[Metropolis P1] Foundation — Containerize, gRPC, NATS, local k8s

[POWDER-RANGER]

Phase 1: Foundation 🧱

Parent epic: #14 (Metropolis Architecture)

Establish the cloud-native substrate: containerization, inter-service communication, event backbone, and local Kubernetes development environment.

---

Deliverables

1.1 Containerization

• Dockerfile for OBLISK core services (multi-stage build)
• docker-compose.yml for local development stack
• .dockerignore optimized for Python builds
• Health check endpoints on all services
• Non-root user execution in containers
• Distroless or Alpine base images where possible

1.2 gRPC Service Layer

• Protobuf definitions: proto/oblisk/v1/agent.proto
• Service: OBLISKAgent with methods:
  • ExecuteTask(TaskRequest) -> TaskResponse
  • StreamEvents(EventStream) -> stream Event
  • GetCapabilities(Empty) -> Capabilities
  • CheckHealth(Empty) -> HealthStatus
• Python gRPC server implementation
• Python async gRPC client
• Server reflection + grpcui support for dev

1.3 NATS Event Mesh

• NATS server deployment (containerized)
• Core NATS for request-reply patterns
• NATS JetStream for persistent queues
• Subject namespaces: oblisk.agent.*, oblisk.vault.*, oblisk.audit.*
• Event schemas (Protobuf or JSON Schema)

1.4 Local Kubernetes

• kind or k3d cluster configuration
• Kustomize manifests for all services
• Namespace isolation: oblisk-system, oblisk-agents
• ConfigMaps for service configuration
• Secrets management (external-secrets operator prep)
• Skaffold for rapid local development loop

1.5 CI/CD Pipeline

• GitHub Actions workflow for container builds
• Multi-arch builds (amd64, arm64)
• Container image signing with Cosign
• Trivy vulnerability scanning in CI
• Image push to GHCR (GitHub Container Registry)

---

Component Diagram

┌─────────────────────────────────────────────────────┐
│                    kind / k3d cluster                │
│                                                      │
│  ┌────────────┐  gRPC   ┌────────────┐              │
│  │  Agent     │────────▶│  Agent     │              │
│  │  Service   │  NATS   │  Service   │              │
│  └─────┬──────┘◀───────┴──────┬─────┘              │
│        │                        │                    │
│        └──────────┬─────────────┘                    │
│                   NATS Server                        │
│                   (JetStream)                        │
└─────────────────────────────────────────────────────┘

---

Infrastructure

# skaffold.yaml
apiVersion: skaffold/v4beta7
kind: Config
build:
  artifacts:
    - image: oblisk-agent
      docker:
        dockerfile: Dockerfile.agent
    - image: oblisk-gateway
      docker:
        dockerfile: Dockerfile.gateway
deploy:
  kubectl: {}

---

Dependencies

Requires: #6 (package layout), #10 (CI hardening)
Blocks: #16 (Towers phase needs containers to orchestrate)

Estimated effort: 6-8 weeks
Priority: P0 — Foundation of everything