H-6700: Run the Petrinaut optimizer in the local compose stack

[TimDiekmann]

🌟 What is the purpose of this PR?

Runs the Petrinaut optimizer as part of the local compose stack: docker compose --profile hash up starts it alongside the other services, reachable at http://petrinaut-opt:4004 from the stack and http://localhost:4004 from the host.

🔗 Related links

• H-6700: Add the Petrinaut optimizer to infra/compose/compose.yml under the hash profile (internal)

🚫 Blocked by

• SRE-812: Wire atlas and petrinaut-opt into the deploy service catalog #9032 — adds petrinaut-opt to the deploy service catalog with GHCR publishing; until that is merged and the first image is published, ghcr.io/hashintel/hash/petrinaut-opt does not exist and the compose service cannot pull.

🔍 What does this change?

• infra/compose/compose.yml:
  • new petrinaut-opt service under the hash profile, using the prebuilt GHCR image like the other app-tier services (bind address, port, healthcheck, and non-root user are baked into the image, so no environment:/healthcheck: blocks are needed; no depends_on — the optimizer is self-contained)
  • api service gets HASH_PETRINAUT_OPT_HOST/HASH_PETRINAUT_OPT_PORT, mirroring the production wiring for the upcoming Node-API integration

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

• does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

• are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

• do not affect the execution graph

❓ How to test this?

1. docker compose -f infra/compose/compose.yml --profile hash up petrinaut-opt
2. Wait for the container to report healthy (built-in /status healthcheck)
3. curl http://localhost:4004/status → 200

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview, Comment	Jul 17, 2026 2:55pm
hashdotdesign-tokens	Ready	Preview, Comment	Jul 17, 2026 2:55pm
petrinaut	Ready	Preview, Comment	Jul 17, 2026 2:55pm

[cursor]

PR Summary

Low Risk
Local dev/compose-only infrastructure wiring with no application logic changes; stack pull depends on the GHCR image being published.

Overview
Adds the Petrinaut optimizer to the local Docker Compose hash profile so docker compose --profile hash up runs it with the rest of the app tier.

A new petrinaut-opt service pulls ghcr.io/hashintel/hash/petrinaut-opt, exposes port 4004 (overridable via PETRINAUT_OPT_PORT), and uses the same lightweight pattern as other GHCR app services (restart on failure, no-new-privileges, no extra env/healthcheck in compose).

The api service gets HASH_PETRINAUT_OPT_HOST / HASH_PETRINAUT_OPT_PORT so the Node API can reach the optimizer at petrinaut-opt:4004, matching upcoming production wiring.

^{Reviewed by Cursor Bugbot for commit e26b500. Bugbot is set up for automated code reviews on this repo. Configure here.}

[kube]

Works perfectly. Thanks!