSOLE_PUBLIC_ORIGIN: *console-origin
      CONSOLE_OUT_DIR: /console-oidc
      # Local-stack value in a tracked file, like the developer instance's
      # admin password in deploy/zitadel/init-steps.yaml.
      ZITADEL_ADMIN_PASSWORD: Publisher-Admin-1!
    volumes:
      - ./deploy/zitadel/bootstrap:/zitadel:ro
      - zitadel-systemapi:/systemapi:ro
      - zitadel-publishers:/publishers
      - console-oidc:/console-oidc
    depends_on:
      zitadel-system-key:
        condition: service_completed_successfully

  identity:
    build:
      context: .
      dockerfile: src/identity/Dockerfile
      # The e2e image adds the operator's revocation CLI, identity-operator, which
      # the suite runs inside this container to revoke an agent's key the way an
      # operator would. The production target does not carry it.
      target: e2e
      args: *go-build-args
    # Runs on :80 as root so the WBA directory it hosts is reachable at the
    # agent's bare subdomain (http://<slug>.foramcp.org, port 80) — the origin the
    # Broker/Exchange resolve from the signed Signature-Agent header. The distroless
    # nonroot default cannot bind a privileged port; e2e overrides it.
    user: "0"
    # Its requests to the Broker and the Exchanges run through the capture
    # proxy; see x-through-capture-proxy.
    extra_hosts: *through-capture-proxy
    environment:
      IDENTITY_ADDR: ":80"
      IDENTITY_DSN: "postgres://fora:fora@postgres:5432/identity?sslmode=disable"
      IDENTITY_LOG_LEVEL: "INFO"
      VAULT_ADDR: "http://identity-vault:8200"
      # The scoped token identity-vault-init created, never root. If that
      # container fails, this service does not start.
      VAULT_TOKEN: *identity-vault-token
      IDENTITY_KV_MOUNT: *identity-kv-mount
      IDENTITY_BASE_DOMAIN: "foramcp.org"
      IDENTITY_WELLKNOWN_SCHEME: "https"
      IDENTITY_OIDC_ISSUER: "http://zitadel:8080"
      IDENTITY_OIDC_CLIENT_ID_FILE: "/bootstrap/identity_client_id"
      IDENTITY_OIDC_CLIENT_SECRET_FILE: "/bootstrap/identity_client_secret"
      IDENTITY_OIDC_SCOPES: "openid profile email"
      <<: *identity-auth
      IDENTITY_MCP_BROKER_URL: "http://broker:8082"
      # No Exchange is configured, deliberately: the account tools take the
      # target per call and resolve its endpoint from that Exchange's own
      # manifest. What IS set is the policy — which Exchanges this deployment
      # will speak to at all. It names all four in this stack, so the lever is
      # exercised in its production posture rather than left empty; another
      # Exchange added to this file has to be added here too.
      IDENTITY_MCP_EXCHANGE_ALLOWLIST: "exchange:8081,exchange-b:8081,exchange-c:8081,exchange-d:8081"
      IDENTITY_MCP_WELLKNOWN_SCHEME: "http"
      # The report leg fetches the offer's exchange well-known over the private
      # compose network, so allow private targets (as the exchanges/broker do).
      # The SSRF guard is SDK-owned and reads these two flags; the old
      # FORA_FETCH_INSECURE_ALLOW_PRIVATE knob left with the in-repo guard.
      # Both MUST stay unset in production.
      SKIP_SSRF: "true"
      ALLOW_INSECURE: "true"
      # Trusts the local CA tls-keygen mints (x-tls-ca-bundle).
      SSL_CERT_FILE: *tls-ca-bundle
    volumes:
      - zitadel-bootstrap:/bootstrap:ro
      - tls-ca:/tls-ca:ro
    # Its static address is in the address plan beside `networks:` at the
    # bottom. The wildcard-DNS sidecar answers *.foramcp.org with the capture
    # proxy's address, and the proxy routes that zone here by name
    # (CAPTURE_ZONES).
    networks:
      default:
        ipv4_address: ${FORA_E2E_NET}.183
    # No healthcheck: distroless image ships only the /identity binary — no shell,
    # no wget/curl (same as exchange/broker). Readiness is gated by the harness,
    # which polls /healthz before driving the MCP endpoint.
    depends_on:
      capture-proxy:
        condition: service_healthy
      postgres:
        condition: service_healthy
      identity-vault-init:
        condition: service_completed_successfully
      zitadel-init:
        condition: service_completed_successfully

  console:
    build:
      context: .
      dockerfile: src/console/Dockerfile
      args: *go-build-args
    # The console reads a publisher's own site to tell which CDN serves it, and
    # the e2e suite's publisher sites live under sites.example, which only the
    # wildcard-DNS sidecar resolves.
    dns: *wildcard-dns
    # Its requests to the Broker and the Exchanges run through the capture
    # proxy; see x-through-capture-proxy.
    extra_hosts: *through-capture-proxy
    environment:
      CONSOLE_ADDR: ":8085"
      CONSOLE_DSN: "postgres://fora:fora@postgres:5432/console?sslmode=disable"
      CONSOLE_LOG_LEVEL: "INFO"
      # All zeroes, the same shape the identity token key in this stack uses:
      # unmistakably not a secret, and fixed so a restart does not sign the
      # harness out mid-run. A real deployment reads a generated key from its
      # secret store; the console's configuration document says why there is no
      # generated fallback.
      CONSOLE_SESSION_KEY: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
      CONSOLE_SIGNING_KEY_FILE: "/keys/console-signing-key.pem"
      CONSOLE_PUBLIC_ORIGIN: *console-origin
      # The https origin the console signs its Exchange calls as; the capture
      # proxy answers https for "console" and forwards to this service.
      CONSOLE_DIRECTORY_ORIGIN: "https://console"
      # Publishers sign in through their own Zitadel instance.
      CONSOLE_OIDC_ISSUER: "http://zitadel-publishers:8080"
      CONSOLE_OIDC_CLIENT_ID_FILE: "/console-oidc/console_client_id"
      CONSOLE_OIDC_CLIENT_SECRET_FILE: "/console-oidc/console_client_secret"
      CONSOLE_OIDC_SCOPES: "openid profile email"
      CONSOLE_OIDC_REDIRECT_URL: "http://console:8085/auth/callback"
      CONSOLE_EXCHANGE_URL: "http://exchange:8081"
      CONSOLE_EXCHANGE_DOMAIN: "exchange:8081"
      CONSOLE_EXCHANGE_WBA_URL: "http://exchange:8081/.well-known/http-message-signatures-directory"
      CONSOLE_CONTRIBUTOR_HOST: "catalog-contributor-e2e"
      CONSOLE_EDGE_RELEASE_REF: "e2e"
      CONSOLE_SUPPORT_EMAIL: "help@exchange.example"
      CONSOLE_FETCH_SCHEME: "http"
      # The console reads publishers' own sites over this private network, so
      # the address guard and the plaintext refusal are both relaxed here. Both
      # MUST stay unset in production.
      SKIP_SSRF: "true"
      ALLOW_INSECURE: "true"
      # Trusts the local CA tls-keygen mints (x-tls-ca-bundle).
      SSL_CERT_FILE: *tls-ca-bundle
    volumes:
      - console-oidc:/console-oidc:ro
      - console-keys:/keys:ro
      - tls-ca:/tls-ca:ro
    depends_on:
      capture-proxy:
        condition: service_healthy
      dns:
        condition: service_healthy
      postgres:
        condition: service_healthy
      zitadel-publishers-init:
        condition: service_completed_successfully
      console-keygen:
        condition: service_completed_successfully

  console-keygen:
    # Mints the console's Ed25519 signing key. The console serves the public
    # half itself, at its own key directory, so nothing else has to be kept in
    # step with it.
    image: alpine/openssl:3.3.2
    entrypoint: ["sh", "/console-keygen.sh"]
    user: "0"
    volumes:
      - ./deploy/console-keys/keygen.sh:/console-keygen.sh:ro
      - console-keys:/keys

  # The automatic catalog importer, shaped as the production template shapes it
  # (deploy/terraform/modules/compose-stack/templates/docker-compose.yml.tftpl):
  # the Exchange's own image run through its second entrypoint, behind a profile
  # so `docker compose up` never starts it, with the contributor key mounted
  # read-only and the same denomination as the seat it imports for. It is a job,
  # not a daemon: production runs it from a timer, and the e2e harness runs it
  # when a test needs an import (harness/importer.py, run_import), from this
  # definition and the image the running exchange service was built from. Both
  # build from one Dockerfile, so that is the image this service names.
  #
  # The contributor is catalog-contributor-e2e, the host every manifest the
  # console generates authorizes. Its key directory is served by
  # key-directories, which mounts the same key file to publish the public half;
  # no other service mounts it, the Exchange included.
  #
  # SKIP_SSRF and ALLOW_INSECURE let the sitemap fetch reach the publisher sites
  # on this private, plain-http network, as they let every other service here
  # fetch over it. Both MUST stay unset in production.
  importer:
    build:
      context: .
      dockerfile: src/exchange/Dockerfile
      target: e2e
      args: *go-build-args
    entrypoint: ["/fora-import"]
    profiles: ["importer"]
    restart: "no"
    dns: *wildcard-dns
    environment:
      EXCHANGE_DSN: "postgres://fora:fora@postgres:5432/fora?sslmode=disable"
      EXCHANGE_DOMAIN: "exchange:8081"
      EXCHANGE_LOG_LEVEL: "INFO"
      # Dialled at the exchange's own address on this network, the authority
      # every other contributor's push here is signed over.
      IMPORT_EXCHANGE_URL: "http://exchange:8081"
      IMPORT_KEY_FILE: "/keys/contributor-key.json"
      # The binary's own defaults, written out as the production template does.
      IMPORT_REQUEST_TIMEOUT: "10s"
      IMPORT_MAX_DOC_BYTES: "1048576"
      IMPORT_MAX_DOCUMENTS: "100"
      IMPORT_MAX_RESOURCES: "10000"
      IMPORT_LISTING_TIMEOUT: "5m"
      <<: *terms-denomination
      SKIP_SSRF: "true"
      ALLOW_INSECURE: "true"
    volumes:
      - ./tests/e2e/harness/fixtures/catalog_contributor_key.json:/keys/contributor-key.json:ro

  # ───── Web Bot Auth conformance oracle (TypeScript) ─────────────
  # Cloudflare's web-bot-auth library behind POST /sign, /verify and /import (and
  # GET /healthz), so the harness can check FORA's Web Bot Auth signatures against
  # an implementation FORA did not write (tests/e2e/harness/wba_oracle_ts.py is
  # the client). It holds no state and calls no other service. No host port: only
  # the runner, inside this network, talks to it.
  wba-oracle-ts:
    build:
      context: tests/e2e/wba-oracle-ts
    healthcheck:
      <<: *health-timing
      test: ["CMD", "node", "src/healthcheck.ts"]

  runner:
    # Opt-in: `docker compose --profile test run --rm runner` executes the suite.
    profiles: ["test"]
    build:
      context: .
      dockerfile: tests/e2e/Dockerfile
      args: *go-build-args
      # The harness installs fora-protocol and fora-protocol-sdk from PyPI at the
      # version tests/e2e/pyproject.toml pins, so no sibling build-context is
      # mirrored in.
    environment:
      # The harness now drives some paths through the SDK's own FORA client, and
      # that client refuses to dial anything the rule below does not permit.
      # SKIP_SSRF drops the dial-time address guard, which would otherwise refuse
      # this network's private addresses; ALLOW_INSECURE permits plaintext http,
      # which every service here serves. The Go FORA services that dial out already
      # set both for the same reason — exchange, exchange-b, exchange-c, broker and
      # identity. The runner did not, because its calls used to bypass the guard
      # entirely by not going through the SDK. Those six are the whole set: a
      # reader auditing which containers run with the address guard off should not
      # have to take "all of them" on trust.
      SKIP_SSRF: "true"
      ALLOW_INSECURE: "true"
      # Trusts the local CA tls-keygen mints (x-tls-ca-bundle).
      SSL_CERT_FILE: *tls-ca-bundle
      # The CA alone, for the harness to build a context that trusts nothing
      # else (tests/e2e/harness/local_ca.py).
      FORA_E2E_TLS_CA_FILE: *tls-ca-file
      # The harness mints its own bearer for the MCP-endpoint test, so it needs the
      # SAME issuer and seed the identity service verifies with.
      <<: *identity-auth
      FORA_E2E_REUSE_STACK: "1"
      FORA_E2E_KEEP_UP: "1"
      FORA_E2E_IN_NETWORK: "1"
      FORA_E2E_COMPOSE_FILE: "/runner/docker-compose.e2e.yml"
      # The Vault root token, for test_identity_vault_scope.py. That test reads
      # the identity service's token and mount from the running identity
      # container, not from here, so it checks what the service is given.
      IDENTITY_VAULT_ROOT_TOKEN: *identity-vault-root-token
      # exchange-a's Ed25519 delivery-URL signing key, the private half of the
      # key it publishes in its WBA directory. The Lambda@Edge suite signs its
      # own delivery URLs with it because that runtime cannot be handed one the
      # Exchange minted: CloudFront terminates TLS, so the Lambda adapter always
      # rebuilds the request URL as https, while the Exchange here mints its
      # delivery URLs on http demo domains and the signature covers the scheme.
      # The verify side stays the production path — the edge resolves the key by
      # thumbprint from the Exchange's directory over the network.
      FORA_EXCHANGE_ED25519_PEM_FILE: "/rsa-keys/ed25519-private.pem"
    volumes:
      # Read-only, for the signing key named above. Written by the rsa-keygen
      # one-shot at stack-up; the aws-edge shim consumes the public half of the
      # sibling RSA pair from the same volume.
      - rsa-keys:/rsa-keys:ro
      - tls-ca:/tls-ca:ro
      - ./docker-compose.e2e.yml:/runner/docker-compose.e2e.yml:ro
      # Docker socket bind: lets obligation tests drive container lifecycle
      # (restart, inspect, exec) via the docker-py SDK without depending on
      # a docker CLI in the runner image. Binding the socket rather than
      # installing the CLI keeps the runner image small and avoids pinning a
      # client version against whatever daemon the host happens to run.
      - /var/run/docker.sock:/var/run/docker.sock
      # The revocation obligations write revocations.json through the harness tree
      # (harness/broker_revocations.py), and the broker service above reads THE
      # SAME volume at /revocations (BROKER_REVOCATION_FILE). The mount is what
      # makes the write cross the container boundary. Without it the path
      # resolves inside the runner image's own layer — the directory is there,
      # because COPY brought .gitkeep in, so the write succeeds and the Broker
      # never sees a byte.
      - revocations:/runner/harness/revocations
      # Read-only, for each login-provider instance's admin token, which the
      # suites mint each test's own user with (harness/publisher_accounts.py):
      # the developers' instance's (zadmin.pat) for the MCP agents, the
      # publishers' instance's (bootstrap.pat) for the console publishers. The
      # first volume also carries identity's OIDC client credentials; nothing in
      # the harness reads those.
      - zitadel-bootstrap:/zitadel-bootstrap:ro
      - zitadel-publishers:/zitadel-publishers:ro
    # The wildcard-DNS sidecar, so the runner resolves the per-test agent and
    # publisher-site hosts the way the Exchanges do: the publisher suites read a
    # buying agent's key directory at the agent's own host.
    dns: *wildcard-dns
    # https to every party reaches the capture proxy, as in the services; see
    # x-through-capture-proxy for why the admin listeners are reached by
    # their -admin aliases instead.
    extra_hosts: *through-capture-proxy
    # The one address every Exchange's admin listener admits (x-runner-address).
    networks:
      default:
        ipv4_address: *runner-address
    depends_on:
      wba-oracle-ts:
        condition: service_healthy
      capture-proxy:
        condition: service_healthy
      exchange:
        condition: service_started
      # Multi-exchange topology (ripdi): the seed ingests the music/sfx/archive
      # catalogs into exchange-b/c/d's DBs, so the runner must wait for them too.
      exchange-b:
        condition: service_started
      exchange-c:
        condition: service_started
      exchange-d:
        condition: service_started
      broker:
        condition: service_started
      edge:
        condition: service_healthy
      aws-edge:
        condition: service_healthy
      fastly-edge:
        condition: service_healthy
      lambda-edge:
        condition: service_healthy
      lambda-edge-no-wba:
        condition: service_healthy
      key-directories:
        condition: service_healthy
      agent-directory:
        condition: service_healthy
      sites:
        condition: service_healthy
      misbehaving-exchange:
        condition: service_healthy
      dns:
        condition: service_healthy
      console:
        condition: service_started
      identity:
        condition: service_started

# The stack's own network, created before `up` and removed after `down` by
# scripts/e2e-stack.sh, which also sets the two variables this file reads:
#   FORA_E2E_NETWORK  the network's name, which is the compose project's name;
#   FORA_E2E_NET      the first three octets of the network's /24.
# Every stack gets a /24 of its own, allocated by the Docker daemon from its
# address pools, so two stacks never claim the same subnet. The address plan is
# the same in each, only the prefix differs:
#   .0/25 (.1-.127)   Docker's automatic range (--ip-range): every container
#                     that names no address of its own;
#   .153              the wildcard-DNS sidecar (x-wildcard-dns);
#   .183              identity, which serves the foramcp.org zone;
#   .184              agent-directory, which serves the agents.example zone;
#   .185              sites, which serves the sites.example zone;
#   .186              the Exchange impostor (misbehaving-exchange);
#   .187              the capture proxy, which the x-through-capture-proxy
#                     hosts entries point at (x-capture-proxy-address) and the
#                     sidecar answers all three zones with; it routes each zone
#                     on to the service above that serves it (CAPTURE_ZONES);
#   .211              the ledger (tigerbeetle), which every Exchange dials by
#                     address (EXCHANGE_BILLING_TB_ADDRESS): the TigerBeetle
#                     client does not resolve hostnames;
#   .220              the runner, the one source the Exchanges' admin listeners
#                     admit (x-runner-address).
# Every static address sits outside the automatic range, so no container started
# without one can be handed one first. The Docker daemon refuses a network whose
# subnet overlaps another's, which is why the subnet cannot be written here: a
# fixed one allowed a single stack per daemon.
networks:
  default:
    name: "${FORA_E2E_NETWORK:?FORA_E2E_NETWORK is unset; run the stack through scripts/e2e-stack.sh or the make e2e targets}"
    external: true

volumes:
  # Ephemeral RSA keypair written by rsa-keygen at stack-up (never committed);
  # private half read by the Exchange, public half by the aws-edge shim.
  rsa-keys:
  # Zitadel's Postgres data and the bootstrap volume the init one-shot writes the
  # admin PAT + the minted OIDC client id/secret into (identity reads the latter).
  zitadeldata:
  zitadel-bootstrap:
  # The System API key and token (zitadel-system-key), the publisher instance's
  # admin token, and the console's OIDC client id/secret.
  zitadel-systemapi:
  zitadel-publishers:
  console-oidc:
  # The console's Ed25519 signing key, minted at stack-up and never committed.
  # The console reads the private half and publishes the public one at its own
  # key directory, which the Exchange fetches.
  console-keys:
  # The ledger's data file. `make e2e-down` runs `down -v`, which deletes it, so
  # each stack starts with an empty ledger.
  tigerbeetle-data:
  # The local CA, minted at stack-up by tls-keygen and never committed: the CA
  # certificate and the bundle every client trusts it through.
  tls-ca:
  # The capture proxy's TLS certificate and private key, from the same one-shot.
  # Only the proxy mounts it.
  tls-proxy-keys:
  # The Broker's revocation file, shared with the runner; see the broker service.
  revocations: