feat: workflow layer model — NCL-first CI/build/distribution generator
Adds a declarative workflow system where .ontology/workflow.ncl declares
independent layers (commit-fast, ci-standard, ci-exhaustive), each with a
trigger and a set of providers. The generator materialises Woodpecker YAML,
justfile recipes, and pre-commit hook stubs from that single declaration.
Layers form a set, not a chain — no layer depends on another at the
declaration level. Woodpecker steps express fine-grained parallelism
internally (lint → test/docs/build).
Schema and catalog:
- reflection/schemas/workflow.ncl — types, contracts, provider constructors
- reflection/defaults/workflow.ncl — standard Rust/Nushell/Nickel catalog
(14 validations, 4 builds)
Generator (ore workflow generate):
- PreCommit: prints hook fragments for manual merge into .pre-commit-config.yaml
- Woodpecker: writes per-layer YAML with image selection, tool installs,
depends_on chains, and CI-aware command translation
(nu --ide-check → find+xargs; markdownlint-cli2 → node:lts image)
- Justfile: single justfiles/workflow.just aggregated from all Justfile layers
(hoisted out of per-provider loop — was writing N times, now once)
Dispatcher: ore workflow validate|list|generate|diff + ore wf v|l|gen|diff
Cargo/nextest profiles:
- .cargo/config.toml: [profile.ci-test] (debug=0, no-incremental) and
[profile.ci] (line-tables-only) — shared by test + docs hooks to reuse
.rlib artifacts; CI retains actionable backtraces
- .config/nextest.toml: ci-test (fail-fast, no retries) and ci (all failures,
one retry)
Pre-commit: nextest run with --profile ci-test --cargo-profile ci-test;
docs-links hook shares same profile to reuse artifacts
Self-application: ontoref declares its own workflow in .ontology/workflow.ncl
and the generated .woodpecker/ files are the authoritative CI definition
Migration 0014: checks workflow.ncl + both cargo and nextest profiles present
Adoption: reflection/templates/ontology/workflow.ncl stub + install_workflow
confirm in adopt_ontoref form + step 5 in adoption script template
2026-04-08 14:20:38 +01:00
|
|
|
{
|
|
|
|
|
id = "0014",
|
|
|
|
|
slug = "workflow-layer-model",
|
|
|
|
|
description = "Workflow layer model: .ontology/workflow.ncl declares independent CI/build/distribution layers. Cargo profiles ci-test (pre-commit, debug=0) and ci (CI pipeline, line-tables-only) must exist. Nextest profiles ci-test and ci must exist. Generator: ore workflow generate.",
|
|
|
|
|
check = {
|
|
|
|
|
tag = "NuCmd",
|
feat: #[onto_mcp_tool] catalog, OCI credential vault layer, validate ADR-018 mode hierarchy
ontoref-derive: #[onto_mcp_tool] attribute macro registers MCP tool unit-structs in
the catalog at link time via inventory::submit!; annotated item is emitted unchanged,
ToolBase/AsyncTool impls stay on the struct. All 34 tools migrated from manual wiring
(net +5: ontoref_list_projects, ontoref_search, ontoref_describe,
ontoref_list_ontology_extensions, ontoref_get_ontology_extension).
validate modes (ADR-018): reads level_hierarchy from workflow.ncl and checks every
.ncl mode for level declared, strategy declared, delegate chain coherent, compose
extends valid. mode resolve <id> shows which hierarchy level handles a mode and why.
--self-test generates synthetic fixtures in a temp dir for CI smoke-testing.
validate run-cargo: two-step Cargo.toml resolution — workspace layout first
(crates/<check.crate>/Cargo.toml), single-crate fallback by package name or repo
basename. Lets the same ADR constraint shape apply to workspace and single-crate repos.
ontology/schemas/manifest.ncl: registry_topology_type contract — multi-registry
coordination, push targets, participant scopes, per-namespace capability.
reflection/requirements/base.ncl: oras ≥1.2.0, cosign ≥2.0.0, sops ≥3.9.0, age
≥1.1.0, restic declared as Hard/Soft requirements with version_min, check_cmd, and
install_hint (ADR-017 toolchain surface).
ADR-019: per-file recipient routing for tenant isolation without multi-vault. Schema
additions: sops.recipient_groups + sops.recipient_rules in ontoref-project.ncl.
secrets-bootstrap generates .sops.yaml from project.ncl in declarative mode. Three
new secrets-audit checks: recipient-routing-coherent, recipient-routing-coverage,
no-multi-vault. Adoption templates: single-team/, multi-tenant/, agent-first/.
Integration templates: domain-producer/, mode-producer/, mode-consumer/.
UI: project_picker surfaces registry badge (⟳ participant) and vault badge
(⛁ vault_id · N, green=declarative / amber=legacy) per project card. Expanded panel
adds collapsible Registry section with namespace, endpoint, and push/pull capability.
manage.html gains Runtime Services card — MCP and GraphQL toggleable without restart
via HTMX POST /ui/manage/services/{service}/toggle.
describe.nu: capabilities JSON includes registry_topology and vault_state per project.
sync.nu: drift check extended to detect //! absence on newly registered crates.
qa.ncl: six entries — credential-vault-best-practice (layered data-flow diagram),
credential-vault-templates (paths A/B/C), credential-vault-troubleshooting (15 named
errors), integration-what-and-why (ADR-042 OCI federation), integration-how-to-implement,
integration-troubleshooting.
on+re: core.ncl + manifest.ncl updated to reflect OCI, MCP, and mode-hierarchy nodes.
Deleted stale presentation assets (2026-02 slides + voice notes).
2026-05-12 04:46:15 +01:00
|
|
|
cmd = "let root = ($env.ONTOREF_PROJECT_ROOT? | default ($env.ONTOREF_ROOT? | default (pwd | path expand))); let wf = $\"($root)/.ontology/workflow.ncl\"; if not ($wf | path exists) { exit 1 }; let has_rust = ($\"($root)/Cargo.toml\" | path exists); if not $has_rust { exit 0 }; let cargo_cfg = $\"($root)/.cargo/config.toml\"; if not ($cargo_cfg | path exists) { exit 1 }; let cargo_txt = (open --raw $cargo_cfg); let has_ci_test = ($cargo_txt | str contains \"[profile.ci-test]\"); let has_ci = ($cargo_txt | str contains \"[profile.ci]\"); let nextest_cfg = $\"($root)/.config/nextest.toml\"; if not ($nextest_cfg | path exists) { exit 1 }; let nextest_txt = (open --raw $nextest_cfg); let nx_ci_test = ($nextest_txt | str contains \"[profile.ci-test]\"); let nx_ci = ($nextest_txt | str contains \"[profile.ci]\"); if $has_ci_test and $has_ci and $nx_ci_test and $nx_ci { exit 0 } else { exit 1 }",
|
feat: workflow layer model — NCL-first CI/build/distribution generator
Adds a declarative workflow system where .ontology/workflow.ncl declares
independent layers (commit-fast, ci-standard, ci-exhaustive), each with a
trigger and a set of providers. The generator materialises Woodpecker YAML,
justfile recipes, and pre-commit hook stubs from that single declaration.
Layers form a set, not a chain — no layer depends on another at the
declaration level. Woodpecker steps express fine-grained parallelism
internally (lint → test/docs/build).
Schema and catalog:
- reflection/schemas/workflow.ncl — types, contracts, provider constructors
- reflection/defaults/workflow.ncl — standard Rust/Nushell/Nickel catalog
(14 validations, 4 builds)
Generator (ore workflow generate):
- PreCommit: prints hook fragments for manual merge into .pre-commit-config.yaml
- Woodpecker: writes per-layer YAML with image selection, tool installs,
depends_on chains, and CI-aware command translation
(nu --ide-check → find+xargs; markdownlint-cli2 → node:lts image)
- Justfile: single justfiles/workflow.just aggregated from all Justfile layers
(hoisted out of per-provider loop — was writing N times, now once)
Dispatcher: ore workflow validate|list|generate|diff + ore wf v|l|gen|diff
Cargo/nextest profiles:
- .cargo/config.toml: [profile.ci-test] (debug=0, no-incremental) and
[profile.ci] (line-tables-only) — shared by test + docs hooks to reuse
.rlib artifacts; CI retains actionable backtraces
- .config/nextest.toml: ci-test (fail-fast, no retries) and ci (all failures,
one retry)
Pre-commit: nextest run with --profile ci-test --cargo-profile ci-test;
docs-links hook shares same profile to reuse artifacts
Self-application: ontoref declares its own workflow in .ontology/workflow.ncl
and the generated .woodpecker/ files are the authoritative CI definition
Migration 0014: checks workflow.ncl + both cargo and nextest profiles present
Adoption: reflection/templates/ontology/workflow.ncl stub + install_workflow
confirm in adopt_ontoref form + step 5 in adoption script template
2026-04-08 14:20:38 +01:00
|
|
|
expect_exit = 0,
|
|
|
|
|
},
|
|
|
|
|
instructions = "
|
|
|
|
|
Adopt the workflow layer model:
|
|
|
|
|
|
|
|
|
|
1. Create .ontology/workflow.ncl declaring your CI layers.
|
|
|
|
|
Use the template at reflection/templates/ontology/workflow.ncl
|
|
|
|
|
or copy from an existing workspace.
|
|
|
|
|
|
|
|
|
|
2. Add cargo profiles to .cargo/config.toml:
|
|
|
|
|
|
|
|
|
|
[profile.ci-test]
|
|
|
|
|
# Pre-commit: no debug info, no incremental — shared .rlib between test + docs hooks
|
|
|
|
|
inherits = \"test\"
|
|
|
|
|
debug = 0
|
|
|
|
|
incremental = false
|
|
|
|
|
|
|
|
|
|
[profile.ci]
|
|
|
|
|
# CI pipeline: line-tables-only for actionable backtraces on remote failures
|
|
|
|
|
inherits = \"test\"
|
|
|
|
|
debug = \"line-tables-only\"
|
|
|
|
|
incremental = false
|
|
|
|
|
|
|
|
|
|
3. Add nextest profiles to .config/nextest.toml:
|
|
|
|
|
|
|
|
|
|
[profile.ci-test]
|
|
|
|
|
fail-fast = true
|
|
|
|
|
retries = 0
|
|
|
|
|
|
|
|
|
|
[profile.ci]
|
|
|
|
|
fail-fast = false
|
|
|
|
|
retries = 1
|
|
|
|
|
|
|
|
|
|
4. Generate CI artifacts from the declaration:
|
|
|
|
|
|
|
|
|
|
ore workflow generate
|
|
|
|
|
|
|
|
|
|
This writes:
|
|
|
|
|
- .woodpecker/ci.yml (from layers with provider Woodpecker + trigger OnPR)
|
|
|
|
|
- .woodpecker/ci-exhaustive.yml (from layers with trigger OnMainMerge)
|
|
|
|
|
- justfiles/workflow.just (from layers with provider Justfile)
|
|
|
|
|
|
|
|
|
|
Pre-commit hooks are printed for manual merge into .pre-commit-config.yaml.
|
|
|
|
|
|
|
|
|
|
5. Verify:
|
|
|
|
|
|
|
|
|
|
ore workflow validate
|
|
|
|
|
ore workflow list
|
|
|
|
|
",
|
|
|
|
|
}
|