docker-1461 — federated local-Docker baseline.

Same semantics. No cloud.

This is the local-Docker analog of the hive-1461 DigitalOcean baseline. The hive toolkit reaches cloud droplets over ssh + systemd; here every in-container probe goes through docker exec and every API probe goes through host-loopback curl over the campaign CA + client cert. Identical wire format, identical governance, identical federation + zero-touch-trust semantics — reproducible by any reviewer with Docker and a host embedder, no DigitalOcean token in sight.

The numbers.

One entrypoint reproduces the whole thing: make 0to60 builds the images, provisions the mesh (seed → TLS → zero-touch → up), runs the verification harness, then runs the full-spectrum suite. make down tears it all back down. Every probe in both harnesses goes over the real TLS+mTLS path; the canonical green reports are committed at deploy/docker-1461/results/.

2 peers + PG/AGE, function-encoded names.

Container names encode each node's function: docker-1461-<function>-<N>. The 2 peers form a W=2-of-N=2 write-quorum mesh on a private bridge; the harness host is the external mTLS client of that mesh, and the alpha/beta agents are distinct X-Agent-Id identities it presents over the published-port TLS path (no separate agent containers — the deliberate difference from the SSH-coupled hive).

The mesh runs on the docker-1461-mesh bridge (172.31.80.0/24, a distinct subnet so it co-exists with other local Docker meshes). The embedder is a host Ollama (nomic-embed-text, 768-dim) reached from the containers via host.docker.internal:11434. All mesh traffic is TLS + mTLS: the peer HTTPS port enforces client_auth_mandatory — a connection is accepted only if the SHA-256 of the client cert's DER bytes is on the mtls-allowlist.txt (fingerprint pinning). One shared client cert authorises the whole mesh; every server cert carries an IP:127.0.0.1 SAN so the host harness connects straight to loopback with no --resolve.

One make target, five provision steps.

Every step is idempotent and re-runnable. make 0to60 = build provision validate test report; make provision = seed tls zerotouch up. The provision steps run in this exact deterministic order:

make validate — 20/20 PASS.

The verification harness exercises the live mesh over the real TLS+mTLS path and emits a JSON + tabular report. Exit status is 0 iff every check is green. Per peer (in-container via docker exec) it asserts binary --version, container docker-health, and single-instance; per peer (over mTLS) it asserts /api/v1/health (status, version, embedder_ready, federation_enabled), storage_backend == postgres, and db_schema_version == 55; and a fleet federation-convergence probe writes a collective-scope marker to peer-1 and reads it back by id on peer-2 over the encrypted path.

Canonical green baseline committed at results/verify-baseline.{json,tsv}: TOTAL=20 PASS=20 FAIL=0 (9 per peer + 2 fleet).

make test — 25/25 across 6 groups.

The full-spectrum suite runs against the live mesh, following a green make validate. Every probe goes over the real TLS+mTLS path and authenticates with x-api-key; throwaway markers land in the _test / _verify / _zerotouch namespaces and are best-effort deleted, so the baseline corpus is never mutated. Canonical green report committed at results/test-full-spectrum.{json,tsv}: TOTAL=25 PASS=25 FAIL=0.

The live AI-NHI loop is the capstone: in the canonical run, OpenRouter (google/gemma-4-26b-a4b-it) returned the term Byzantine fault tolerance, the harness committed it as a collective memory on docker-1461-peer-1, and it converged on docker-1461-peer-2 — a real LLM decision crossing the encrypted mesh and federating cross-peer.

Pinned, deterministic, idempotent, verifiable.

• Pinned artifacts (provision/lib.sh): version 0.7.0, schema v55, EMBED_DIM=768, apache/age:release_PG16_1.6.0, embedder/LLM model ids, every port/name/path — all single-source constants, env-overridable for forks, with no hostname/region/vendor literal baked into any variable name.
• Deterministic topology. Peer name/port/schema/federation-id are pure functions of a 1-based peer index; nothing is hand-enumerated.
• Idempotent. Every step is safe to re-run; the campaign CA + per-peer keys are minted once and reused for stable trust.
• Verifiable. make validate + make test exercise the live mesh over the real TLS+mTLS path and emit JSON + tabular reports; exit 0 iff every check is green.
• Secret hygiene. OPENROUTER_API_KEY (peer LLM + the daemon's effective X-API-Key) is sourced from ~/.env into the compose shell only; the generated Postgres password lives only in the gitignored run dir (mode 0600). Never committed, never echoed, never on a command line.

Build, prove, full-spectrum test.

Reproducibility contract.

Campaign

#1461 — peer-reproducible baseline (local-Docker arm)

Operator

justin@alpha-one.mobi

Authoring agent

Claude (Opus 4.7), AI NHI under operator authority

Host

single local Docker host (Docker Engine + Compose v2)

Daemon image

ai-memory-docker-1461-daemon:latest, features sal,sal-postgres

ai-memory binary sha256

549954985755c706100686b098c3859fa6c60965014b8b55c8ba74c37e6e1854

Schema

v55 (PG16 + Apache AGE 1.6.0 + pgvector)

Embedder

nomic-embed-text (768-dim) via host Ollama (host.docker.internal:11434)

NHI / peer LLM

OpenRouter google/gemma-4-26b-a4b-it

Quorum

W=2-of-N=2 write-quorum mesh across 2 peers

Transport

TLS + mTLS everywhere; client_auth_mandatory fingerprint-pinned allowlist; zero-touch first-party CA trust

Branch

release/v0.7.0

Verification

20/20 PASS · full-spectrum 25/25 PASS · zero FAIL

Tracking issue

#1461 — peer-reproducible install campaign

Other v0.7.0 campaigns.