# Local and 103 runtime topology

> Last confirmed: 2026-07-26 20:18 CST.
>
> This is the current topology source of truth for local Memind and 103 production. Prefer this document over older migration notes. Older architecture documents may contain historical paths from before the MindSpace split.

## Local Mac

Local Memind connects to native `goosed`, not Colima/Docker `goosed`.

| Item | Value |
|------|-------|
| Runtime type | Native launchd process |
| Service | `com.tkmind.local-goosed` |
| Binary | `/Users/john/Project/tkmind_go/target/release/goosed` |
| Command role | `goosed agent` |
| Port | `18006` only |
| Session store | PostgreSQL `goose_sessions_dev` |

Local ports `18007`-`18009` are not the intended local goosed pool. If they are listening locally, treat that as drift unless a specific local test explicitly opened them.

Local Colima may exist for other workloads, but local Memind/goosed is not supposed to route through the 103-style `goosed-prod-1..9` Colima pool.

## Portal

| Item | Value |
|------|-------|
| Host | `58.38.22.103` |
| Live directory | `/Users/john/Project/Memind` |
| Service | `cn.tkmind.memind-portal` |
| Start script | `/Users/john/Project/Memind/scripts/run-memind-portal-prod.sh` |
| Port | `8081` |
| Health check | `curl http://127.0.0.1:8081/api/status` |
| Upstream goosed pool | `TKMIND_API_TARGETS` → `https://127.0.0.1:18006` … `18014`（9 targets，2026-07-07 确认） |

Portal must be released as a runtime artifact. Do not edit source directly on 103.

### User-level canary (when enabled)

| Item | Value |
|------|-------|
| Stable edge upstream | `105 nginx -> 58.38.22.103:8081` |
| Identity router | `127.0.0.1:18082` |
| Canary edge tunnel | `105 127.0.0.1:19082 -> 103 127.0.0.1:18082` |
| Candidate Portal | `127.0.0.1:18081` |
| Candidate goosed | `127.0.0.1:18015` |
| Release entry | `scripts/release-portal-canary-prod.sh` |
| Rollback entry | `scripts/rollback-portal-canary-prod.sh` |

The stable Portal stays on 8081 and the normal 105 edge path is a direct upstream, not
the retired 19081 tunnel. A canary release starts an isolated 19082 tunnel and changes
the two committed 105 nginx upstreams only after the candidate, router, 103/105 backups,
immutable identity checks, and tunnel checks pass. It then proves stable fallback before
declaring success. Port 18080 is occupied by a separate Memory V2 mock service and must
not be reused.

## MindSpace Service

| Item | Value |
|------|-------|
| Live directory | `/Users/john/MindSpace` |
| Service | `cn.tkmind.mindspace-service` |
| Start script | `/Users/john/MindSpace/scripts/run-mindspace-prod.sh` |
| Port | `8082` |
| Health check | `curl http://127.0.0.1:8082/health` |
| Contract check | `curl http://127.0.0.1:8082/mindspace/v1/contract` |
| Shared Memind root | `MEMIND_SHARED_ROOT=/Users/john/Project/Memind` |

`/Users/john/MindSpace` is the production MindSpace service root. Do not treat `/Users/john/Project/Memind/MindSpace` as the canonical MindSpace service root after the split.

`/health` and `/mindspace/v1/contract` expose the MindSpace service contract
version and build metadata. Production release scripts must reject a service
whose contract version is stale, whose required authority bindings are missing,
or whose `gitSha` does not match the runtime artifact manifest.

## goosed

103 goosed runs in Colima/Docker, not as native launchd processes.

| Item | Value |
|------|-------|
| Docker context | `colima` |
| Compose directory | `/Users/john/Project/goosed-prod` |
| Compose env | `/Users/john/Project/goosed-prod/.env` |
| Image pattern | `tkmind/goosed:prod-${GOOSED_TAG}` |
| Session store | PostgreSQL `memind_sessions` through `GOOSE_SESSION_DB_URL` |
| Session PostgreSQL | **Host** `postgresql@17` on `127.0.0.1:5432` (`/opt/homebrew/var/postgresql@17`) |

**Critical:** Colima goosed reaches the session DB via `host.docker.internal:5432`. If host PostgreSQL is stopped, H5 `/agent/start` hangs ~60s then fails with `pool timed out`, and the UI stays on「正在创建新对话…」. Recovery:

```bash
ssh john@58.38.22.103 'bash /Users/john/Project/goosed-prod/scripts/ensure-goose-session-postgres.sh'
ssh john@58.38.22.103 '/opt/homebrew/opt/postgresql@17/bin/pg_isready -h 127.0.0.1 -p 5432'
```

`cn.tkmind.goosed-monitor`（103）运行 `goosed-prod/scripts/monitor-goosed-containers.mjs`，本地 native goosed 监控用 `scripts/monitor-goosed-fds.mjs`；两者都会在巡检时调用 `ensure-goose-session-postgres.sh`。

Container layout (host port → container `18006`):

| Container | Host port | Container port |
|-----------|-----------|----------------|
| `goosed-prod-1` | `18006` | `18006` |
| `goosed-prod-2` | `18007` | `18006` |
| `goosed-prod-3` | `18008` | `18006` |
| `goosed-prod-4` | `18009` | `18006` |
| `goosed-prod-5` | `18010` | `18006` |
| `goosed-prod-6` | `18011` | `18006` |
| `goosed-prod-7` | `18012` | `18006` |
| `goosed-prod-8` | `18013` | `18006` |
| `goosed-prod-9` | `18014` | `18006` |

All nine host ports must return `ok` from `/status`, and must appear in Portal `.env` `TKMIND_API_TARGETS`.

## PostgreSQL rule

Both local native goosed and 103 Colima goosed persist sessions in PostgreSQL:

- local native goosed: PostgreSQL database `goose_sessions_dev`
- 103 Colima goosed: PostgreSQL database `memind_sessions`

Do not assume a local SQLite session store when debugging current Memind/goosed behavior.

## Important path rule

The canonical production MindSpace service root is:

```text
/Users/john/MindSpace
```

The old monolith path:

```text
/Users/john/Project/Memind/MindSpace
```

is legacy compatibility/storage context only. If Portal or goosed config still points business MindSpace service behavior at the old path, treat that as configuration drift to fix, not as the desired topology.

In particular, check these before debugging missing folders/pages:

```bash
ssh john@58.38.22.103 'grep -E "^(MINDSPACE|MINDSPACE_ROOT|MINDSPACE_SERVICE|MEMIND_SHARED_ROOT)=" /Users/john/Project/Memind/.env /Users/john/Project/goosed-prod/.env 2>/dev/null'
ssh john@58.38.22.103 'launchctl print gui/$(id -u)/cn.tkmind.mindspace-service | grep -E "program =|working directory|MINDSPACE|MEMIND_SHARED"'
ssh john@58.38.22.103 '/opt/homebrew/bin/docker inspect goosed-prod-1 --format "{{json .Mounts}}"'
```

## Current verification commands

```bash
ssh john@58.38.22.103 'curl -fsS http://127.0.0.1:8081/api/status'
ssh john@58.38.22.103 'curl -fsS http://127.0.0.1:8082/health'
ssh john@58.38.22.103 'for p in $(seq 18006 18014); do curl -kfsS https://127.0.0.1:$p/status; echo; done'
ssh john@58.38.22.103 'grep ^TKMIND_API_TARGETS= /Users/john/Project/Memind/.env'
```