From 82a358f18d2fe416da3c84d361365e9468bc57fc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jesu=CC=81s=20Pe=CC=81rez?= Date: Tue, 12 May 2026 04:46:15 +0100 Subject: [PATCH] feat: #[onto_mcp_tool] catalog, OCI credential vault layer, validate ADR-018 mode hierarchy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ontoref-derive: #[onto_mcp_tool] attribute macro registers MCP tool unit-structs in the catalog at link time via inventory::submit!; annotated item is emitted unchanged, ToolBase/AsyncTool impls stay on the struct. All 34 tools migrated from manual wiring (net +5: ontoref_list_projects, ontoref_search, ontoref_describe, ontoref_list_ontology_extensions, ontoref_get_ontology_extension). validate modes (ADR-018): reads level_hierarchy from workflow.ncl and checks every .ncl mode for level declared, strategy declared, delegate chain coherent, compose extends valid. mode resolve shows which hierarchy level handles a mode and why. --self-test generates synthetic fixtures in a temp dir for CI smoke-testing. validate run-cargo: two-step Cargo.toml resolution — workspace layout first (crates//Cargo.toml), single-crate fallback by package name or repo basename. Lets the same ADR constraint shape apply to workspace and single-crate repos. ontology/schemas/manifest.ncl: registry_topology_type contract — multi-registry coordination, push targets, participant scopes, per-namespace capability. reflection/requirements/base.ncl: oras ≥1.2.0, cosign ≥2.0.0, sops ≥3.9.0, age ≥1.1.0, restic declared as Hard/Soft requirements with version_min, check_cmd, and install_hint (ADR-017 toolchain surface). ADR-019: per-file recipient routing for tenant isolation without multi-vault. Schema additions: sops.recipient_groups + sops.recipient_rules in ontoref-project.ncl. secrets-bootstrap generates .sops.yaml from project.ncl in declarative mode. Three new secrets-audit checks: recipient-routing-coherent, recipient-routing-coverage, no-multi-vault. Adoption templates: single-team/, multi-tenant/, agent-first/. Integration templates: domain-producer/, mode-producer/, mode-consumer/. UI: project_picker surfaces registry badge (⟳ participant) and vault badge (⛁ vault_id · N, green=declarative / amber=legacy) per project card. Expanded panel adds collapsible Registry section with namespace, endpoint, and push/pull capability. manage.html gains Runtime Services card — MCP and GraphQL toggleable without restart via HTMX POST /ui/manage/services/{service}/toggle. describe.nu: capabilities JSON includes registry_topology and vault_state per project. sync.nu: drift check extended to detect //! absence on newly registered crates. qa.ncl: six entries — credential-vault-best-practice (layered data-flow diagram), credential-vault-templates (paths A/B/C), credential-vault-troubleshooting (15 named errors), integration-what-and-why (ADR-042 OCI federation), integration-how-to-implement, integration-troubleshooting. on+re: core.ncl + manifest.ncl updated to reflect OCI, MCP, and mode-hierarchy nodes. Deleted stale presentation assets (2026-02 slides + voice notes). --- .cargo/config.toml | 1 + .gitignore | 2 + .ontology/core.ncl | 130 +- .ontology/manifest.ncl | 90 +- .ontology/state.ncl | 6 +- .ontoref/project.ncl | 20 + CHANGELOG.md | 127 + Cargo.lock | 385 +- Cargo.toml | 46 +- Dockerfile | 32 + JUST.md | 2 + README.md | 70 +- adrs/adr-014-runtime-service-toggles.ncl | 98 + ...adr-015-mcp-tool-inventory-auto-derive.ncl | 88 + adrs/adr-016-component-lift-out-pattern.ncl | 101 + ...dr-017-registry-credential-vault-model.ncl | 217 + ...vel-hierarchy-mode-resolution-strategy.ncl | 148 + ...ile-recipient-routing-tenant-isolation.ncl | 151 + ...020-three-layer-ontoref-instance-model.ncl | 221 + .../docs/2-week-sprint-knowledge_done.md | 184 + .../{ => docs}/2026-02-17-notas_voz.md | 0 .../{ => docs}/2026-02-27-notas_voz_rust.md | 0 ...estas-dos-propuestas-para-un-open-spac.txt | 4668 ++++ ...uedes-sacar-el-texto-de-este-contenido.txt | 905 + assets/presentation/docs/INDEX.md | 69 + ...JoseCelano_2026-6-08_Ontologías_y_DAGs.pdf | Bin 0 -> 1131914 bytes assets/presentation/docs/Steal_This_Deck.pdf | Bin 0 -> 3388479 bytes assets/presentation/docs/about_plantir.md | 28 + .../docs/ontologia-filosofia-software.md | 544 + .../docs/ontologia-filosofia-software.pdf | 19472 ++++++++++++++++ .../docs/ontologia-filosofia-software.typ | 963 + assets/presentation/docs/ontologia_motor.md | 53 + .../docs/ontologia_motor_resumen.md | 89 + .../docs/ontoref-dags-diferenciacion.md | 107 + .../ontoref-scope-proyecto-infra-personal.md | 157 + .../docs/ontoref-yin-yang-diferenciacion.md | 67 + .../ai-knowledge-tool-who-keeps-it-alive.md | 97 + ...dags-everywhere-none-know-what-they-are.md | 106 + .../posts/en/one-protocol-three-subjects.md | 122 + ...our-ontology-should-live-with-your-code.md | 106 + ...s-en-todos-lados-ninguno-sabe-lo-que-es.md | 106 + ...mienta-conocimiento-quien-mantiene-vivo.md | 97 + ...u-ontologia-deberia-vivir-con-tu-codigo.md | 106 + .../posts/es/un-protocolo-tres-sujetos.md | 122 + .../a-two-week-sprint-for-knowledge.md | 101 + .../a-two-week-sprint-for-knowledge.pdf | 2032 ++ .../presentation/docs/talisman-article/en.typ | 160 + .../presentation/docs/talisman-article/es.typ | 160 + ...int-de-dos-semanas-para-el-conocimiento.md | 101 + ...nt-de-dos-semanas-para-el-conocimiento.pdf | 2119 ++ .../talisman-steal-this-deck-extractions.md | 118 + assets/presentation/intro_slides.md | 989 + assets/presentation/jj_rad.sh | 3 + assets/presentation/jj_slides.md | 1188 + assets/presentation/lian-build.md | 761 + .../{slides.md => ontology_slides.md} | 0 assets/presentation/public/lian-h.svg | 70 + assets/presentation/public/lian-v.svg | 70 + assets/presentation/run.sh | 4 +- assets/presentation/work_group_info.md | 576 + assets/work-group-ore/README.md | 33 + assets/work-group-ore/demo/README.md | 59 + .../demo/option-a-owner/README.md | 38 + .../demo/option-a-owner/core.broken.ncl | 15 + .../demo/option-a-owner/core.start.ncl | 8 + .../option-a-owner/core.with-contract.ncl | 14 + .../demo/option-b-layers/README.md | 68 + .../demo/option-b-layers/core.broken.ncl | 45 + .../demo/option-b-layers/core.start.ncl | 8 + .../option-b-layers/core.with-contract.ncl | 44 + .../work-group-ore/demo/recording/README.md | 50 + .../work-group-ore/demo/recording/record.sh | 107 + assets/work-group-ore/demo/script.md | 235 + assets/work-group-ore/setup.md | 125 + crates/ontoref-daemon/Cargo.toml | 5 +- crates/ontoref-daemon/src/api.rs | 268 +- crates/ontoref-daemon/src/config.rs | 16 + crates/ontoref-daemon/src/graphql/mod.rs | 1097 + crates/ontoref-daemon/src/lib.rs | 2 + crates/ontoref-daemon/src/main.rs | 66 + crates/ontoref-daemon/src/mcp/mod.rs | 666 +- crates/ontoref-daemon/src/registry.rs | 66 +- crates/ontoref-daemon/src/ui/handlers.rs | 499 +- crates/ontoref-daemon/src/ui/login.rs | 10 +- crates/ontoref-daemon/src/ui/mod.rs | 4 + crates/ontoref-daemon/templates/base.html | 79 +- .../templates/pages/manage.html | 46 + .../templates/pages/project_picker.html | 55 + crates/ontoref-derive/src/lib.rs | 137 + crates/ontoref-ontology/src/lib.rs | 7 +- crates/ontoref-ontology/src/mcp.rs | 24 + domains/provisioning/commands.nu | 462 +- domains/provisioning/domain.ncl | 27 + install/install.nu | 3 +- install/resources/config.ncl | 49 +- install/resources/schemas/ontoref-project.ncl | 41 + .../resources/templates/integration/README.md | 78 + .../domain-producer/contract.ncl.template | 32 + .../domain-producer/example.json.template | 11 + .../domain-producer/manifest.ncl.template | 27 + .../mode-consumer/cabling.ncl.template | 32 + .../mode-producer/domains.lock.ncl.template | 18 + .../mode-producer/manifest.ncl.template | 24 + .../mode-producer/provisioning.ncl.template | 43 + install/resources/templates/sops/README.md | 65 + .../sops/agent-first/manifest.ncl.snippet | 37 + .../sops/agent-first/project.ncl.snippet | 30 + .../sops/multi-tenant/manifest.ncl.snippet | 49 + .../sops/multi-tenant/project.ncl.snippet | 34 + .../sops/single-team/manifest.ncl.snippet | 23 + .../sops/single-team/project.ncl.snippet | 20 + justfile | 1 + justfiles/_secrets_lib.sh | 245 + justfiles/build.just | 28 +- justfiles/ci.just | 41 +- justfiles/secrets.just | 770 + lian-build/build_directives.ncl | 41 + lian-build/ctx-test.nu | 134 + ontology/defaults/decomposition.ncl | 58 + ontology/defaults/manifest.ncl | 13 +- ontology/schemas/manifest.ncl | 82 + provisioning/project.ncl | 14 + reflection/backlog.ncl | 417 + reflection/bin/ontoref.nu | 82 +- reflection/defaults/workflow.ncl | 8 +- .../0003-manifest-self-interrogation.ncl | 7 +- .../0010-manifest-capability-completeness.ncl | 7 +- .../migrations/0014-workflow-layer-model.ncl | 2 +- .../migrations/0015-registry-topology.ncl | 62 + .../0016-registry-credential-vault.ncl | 129 + .../0017-level-hierarchy-strategy.ncl | 84 + .../migrations/0018-recipient-routing.ncl | 136 + reflection/modes/update_ontoref.ncl | 14 +- reflection/modules/adr.nu | 9 +- reflection/modules/backlog.nu | 8 +- reflection/modules/describe.nu | 167 +- reflection/modules/env.nu | 9 + reflection/modules/graph.nu | 5 +- reflection/modules/migrate.nu | 16 +- reflection/modules/secrets.nu | 711 + reflection/modules/services.nu | 4 +- reflection/modules/store.nu | 25 +- reflection/modules/sync.nu | 159 +- reflection/modules/validate.nu | 551 +- reflection/modules/vault.nu | 258 + reflection/modules/workflow.nu | 16 + reflection/nulib/bootstrap.nu | 2 +- reflection/nulib/help.nu | 34 +- reflection/nulib/modes.nu | 34 +- reflection/qa.ncl | 1167 +- reflection/requirements/base.ncl | 66 + reflection/schema.ncl | 25 +- reflection/schemas/workflow.ncl | 8 +- reflection/tests/test_credential_chain.sh | 199 + reflection/tests/test_secrets.nu | 355 + reflection/tests/test_vault_lock.sh | 112 + steal_this_deck_session.txt | 862 + templates/ontology/connections.ncl | 2 +- templates/ontology/manifest.ncl | 11 + 159 files changed, 50359 insertions(+), 387 deletions(-) create mode 100644 Dockerfile create mode 100644 JUST.md create mode 100644 adrs/adr-014-runtime-service-toggles.ncl create mode 100644 adrs/adr-015-mcp-tool-inventory-auto-derive.ncl create mode 100644 adrs/adr-016-component-lift-out-pattern.ncl create mode 100644 adrs/adr-017-registry-credential-vault-model.ncl create mode 100644 adrs/adr-018-level-hierarchy-mode-resolution-strategy.ncl create mode 100644 adrs/adr-019-per-file-recipient-routing-tenant-isolation.ncl create mode 100644 adrs/adr-020-three-layer-ontoref-instance-model.ncl create mode 100644 assets/presentation/docs/2-week-sprint-knowledge_done.md rename assets/presentation/{ => docs}/2026-02-17-notas_voz.md (100%) rename assets/presentation/{ => docs}/2026-02-27-notas_voz_rust.md (100%) create mode 100644 assets/presentation/docs/2026-04-24-234910-me-planteo-estas-dos-propuestas-para-un-open-spac.txt create mode 100644 assets/presentation/docs/2026-04-25-000346-puedes-sacar-el-texto-de-este-contenido.txt create mode 100644 assets/presentation/docs/INDEX.md create mode 100644 assets/presentation/docs/JoseCelano_2026-6-08_Ontologías_y_DAGs.pdf create mode 100644 assets/presentation/docs/Steal_This_Deck.pdf create mode 100644 assets/presentation/docs/about_plantir.md create mode 100644 assets/presentation/docs/ontologia-filosofia-software.md create mode 100644 assets/presentation/docs/ontologia-filosofia-software.pdf create mode 100644 assets/presentation/docs/ontologia-filosofia-software.typ create mode 100644 assets/presentation/docs/ontologia_motor.md create mode 100644 assets/presentation/docs/ontologia_motor_resumen.md create mode 100644 assets/presentation/docs/ontoref-dags-diferenciacion.md create mode 100644 assets/presentation/docs/ontoref-scope-proyecto-infra-personal.md create mode 100644 assets/presentation/docs/ontoref-yin-yang-diferenciacion.md create mode 100644 assets/presentation/docs/posts/en/ai-knowledge-tool-who-keeps-it-alive.md create mode 100644 assets/presentation/docs/posts/en/dags-everywhere-none-know-what-they-are.md create mode 100644 assets/presentation/docs/posts/en/one-protocol-three-subjects.md create mode 100644 assets/presentation/docs/posts/en/your-ontology-should-live-with-your-code.md create mode 100644 assets/presentation/docs/posts/es/dags-en-todos-lados-ninguno-sabe-lo-que-es.md create mode 100644 assets/presentation/docs/posts/es/la-ia-herramienta-conocimiento-quien-mantiene-vivo.md create mode 100644 assets/presentation/docs/posts/es/tu-ontologia-deberia-vivir-con-tu-codigo.md create mode 100644 assets/presentation/docs/posts/es/un-protocolo-tres-sujetos.md create mode 100644 assets/presentation/docs/talisman-article/a-two-week-sprint-for-knowledge.md create mode 100644 assets/presentation/docs/talisman-article/a-two-week-sprint-for-knowledge.pdf create mode 100644 assets/presentation/docs/talisman-article/en.typ create mode 100644 assets/presentation/docs/talisman-article/es.typ create mode 100644 assets/presentation/docs/talisman-article/un-sprint-de-dos-semanas-para-el-conocimiento.md create mode 100644 assets/presentation/docs/talisman-article/un-sprint-de-dos-semanas-para-el-conocimiento.pdf create mode 100644 assets/presentation/docs/talisman-steal-this-deck-extractions.md create mode 100644 assets/presentation/intro_slides.md create mode 100755 assets/presentation/jj_rad.sh create mode 100644 assets/presentation/jj_slides.md create mode 100644 assets/presentation/lian-build.md rename assets/presentation/{slides.md => ontology_slides.md} (100%) create mode 100644 assets/presentation/public/lian-h.svg create mode 100644 assets/presentation/public/lian-v.svg create mode 100644 assets/presentation/work_group_info.md create mode 100644 assets/work-group-ore/README.md create mode 100644 assets/work-group-ore/demo/README.md create mode 100644 assets/work-group-ore/demo/option-a-owner/README.md create mode 100644 assets/work-group-ore/demo/option-a-owner/core.broken.ncl create mode 100644 assets/work-group-ore/demo/option-a-owner/core.start.ncl create mode 100644 assets/work-group-ore/demo/option-a-owner/core.with-contract.ncl create mode 100644 assets/work-group-ore/demo/option-b-layers/README.md create mode 100644 assets/work-group-ore/demo/option-b-layers/core.broken.ncl create mode 100644 assets/work-group-ore/demo/option-b-layers/core.start.ncl create mode 100644 assets/work-group-ore/demo/option-b-layers/core.with-contract.ncl create mode 100644 assets/work-group-ore/demo/recording/README.md create mode 100755 assets/work-group-ore/demo/recording/record.sh create mode 100644 assets/work-group-ore/demo/script.md create mode 100644 assets/work-group-ore/setup.md create mode 100644 crates/ontoref-daemon/src/graphql/mod.rs create mode 100644 crates/ontoref-ontology/src/mcp.rs create mode 100644 install/resources/templates/integration/README.md create mode 100644 install/resources/templates/integration/domain-producer/contract.ncl.template create mode 100644 install/resources/templates/integration/domain-producer/example.json.template create mode 100644 install/resources/templates/integration/domain-producer/manifest.ncl.template create mode 100644 install/resources/templates/integration/mode-consumer/cabling.ncl.template create mode 100644 install/resources/templates/integration/mode-producer/domains.lock.ncl.template create mode 100644 install/resources/templates/integration/mode-producer/manifest.ncl.template create mode 100644 install/resources/templates/integration/mode-producer/provisioning.ncl.template create mode 100644 install/resources/templates/sops/README.md create mode 100644 install/resources/templates/sops/agent-first/manifest.ncl.snippet create mode 100644 install/resources/templates/sops/agent-first/project.ncl.snippet create mode 100644 install/resources/templates/sops/multi-tenant/manifest.ncl.snippet create mode 100644 install/resources/templates/sops/multi-tenant/project.ncl.snippet create mode 100644 install/resources/templates/sops/single-team/manifest.ncl.snippet create mode 100644 install/resources/templates/sops/single-team/project.ncl.snippet create mode 100644 justfiles/_secrets_lib.sh create mode 100644 justfiles/secrets.just create mode 100644 lian-build/build_directives.ncl create mode 100644 lian-build/ctx-test.nu create mode 100644 ontology/defaults/decomposition.ncl create mode 100644 provisioning/project.ncl create mode 100644 reflection/migrations/0015-registry-topology.ncl create mode 100644 reflection/migrations/0016-registry-credential-vault.ncl create mode 100644 reflection/migrations/0017-level-hierarchy-strategy.ncl create mode 100644 reflection/migrations/0018-recipient-routing.ncl create mode 100644 reflection/modules/secrets.nu create mode 100644 reflection/modules/vault.nu create mode 100755 reflection/tests/test_credential_chain.sh create mode 100644 reflection/tests/test_secrets.nu create mode 100755 reflection/tests/test_vault_lock.sh create mode 100644 steal_this_deck_session.txt diff --git a/.cargo/config.toml b/.cargo/config.toml index 69740df..c6df80c 100644 --- a/.cargo/config.toml +++ b/.cargo/config.toml @@ -4,6 +4,7 @@ [build] # Number of parallel jobs for compilation jobs = 4 +target-dir = "/Volumes/Devel/ontoref/target" # Code generation backend # codegen-backend = "llvm" diff --git a/.gitignore b/.gitignore index 6ba45c4..ae25bf2 100644 --- a/.gitignore +++ b/.gitignore @@ -2,6 +2,8 @@ CLAUDE.md .claude logs logs-archive +.ncl-cache +data utils/save*sh .fastembed_cache presentaciones diff --git a/.ontology/core.ncl b/.ontology/core.ncl index 5bbaef5..d1216e9 100644 --- a/.ontology/core.ncl +++ b/.ontology/core.ncl @@ -85,9 +85,16 @@ let d = import "../ontology/defaults/core.ncl" in "adrs/adr-010-protocol-migration-system.ncl", "adrs/adr-011-mode-guards-and-convergence.ncl", "adrs/adr-012-domain-extension-system.ncl", + "adrs/adr-013-vcs-abstraction-layer.ncl", + "adrs/adr-014-runtime-service-toggles.ncl", + "adrs/adr-015-mcp-tool-inventory-auto-derive.ncl", + "adrs/adr-016-component-lift-out-pattern.ncl", + "adrs/adr-017-registry-credential-vault-model.ncl", + "adrs/adr-018-level-hierarchy-mode-resolution-strategy.ncl", + "adrs/adr-019-per-file-recipient-routing-tenant-isolation.ncl", "CHANGELOG.md", ], - adrs = ["adr-001", "adr-002", "adr-003", "adr-004", "adr-005", "adr-006", "adr-007", "adr-008", "adr-009", "adr-010", "adr-011", "adr-012"], + adrs = ["adr-001", "adr-002", "adr-003", "adr-004", "adr-005", "adr-006", "adr-007", "adr-008", "adr-009", "adr-010", "adr-011", "adr-012", "adr-013", "adr-014", "adr-015", "adr-016", "adr-017", "adr-018", "adr-019"], }, d.make_node { @@ -214,11 +221,12 @@ let d = import "../ontology/defaults/core.ncl" in name = "Ontoref Daemon", pole = 'Yang, level = 'Practice, - description = "HTTP daemon for NCL export caching, file watching, actor registry, and MCP surface. Provides notification barrier, HTTP API (11 pages), MCP server (29 tools, stdio + streamable-HTTP), Q&A NCL persistence, quick-actions catalog, passive drift observation, unified auth/session management, per-file ontology version counters (GET /projects/{slug}/ontology/versions), and annotated API catalog (GET /api/catalog). API catalog populated at link time via #[onto_api] proc-macro + inventory — zero runtime overhead. Launched via ADR-004 NCL pipe bootstrap: nickel export config.ncl | ontoref-daemon.bin --config-stdin. Graph, search, and api_catalog UI pages carry browser-style panel navigation (back/forward history stack). File artifact paths open in external tabs: card.repo (Gitea source URL) for most files, card.docs (cargo docs) for .rs files — no inline file loading. card_repo/card_docs injected into Tera context from insert_brand_ctx; | safe filter required for URL values inside