feat(config,compose): sdk agents with vault prompt granules and skill plugins, ro vault with rw sub-mounts, beaver-runner

docker-compose.yml

@@ -43,8 +43,10 @@ services:
       CONFIG_PATH: /config/config.py
       DATABASE_URL: postgresql+psycopg://${POSTGRES_USER:-beaver}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-beaver}
       RAYCAST_CONFIG_PATH: /config/config.json
-      IS_SANDBOX: "1"
-      CLAUDE_PTY_SNAPSHOT_DIR: /tmp/cc-pty
+      # Процесс модели: свой uid, свой HOME (там ~/.claude), белый список env
+      # собирает адаптер. В env модели нет DATABASE_URL, POSTGRES_*, *_PAT.
+      CLAUDE_RUNNER_USER: beaver-runner
+      CLAUDE_HOME: /home/beaver-runner
     ports:
       - "${PORT_MESSAGES:-62990}:62990"  # anthropic
       - "${PORT_MCP:-62991}:62991"  # mcp
@@ -52,25 +54,39 @@ services:
       - "${PORT_MARKDOWN:-62993}:62993"  # obsidian companion
     volumes:
       - ./config.py:/config/config.py:ro
-      - ./prompt.md:/config/prompt.md:ro
       - ./config.json:/config/config.json:ro
-      - vault:/vault
-      - claude-home:/root/.claude
+      # §3.7: vault только на чтение, rw - подмонтирования зон агента.
+      - vault:/vault:ro
+      - type: volume
+        source: vault
+        target: /vault/мета/бобер
+        volume:
+          subpath: мета/бобер
+      - type: volume
+        source: vault
+        target: /vault/💬 чаты
+        volume:
+          subpath: 💬 чаты
+      - claude-home:/home/beaver-runner/.claude
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:62990/healthz', timeout=3)"]
+      interval: 30s
+      timeout: 5s
+      start_period: 60s
+      retries: 3
     entrypoint:
       - /bin/sh
       - -c
       - |
         set -e
-        mkdir -p /root/.claude
-        if [ -f /root/.claude.json ] && [ ! -L /root/.claude.json ]; then
-          if [ ! -e /root/.claude/claude.json ]; then
-            mv /root/.claude.json /root/.claude/claude.json
-          else
-            rm /root/.claude.json
-          fi
-        fi
-        [ -e /root/.claude/claude.json ] || echo '{}' > /root/.claude/claude.json
-        ln -sf /root/.claude/claude.json /root/.claude.json
+        runner=beaver-runner
+        mkdir -p /home/$$runner/.claude
+        chown -R $$runner /home/$$runner
+        for d in "/vault/мета/бобер" "/vault/💬 чаты"; do
+          setfacl -R -m "u:$$runner:rwX" -m "d:u:$$runner:rwX" "$$d" \
+            || chown -R $$runner "$$d" \
+            || echo "warning: cannot grant $$runner write access to $$d"
+        done
         exec python -m beaver_gateway
 
 volumes: