[Unit]
Description=AI Research Council Minimal Synthetic Controller
Documentation=file:/opt/ai-research-council/r05_6_target_manifest_v1.json
Wants=network-online.target
After=network-online.target
Before=ai-research-council.service
StartLimitIntervalSec=300
StartLimitBurst=5

[Service]
Type=simple
User=ai-council
Group=ai-council
WorkingDirectory=/opt/ai-research-council
Environment=PYTHONDONTWRITEBYTECODE=1
LoadCredential=council_master:/etc/ai-research-council/council-master.key
ExecStart=/usr/bin/python3 -B /opt/ai-research-council/council_controller.py serve --deployment-config /etc/ai-research-council/council.json --relay-policy /opt/ai-research-council/policies/r03_a2_policy_v1.json --core-policy /opt/ai-research-council/policies/r03_core_policy_v1.json --staging-policy /opt/ai-research-council/policies/r03_a3_policy_v1.json --manifest-dir /opt/ai-research-council/room_manifests --state-root /var/lib/ai-research-council/council --master-key-file %d/council_master
Restart=on-failure
RestartSec=5
TimeoutStartSec=30
TimeoutStopSec=20
RuntimeDirectory=ai-council-controller
RuntimeDirectoryMode=0700
UMask=0077
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
DevicePolicy=closed
ProtectSystem=strict
ProtectHome=true
ProtectHostname=true
ProtectClock=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectProc=invisible
ProcSubset=pid
RestrictRealtime=true
RestrictSUIDSGID=true
RestrictNamespaces=true
LockPersonality=true
MemoryDenyWriteExecute=true
CapabilityBoundingSet=
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM
RestrictAddressFamilies=AF_INET AF_UNIX
IPAddressDeny=any
IPAddressAllow=localhost
ReadWritePaths=/var/lib/ai-research-council/council /run/ai-council-controller
InaccessiblePaths=-/etc/ai-research-council/telegram.token -/etc/ai-research-council/config.json -/var/lib/ai-research-council/gateway.sqlite3 -/run/credentials/ai-research-council.service
LimitNOFILE=1024
TasksMax=64
MemoryMax=512M

[Install]
WantedBy=multi-user.target