diff --git a/docker-compose.yaml b/docker-compose.yaml
index 64eac1fb..d81d65b8 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -47,6 +47,31 @@ services:
       timeout: 5s
       retries: 5
 
+  # ==========================================================================
+  # Backup - periodic pg_dump of the roboco DB (interim; no PITR/WAL yet)
+  # ==========================================================================
+  backup:
+    image: pgvector/pgvector:pg16
+    container_name: roboco-backup
+    restart: unless-stopped
+    # data-only network — pg_dump reaches postgres by container name, same
+    # as every other data-network consumer; never exposed to the agent mesh.
+    networks:
+      - data
+    environment:
+      POSTGRES_HOST: roboco-postgres
+      POSTGRES_PORT: 5432
+      POSTGRES_USER: roboco
+      POSTGRES_PASSWORD: roboco
+      POSTGRES_DB: roboco
+    entrypoint: ["/bin/bash", "/scripts/backup-entrypoint.sh"]
+    volumes:
+      - ./docker/scripts/backup-entrypoint.sh:/scripts/backup-entrypoint.sh:ro
+      - ${ROBOCO_DATA_DIR:-./data}/backups:/backups
+    depends_on:
+      postgres:
+        condition: service_healthy
+
   # ==========================================================================
   # MinIO - Object storage for rendered videos (NAS default-on; registry OFF)
   # ==========================================================================
@@ -358,6 +383,20 @@ services:
     depends_on:
       - agent-grok-image
 
+  # ==========================================================================
+  # Sandbox PG Image Builder (kitchen-sink postgres for parameterized dev DBs)
+  # Only pulled by the provisioner when a venture requests pg extensions; bare
+  # sandboxes stay on the light upstream postgres image. See
+  # docker/sandbox-pg.Dockerfile + docs/internal/specs/2026-07-13-sandbox-extensions-on-the-fly.md
+  # ==========================================================================
+  sandbox-pg-image:
+    build:
+      context: .
+      dockerfile: docker/sandbox-pg.Dockerfile
+    image: roboco-sandbox-pg
+    entrypoint: ["/bin/sh", "-c", "echo 'Sandbox PG (kitchen-sink) image built'"]
+    restart: "no"
+
   # ==========================================================================
   # Orchestrator - API Server + Agent Spawner
   # ==========================================================================
@@ -490,6 +529,14 @@ services:
       ROBOCO_RELEASE_MANAGER_ENABLED: ${ROBOCO_RELEASE_MANAGER_ENABLED:-true}
       ROBOCO_ORG_MEMORY_ENABLED: ${ROBOCO_ORG_MEMORY_ENABLED:-true}
       ROBOCO_X_ENGINE_ENABLED: ${ROBOCO_X_ENGINE_ENABLED:-true}
+      ROBOCO_OBSIDIAN_VAULT_ENABLED: ${ROBOCO_OBSIDIAN_VAULT_ENABLED:-true}
+      ROBOCO_VAULT_PATH: ${ROBOCO_VAULT_PATH:-/app/vault}
+      ROBOCO_VAULT_INTAKE_ENABLED: ${ROBOCO_VAULT_INTAKE_ENABLED:-true}
+      ROBOCO_VAULT_ARCHIVE_DAYS: ${ROBOCO_VAULT_ARCHIVE_DAYS:-30}
+      ROBOCO_VAULT_REPORT_ENABLED: ${ROBOCO_VAULT_REPORT_ENABLED:-true}
+      ROBOCO_VAULT_KB_ENABLED: ${ROBOCO_VAULT_KB_ENABLED:-true}
+      ROBOCO_VAULT_KB_DIRS: ${ROBOCO_VAULT_KB_DIRS:-RoboCo/Notes}
+      ROBOCO_VAULT_KB_INTERVAL_SECONDS: ${ROBOCO_VAULT_KB_INTERVAL_SECONDS:-900}
       #   - Board roadmap engine: weekly, opens ONE held exploration task for
       #     the Product Owner, who proposes a themed cycle of roadmap items;
       #     the CEO approves each item individually into the backlog.
@@ -579,6 +626,7 @@ services:
       - ${ROBOCO_HOST_GROK_DIR:-/home/renzof/.grok}:${ROBOCO_HOST_GROK_DIR:-/home/renzof/.grok}
       # Shared config directory for MCP configs (writable)
       - ${ROBOCO_DATA_DIR:-./data}/mcp-configs:/app/mcp-configs
+      - ${ROBOCO_DATA_DIR:-./data}/vault:/app/vault
       # Generated prompts directory - composed at runtime from layers
       - ${ROBOCO_DATA_DIR:-./data}/prompts-generated:/app/prompts-generated
       # Per-agent Claude settings (generated at spawn time)