ontoref/install/resources/templates/integration/README.md

79 lines
2.9 KiB
Markdown
Raw Normal View History

feat: #[onto_mcp_tool] catalog, OCI credential vault layer, validate ADR-018 mode hierarchy ontoref-derive: #[onto_mcp_tool] attribute macro registers MCP tool unit-structs in the catalog at link time via inventory::submit!; annotated item is emitted unchanged, ToolBase/AsyncTool impls stay on the struct. All 34 tools migrated from manual wiring (net +5: ontoref_list_projects, ontoref_search, ontoref_describe, ontoref_list_ontology_extensions, ontoref_get_ontology_extension). validate modes (ADR-018): reads level_hierarchy from workflow.ncl and checks every .ncl mode for level declared, strategy declared, delegate chain coherent, compose extends valid. mode resolve <id> shows which hierarchy level handles a mode and why. --self-test generates synthetic fixtures in a temp dir for CI smoke-testing. validate run-cargo: two-step Cargo.toml resolution — workspace layout first (crates/<check.crate>/Cargo.toml), single-crate fallback by package name or repo basename. Lets the same ADR constraint shape apply to workspace and single-crate repos. ontology/schemas/manifest.ncl: registry_topology_type contract — multi-registry coordination, push targets, participant scopes, per-namespace capability. reflection/requirements/base.ncl: oras ≥1.2.0, cosign ≥2.0.0, sops ≥3.9.0, age ≥1.1.0, restic declared as Hard/Soft requirements with version_min, check_cmd, and install_hint (ADR-017 toolchain surface). ADR-019: per-file recipient routing for tenant isolation without multi-vault. Schema additions: sops.recipient_groups + sops.recipient_rules in ontoref-project.ncl. secrets-bootstrap generates .sops.yaml from project.ncl in declarative mode. Three new secrets-audit checks: recipient-routing-coherent, recipient-routing-coverage, no-multi-vault. Adoption templates: single-team/, multi-tenant/, agent-first/. Integration templates: domain-producer/, mode-producer/, mode-consumer/. UI: project_picker surfaces registry badge (⟳ participant) and vault badge (⛁ vault_id · N, green=declarative / amber=legacy) per project card. Expanded panel adds collapsible Registry section with namespace, endpoint, and push/pull capability. manage.html gains Runtime Services card — MCP and GraphQL toggleable without restart via HTMX POST /ui/manage/services/{service}/toggle. describe.nu: capabilities JSON includes registry_topology and vault_state per project. sync.nu: drift check extended to detect //! absence on newly registered crates. qa.ncl: six entries — credential-vault-best-practice (layered data-flow diagram), credential-vault-templates (paths A/B/C), credential-vault-troubleshooting (15 named errors), integration-what-and-why (ADR-042 OCI federation), integration-how-to-implement, integration-troubleshooting. on+re: core.ncl + manifest.ncl updated to reflect OCI, MCP, and mode-hierarchy nodes. Deleted stale presentation assets (2026-02 slides + voice notes).
2026-05-12 04:46:15 +01:00
# Integration Templates (ADR-015 / federated OCI artifacts)
Three starting templates for integration. Pick the role you want to play; you
can be both a producer and a consumer.
## Pick the template that matches what you want to do
| Template | Role | Outcome |
|---|---|---|
| `domain-producer/` | Define a typed contract for structured data | Push `domains/<participant>/<id>:<version>` to ZOT |
| `mode-producer/` | Author an orchestration mode that consumes domains | Push `modes/<participant>/<id>:<version>` to ZOT |
| `mode-consumer/` | Adopt someone else's published mode | Cabling file in `infra/<ws>/integrations/` |
## Layout
```text
domain-producer/
contract.ncl.template ← schema (Nickel types) for the structured data
example.json.template ← reference instance matching the contract
manifest.ncl.template ← DomainArtifact descriptor
mode-producer/
provisioning.ncl.template ← IntegrationMode declaration
domains.lock.ncl.template ← pinned versions of consumed domains
manifest.ncl.template ← ModeArtifact descriptor
mode-consumer/
cabling.ncl.template ← binds mode params to workspace values
```
## Workflow
### Producer (one-time per artifact)
```bash
# 1. Copy template to your catalog dir
cp -r install/resources/templates/integration/domain-producer/ catalog/domains/my-domain/
mv catalog/domains/my-domain/contract.ncl.template catalog/domains/my-domain/contract.ncl
mv catalog/domains/my-domain/example.json.template catalog/domains/my-domain/example.json
mv catalog/domains/my-domain/manifest.ncl.template catalog/domains/my-domain/manifest.ncl
# 2. Edit the files: replace <placeholders>, define your types
# 3. Publish
ore secrets bootstrap # one-time, vault setup
prvng integration domain publish catalog/domains/my-domain <participant>
prvng integration domain verify <participant>/my-domain 0.1.0
```
### Consumer (one-time per mode you adopt)
```bash
# 1. Subscribe — pulls the mode + its domain dependencies, scaffolds cabling
prvng integration subscribe <mode-id> \
--mode-file infra/modes/<mode-id>.ncl \
--workspace-dir .
# 2. Edit the generated cabling file
$EDITOR infra/<ws>/integrations/<mode-id>.ncl
# 3. Validate that all bindings resolve
prvng integration validate <mode-id> --workspace-dir .
# 4. Invoke the mode
prvng integration invoke <mode-id> --binary <name>
```
## Without templates: minimal viable
The artifact format is documented in `provisioning/schemas/lib/integration/oci_artifact_format.ncl`.
You can write `contract.ncl`, `manifest.ncl`, `provisioning.ncl` from scratch following
the type definitions there. Templates only save copy-paste time.
## See also
- `reflection/qa.ncl::integration-*` — FAQ with diagrams
- `provisioning/schemas/lib/integration/oci_artifact_format.ncl` — types
- `prvng integration --help` — command surface