feat(dev): propagate INSECURE_INTERNAL=1 to compose services Maestro starts in dev mode

src/lib/containers/start.go

@@ -18,6 +18,7 @@ package containers
 import (
 	"context"
 	"fmt"
+	"os"
 	"path/filepath"
 	"strings"
 
@@ -69,6 +70,15 @@ func StartContainer(ctx context.Context, item types.RegistryContainer) error {
 		return err
 	}
 
+	// Dev escape hatch (M2 §2): when Maestro itself runs with
+	// INSECURE_INTERNAL=1, start services the dev way too — propagate the flag
+	// into the compose services so infra auto-started by Maestro (e.g. a
+	// resurrected dcntrlized-auth, see infra.go) keeps a plaintext listener
+	// instead of coming up as mTLS against the plaintext dev fleet.
+	if os.Getenv("INSECURE_INTERNAL") == "1" {
+		propagateInsecureInternal(project)
+	}
+
 	// The compose file may reference the image by a short name (e.g.
 	// "testservice") while install pulled it under its full registry reference.
 	// Make sure those short names exist so Up() can find them.
@@ -161,6 +171,23 @@ func injectServiceIdentity(ctx context.Context, project *composetypes.Project, s
 	return nil
 }
 
+// propagateInsecureInternal injects INSECURE_INTERNAL=1 into every non-oneoff
+// compose service when Maestro itself runs in dev mode (the same flag the dev
+// debug composes set). Mirroring those composes keeps peer edges plaintext, so
+// a service auto-installed and started by Maestro (e.g. a resurrected
+// dcntrlized-auth) matches the compose-managed plaintext dev fleet instead of
+// binding an mTLS listener the satellites cannot reach.
+func propagateInsecureInternal(project *composetypes.Project) {
+	for name, s := range project.Services {
+		if isOneoff(s) {
+			continue
+		}
+		s.Environment = mergeEnv(s.Environment, map[string]string{"INSECURE_INTERNAL": "1"})
+		project.Services[name] = s
+	}
+	logger.Info("Dev mode (INSECURE_INTERNAL=1): propagated plaintext escape hatch to %d service(s)", len(project.Services))
+}
+
 // pinAuthFingerprint returns the service's pinned auth fingerprint, fetching
 // and persisting it when the install record does not have one yet (M2 §5).
 // Best-effort: when the auth service is unreachable, it returns "" and the