ontoref/install/resources/config.ncl

# ~/.config/ontoref/config.ncl — ontoref-daemon runtime configuration
#
# Edit interactively:
#   ontoref config-edit           (typedialog-web roundtrip, browser form)
# Validate:
#   nickel typecheck ~/.config/ontoref/config.ncl
# Apply (NCL pipe bootstrap, ADR-004):
#   ontoref-daemon-boot
#   ontoref-daemon-boot --dry-run  # preview composed JSON

let Port = std.contract.from_predicate
  (fun p => std.is_number p && p > 1024 && p < 65536)
  in

let LogLevel     = [| 'trace, 'debug, 'info, 'warn, 'error |] in
let Rotation     = [| 'daily, 'hourly, 'never |] in
let Actor        = [| 'developer, 'agent, 'ci, 'admin |] in
let Severity     = [| 'Hard, 'Soft |] in
let VaultBackend = [| 'restic, 'kopia |] in

let KeyRole   = [| 'admin, 'viewer |] in
let KeyEntry  = { role | KeyRole, hash | String } in
let ActorKeyBindings = { _ | String } in
let RecipientGroup   = { _ | Array String } in
let RecipientRule    = { path | String, groups | Array String } in
let SopsConfig = {
  enabled | Bool | default = false,
  vault_id | String | optional,
  vault_backend | VaultBackend | default = 'restic,
  registry_endpoint | String | optional,
  age_key_paths | Array String | default = [],
  master_key_path | String | optional,
  actor_key_bindings | ActorKeyBindings | default = {},
  recipient_groups | RecipientGroup    | default = {},
  recipient_rules  | Array RecipientRule | default = [],
} in
let ProjectEntry = {
  slug                | String,
  root                | String,
  nickel_import_paths | Array String | default = [],
  keys                | Array KeyEntry | default = [],
  remote_url          | String | default = "",
  push_only           | Bool   | default = false,
  sops                | SopsConfig | optional,
} in

{
  # Nickel import paths used when exporting/typechecking configs that import schemas.
  # Relative paths are resolved from the config file's directory.
  nickel_import_paths | Array String = [],

  # Registered projects served by this daemon instance.
  # Local projects:  populated from projects.ncl (ontoref project-add /path/to/project)
  # Remote projects: populated from remote-projects.ncl (ontoref project-add-remote <url> <slug>)
  projects | Array ProjectEntry = (import "./projects.ncl") @ (import "./remote-projects.ncl"),

  daemon = {
    port | Port   = 7890,
    host | String = "127.0.0.1",
  },

  db = {
    enabled  | Bool   = false,
    url      | String = "http://localhost:8000/ontoref",
    pool_max | Number = 5,
  },

  nats_events = {
    enabled        | Bool         = false,
    url            | String       = "nats://localhost:4222",
    streams_config | String       = "",
    emit           | Array String = [],
    subscribe      | Array String = [],
    handlers_dir   | String       = "reflection/handlers",
  },

  log = {
    level     | LogLevel = 'info,
    rotation  | Rotation = 'daily,
    max_files | Number   = 7,
    compress  | Bool     = false,
    archive   | String   = "",
    # Resolved by daemon from platform conventions when empty:
    #   macOS: ~/Library/Logs/ontoref/   Linux: ~/.local/state/ontoref/logs/
    path | String = "",
  },

  cache = {
    # Resolved by daemon from platform conventions when empty:
    #   macOS: ~/Library/Caches/ontoref/   Linux: ~/.cache/ontoref/
    path | String = "",
  },

  # Default vault settings (ADR-017). Per-project override in <project>/.ontoref/project.ncl::sops.
  vault = {
    # Path to the master age private key (.kage) used to open project vaults.
    # Empty here = each project must declare sops.master_key_path explicitly.
    master_key_path | String = "",
    # Default vault backend tool. Switching requires re-initializing local repos.
    backend | VaultBackend = 'restic,
    # Cosign keypair for signing/verifying src-vault OCI artifacts.
    # Empty paths = cosign operations error explicitly. No env-var fallback.
    cosign = {
      key_path | String = "",   # cosign.key — used by `secrets push` to sign
      pub_path | String = "",   # cosign.pub — used by `secrets sync` and verify
      # Upload signature metadata to Rekor (sigstore public transparency log).
      # Default false (private self-hosted model). Set true only if you publish
      # artifacts that need globally verifiable, tamper-evident audit trail.
      # Verification side propagates: false → cosign verify uses --insecure-ignore-tlog.
      tlog | Bool = false,
      # Cosign 2+ requires a --signing-config without Rekor URLs when tlog=false.
      # Generate once with:
      #   curl https://raw.githubusercontent.com/sigstore/root-signing/refs/heads/main/targets/signing_config.v0.2.json \
      #     | jq 'del(.rekorTlogUrls) | del(.rekorTlogConfig)' > <path>
      signing_config_path | String = "",
    },
  },

  ui = {
    # Resolved from platform data dir when empty:
    #   macOS: ~/Library/Application Support/ontoref/templates
    #   Linux: ~/.local/share/ontoref/templates
    templates_dir | String = "",
    public_dir    | String = "",
    logo          | String = "ontoref-logo.svg",
    tls_cert      | String = "",
    tls_key       | String = "",
  },

  mode_run = {
    rules | Array {
      when    | { mode_id | String | optional, actor | String | optional },
      allow   | Bool,
      reason  | String,
    } = [
      { when = { mode_id = "validate-ontology" }, allow = true,  reason = "validation always allowed" },
      { when = { actor   = "agent"             }, allow = true,  reason = "agent actor always allowed" },
      { when = { actor   = "ci"                }, allow = true,  reason = "ci actor always allowed" },
    ],
  },

  actor_init | Array {
    actor    | String,
    mode     | String,
    auto_run | Bool,
  } = [
    { actor = "agent",     mode = "describe capabilities", auto_run = true  },
    { actor = "developer", mode = "",                      auto_run = false },
    { actor = "ci",        mode = "",                      auto_run = false },
  ],

  quick_actions | Array {
    id       | String,
    label    | String,
    icon     | String,
    category | String,
    mode     | String,
    actors   | Array String,
  } = [
    {
      id       = "gen-docs",
      label    = "Generate documentation",
      icon     = "book-open",
      category = "docs",
      mode     = "generate-mdbook",
      actors   = ["developer", "agent"],
    },
    {
      id       = "sync-onto",
      label    = "Sync ontology",
      icon     = "refresh",
      category = "sync",
      mode     = "sync-ontology",
      actors   = ["developer", "ci", "agent"],
    },
    {
      id       = "coder-workflow",
      label    = "Coder workflow",
      icon     = "code",
      category = "process",
      mode     = "coder-workflow",
      actors   = ["developer", "agent"],
    },
  ],
}