82a358f18d
ontoref-derive: #[onto_mcp_tool] attribute macro registers MCP tool unit-structs in
the catalog at link time via inventory::submit!; annotated item is emitted unchanged,
ToolBase/AsyncTool impls stay on the struct. All 34 tools migrated from manual wiring
(net +5: ontoref_list_projects, ontoref_search, ontoref_describe,
ontoref_list_ontology_extensions, ontoref_get_ontology_extension).
validate modes (ADR-018): reads level_hierarchy from workflow.ncl and checks every
.ncl mode for level declared, strategy declared, delegate chain coherent, compose
extends valid. mode resolve <id> shows which hierarchy level handles a mode and why.
--self-test generates synthetic fixtures in a temp dir for CI smoke-testing.
validate run-cargo: two-step Cargo.toml resolution — workspace layout first
(crates/<check.crate>/Cargo.toml), single-crate fallback by package name or repo
basename. Lets the same ADR constraint shape apply to workspace and single-crate repos.
ontology/schemas/manifest.ncl: registry_topology_type contract — multi-registry
coordination, push targets, participant scopes, per-namespace capability.
reflection/requirements/base.ncl: oras ≥1.2.0, cosign ≥2.0.0, sops ≥3.9.0, age
≥1.1.0, restic declared as Hard/Soft requirements with version_min, check_cmd, and
install_hint (ADR-017 toolchain surface).
ADR-019: per-file recipient routing for tenant isolation without multi-vault. Schema
additions: sops.recipient_groups + sops.recipient_rules in ontoref-project.ncl.
secrets-bootstrap generates .sops.yaml from project.ncl in declarative mode. Three
new secrets-audit checks: recipient-routing-coherent, recipient-routing-coverage,
no-multi-vault. Adoption templates: single-team/, multi-tenant/, agent-first/.
Integration templates: domain-producer/, mode-producer/, mode-consumer/.
UI: project_picker surfaces registry badge (⟳ participant) and vault badge
(⛁ vault_id · N, green=declarative / amber=legacy) per project card. Expanded panel
adds collapsible Registry section with namespace, endpoint, and push/pull capability.
manage.html gains Runtime Services card — MCP and GraphQL toggleable without restart
via HTMX POST /ui/manage/services/{service}/toggle.
describe.nu: capabilities JSON includes registry_topology and vault_state per project.
sync.nu: drift check extended to detect //! absence on newly registered crates.
qa.ncl: six entries — credential-vault-best-practice (layered data-flow diagram),
credential-vault-templates (paths A/B/C), credential-vault-troubleshooting (15 named
errors), integration-what-and-why (ADR-042 OCI federation), integration-how-to-implement,
integration-troubleshooting.
on+re: core.ncl + manifest.ncl updated to reflect OCI, MCP, and mode-hierarchy nodes.
Deleted stale presentation assets (2026-02 slides + voice notes).
61 lines
2.6 KiB
Text
61 lines
2.6 KiB
Text
let s = import "../schemas/manifest.ncl" in
|
|
let c = import "content.ncl" in
|
|
|
|
{
|
|
make_manifest = fun data => s.ProjectManifest & data,
|
|
make_layer = fun data => s.Layer & data,
|
|
make_op_mode = fun data => s.OperationalMode & data,
|
|
make_consumption_mode = fun data => s.ConsumptionMode & data,
|
|
make_publication_service = fun data => s.PublicationService & data,
|
|
make_tool = fun data => s.ToolRequirement & data,
|
|
|
|
ProjectManifest = s.ProjectManifest,
|
|
Layer = s.Layer,
|
|
OperationalMode = s.OperationalMode,
|
|
ConsumptionMode = s.ConsumptionMode,
|
|
PublicationService = s.PublicationService,
|
|
ToolRequirement = s.ToolRequirement,
|
|
JustfileConvention = s.JustfileConvention,
|
|
ClaudeBaseline = s.ClaudeBaseline,
|
|
RepoKind = s.RepoKind,
|
|
ConsumerType = s.ConsumerType,
|
|
ArtifactKind = s.ArtifactKind,
|
|
AuditLevel = s.AuditLevel,
|
|
AuthMethod = s.AuthMethod,
|
|
ServiceScope = s.ServiceScope,
|
|
InstallMethod = s.InstallMethod,
|
|
JustfileSystem = s.JustfileSystem,
|
|
ContentAsset = c.ContentAsset,
|
|
ContentTemplate = c.ContentTemplate,
|
|
AssetKind = c.AssetKind,
|
|
TemplateKind = c.TemplateKind,
|
|
make_asset = c.make_asset,
|
|
make_template = c.make_template,
|
|
# Config surface builders
|
|
ConfigKind = s.ConfigKind,
|
|
ConsumerKind = s.ConsumerKind,
|
|
ConfigConsumer = s.ConfigConsumer,
|
|
ConfigSection = s.ConfigSection,
|
|
ConfigSurface = s.ConfigSurface,
|
|
make_config_surface = fun data => s.ConfigSurface & data,
|
|
make_config_section = fun data => s.ConfigSection & data,
|
|
make_config_consumer = fun data => s.ConfigConsumer & data,
|
|
# Capability / requirement / critical-dep builders
|
|
EnvTarget = s.EnvTarget,
|
|
RequirementKind = s.RequirementKind,
|
|
Capability = s.Capability,
|
|
Requirement = s.Requirement,
|
|
CriticalDep = s.CriticalDep,
|
|
make_capability = fun data => s.Capability & data,
|
|
make_requirement = fun data => s.Requirement & data,
|
|
make_critical_dep = fun data => s.CriticalDep & data,
|
|
# Registry topology builders
|
|
RegistryRole = s.RegistryRole,
|
|
RegistryNamespaces = s.RegistryNamespaces,
|
|
RegistryEntry = s.RegistryEntry,
|
|
RegistriesConfig = s.RegistriesConfig,
|
|
RegistryProvides = s.RegistryProvides,
|
|
make_registry_entry = fun data => s.RegistryEntry & data,
|
|
make_registries_config = fun data => s.RegistriesConfig & data,
|
|
make_registry_provides = fun data => s.RegistryProvides & data,
|
|
}
|