Simplify Athena operator architecture

platform/mcp/compose.yaml

@@ -180,25 +180,17 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.platform-context
-    image: mike-ai/mcp-platform-context:1.1.0
+    image: mike-ai/mcp-platform-context:2.0.0
     container_name: mike-ai-mcp-platform-context
     environment:
       ATHENA_REPO_ROOT: /knowledge/repo
-      ATHENA_DOCS_ROOT: /workspace/docs
       ATHENA_RUNTIME_FILE: /runtime/runtime.json
-      ATHENA_CONTEXT_STATE: /state
-      # Writes remain confined to docs/*.md and require a prepared proposal
-      # plus its exact confirmation string. The MCP cannot change code,
-      # containers, networking, secrets, Git or recovery bundles.
-      ATHENA_DOC_WRITE_MODE: enabled
     volumes:
       - ${PLATFORM_STACK_DIR:-/opt/mike-ai/stack}:/knowledge/repo:ro
-      - ${PLATFORM_DOCS_DIR:-/opt/mike-ai/stack/docs}:/workspace/docs:rw
       - ${PLATFORM_CONTEXT_RUNTIME_DIR:-/var/lib/mike-ai-platform-context}:/runtime:ro
-      - ${PLATFORM_CONTEXT_STATE_DIR:-/data/mike-ai-platform-context}:/state:rw
-    # The context service has no arbitrary URL input. Its only egress use is a
-    # bounded reachability check of endpoints from config/service-catalog.json.
-    networks: [tools, egress]
+    # Documentation is strictly read-only. Runtime inspection and all changes
+    # belong to the Athena Operator instead of a second maintenance workflow.
+    networks: [tools]
     healthcheck:
       test: ["CMD", "python", "-c", "import socket; s=socket.create_connection(('127.0.0.1',8000),2); s.close()"]
       interval: 30s
@@ -211,7 +203,7 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.athena-operator
-    image: mike-ai/mcp-athena-operator:2.3.4
+    image: mike-ai/mcp-athena-operator:3.0.0
     container_name: mike-ai-mcp-athena-operator
     environment:
       ATHENA_OPERATOR_SOCKET: /operator/operator.sock