82a358f18d
ontoref-derive: #[onto_mcp_tool] attribute macro registers MCP tool unit-structs in
the catalog at link time via inventory::submit!; annotated item is emitted unchanged,
ToolBase/AsyncTool impls stay on the struct. All 34 tools migrated from manual wiring
(net +5: ontoref_list_projects, ontoref_search, ontoref_describe,
ontoref_list_ontology_extensions, ontoref_get_ontology_extension).
validate modes (ADR-018): reads level_hierarchy from workflow.ncl and checks every
.ncl mode for level declared, strategy declared, delegate chain coherent, compose
extends valid. mode resolve <id> shows which hierarchy level handles a mode and why.
--self-test generates synthetic fixtures in a temp dir for CI smoke-testing.
validate run-cargo: two-step Cargo.toml resolution — workspace layout first
(crates/<check.crate>/Cargo.toml), single-crate fallback by package name or repo
basename. Lets the same ADR constraint shape apply to workspace and single-crate repos.
ontology/schemas/manifest.ncl: registry_topology_type contract — multi-registry
coordination, push targets, participant scopes, per-namespace capability.
reflection/requirements/base.ncl: oras ≥1.2.0, cosign ≥2.0.0, sops ≥3.9.0, age
≥1.1.0, restic declared as Hard/Soft requirements with version_min, check_cmd, and
install_hint (ADR-017 toolchain surface).
ADR-019: per-file recipient routing for tenant isolation without multi-vault. Schema
additions: sops.recipient_groups + sops.recipient_rules in ontoref-project.ncl.
secrets-bootstrap generates .sops.yaml from project.ncl in declarative mode. Three
new secrets-audit checks: recipient-routing-coherent, recipient-routing-coverage,
no-multi-vault. Adoption templates: single-team/, multi-tenant/, agent-first/.
Integration templates: domain-producer/, mode-producer/, mode-consumer/.
UI: project_picker surfaces registry badge (⟳ participant) and vault badge
(⛁ vault_id · N, green=declarative / amber=legacy) per project card. Expanded panel
adds collapsible Registry section with namespace, endpoint, and push/pull capability.
manage.html gains Runtime Services card — MCP and GraphQL toggleable without restart
via HTMX POST /ui/manage/services/{service}/toggle.
describe.nu: capabilities JSON includes registry_topology and vault_state per project.
sync.nu: drift check extended to detect //! absence on newly registered crates.
qa.ncl: six entries — credential-vault-best-practice (layered data-flow diagram),
credential-vault-templates (paths A/B/C), credential-vault-troubleshooting (15 named
errors), integration-what-and-why (ADR-042 OCI federation), integration-how-to-implement,
integration-troubleshooting.
on+re: core.ncl + manifest.ncl updated to reflect OCI, MCP, and mode-hierarchy nodes.
Deleted stale presentation assets (2026-02 slides + voice notes).
208 lines
7 KiB
Text
208 lines
7 KiB
Text
# Standard validation, build, and distribution catalog for Rust/Nushell/Nickel projects.
|
|
# Workspaces import this and reference IDs in their layer declarations.
|
|
# Override or extend by merging with &: `D.validations & { my-check = { ... } }`
|
|
|
|
{
|
|
validations = {
|
|
# ── Rust linting ─────────────────────────────────────────────────────────
|
|
|
|
rust-fmt = {
|
|
id = "rust-fmt",
|
|
kind = 'Lint,
|
|
tool = "cargo",
|
|
args = ["+nightly", "fmt", "--all", "--", "--check"],
|
|
when = ["*.rs"],
|
|
fail_fast = true,
|
|
cargo_profile = "",
|
|
},
|
|
|
|
rust-clippy = {
|
|
id = "rust-clippy",
|
|
kind = 'Lint,
|
|
tool = "cargo",
|
|
args = ["clippy", "--all-targets", "--no-deps", "--profile", "clippy", "--", "-D", "warnings"],
|
|
when = ["*.rs"],
|
|
fail_fast = true,
|
|
cargo_profile = "clippy",
|
|
},
|
|
|
|
rust-clippy-all = {
|
|
id = "rust-clippy-all",
|
|
kind = 'Lint,
|
|
tool = "cargo",
|
|
args = ["clippy", "--all-targets", "--all-features", "--", "-D", "warnings"],
|
|
when = ["*.rs"],
|
|
fail_fast = true,
|
|
cargo_profile = "",
|
|
},
|
|
|
|
# ── Rust testing ─────────────────────────────────────────────────────────
|
|
|
|
nextest-ci-test = {
|
|
id = "nextest-ci-test",
|
|
kind = 'Test,
|
|
tool = "cargo-nextest",
|
|
args = ["run", "--all-features", "--workspace",
|
|
"--profile", "ci-test", "--cargo-profile", "ci-test"],
|
|
when = ["*.rs"],
|
|
fail_fast = true,
|
|
cargo_profile = "ci-test",
|
|
},
|
|
|
|
nextest-ci = {
|
|
id = "nextest-ci",
|
|
kind = 'Test,
|
|
tool = "cargo-nextest",
|
|
args = ["run", "--all-features", "--workspace",
|
|
"--profile", "ci", "--cargo-profile", "ci"],
|
|
when = ["*.rs"],
|
|
fail_fast = false, # see all failures in CI
|
|
cargo_profile = "ci",
|
|
},
|
|
|
|
# ── Security ─────────────────────────────────────────────────────────────
|
|
|
|
deny-subset = {
|
|
id = "deny-subset",
|
|
kind = 'Security,
|
|
tool = "cargo-deny",
|
|
args = ["check", "licenses", "advisories"],
|
|
when = ["Cargo.toml", "Cargo.lock"],
|
|
fail_fast = true,
|
|
cargo_profile = "",
|
|
},
|
|
|
|
deny-all = {
|
|
id = "deny-all",
|
|
kind = 'Security,
|
|
tool = "cargo-deny",
|
|
args = ["check"],
|
|
when = [],
|
|
fail_fast = true,
|
|
cargo_profile = "",
|
|
},
|
|
|
|
geiger = {
|
|
id = "geiger",
|
|
kind = 'Security,
|
|
tool = "cargo-geiger",
|
|
args = ["--all-features", "--all-targets"],
|
|
when = ["*.rs"],
|
|
fail_fast = false, # informational by default; use --forbid-only to gate
|
|
cargo_profile = "",
|
|
},
|
|
|
|
# ── Documentation ────────────────────────────────────────────────────────
|
|
|
|
docs-check = {
|
|
id = "docs-check",
|
|
kind = 'Docs,
|
|
tool = "cargo",
|
|
args = ["doc", "--no-deps", "--workspace", "--profile", "ci", "-q"],
|
|
when = ["*.rs"],
|
|
fail_fast = true,
|
|
cargo_profile = "ci",
|
|
},
|
|
|
|
# ── Compliance (ontoref-specific) ────────────────────────────────────────
|
|
|
|
docs-drift = {
|
|
id = "docs-drift",
|
|
kind = 'Compliance,
|
|
tool = "nu",
|
|
args = ["-c", "use ./reflection/modules/sync.nu; sync diff --docs --fail-on-drift"],
|
|
when = ["*.rs"],
|
|
fail_fast = true,
|
|
cargo_profile = "",
|
|
},
|
|
|
|
manifest-coverage = {
|
|
id = "manifest-coverage",
|
|
kind = 'Compliance,
|
|
tool = "nu",
|
|
args = ["--no-config-file", "-c",
|
|
"use ./reflection/modules/sync.nu *; sync manifest-check"],
|
|
when = [".ontology/*.ncl", "reflection/modes/*.ncl", "reflection/forms/*.ncl"],
|
|
fail_fast = true,
|
|
cargo_profile = "",
|
|
},
|
|
|
|
# ── Nickel / Nushell linting ─────────────────────────────────────────────
|
|
|
|
nickel-typecheck = {
|
|
id = "nickel-typecheck",
|
|
kind = 'Lint,
|
|
tool = "nickel",
|
|
args = ["typecheck"],
|
|
when = ["*.ncl"],
|
|
fail_fast = true,
|
|
cargo_profile = "",
|
|
},
|
|
|
|
nushell-check = {
|
|
id = "nushell-check",
|
|
kind = 'Lint,
|
|
tool = "nu",
|
|
args = ["--ide-check", "100"],
|
|
when = ["*.nu"],
|
|
fail_fast = true,
|
|
cargo_profile = "",
|
|
},
|
|
|
|
# ── Markdown ─────────────────────────────────────────────────────────────
|
|
|
|
markdownlint = {
|
|
id = "markdownlint",
|
|
kind = 'Lint,
|
|
tool = "markdownlint-cli2",
|
|
args = [],
|
|
when = ["*.md"],
|
|
fail_fast = true,
|
|
cargo_profile = "",
|
|
},
|
|
},
|
|
|
|
builds = {
|
|
release-native = {
|
|
id = "release-native",
|
|
kind = 'Binary,
|
|
tool = "cargo",
|
|
args = ["build", "--release", "--workspace"],
|
|
cargo_profile = "release",
|
|
target = "",
|
|
artifacts = ["{TARGET_DIR}/release/"],
|
|
},
|
|
|
|
release-musl-x86 = {
|
|
id = "release-musl-x86",
|
|
kind = 'Binary,
|
|
tool = "cross",
|
|
args = ["build", "--target", "x86_64-unknown-linux-musl", "--release"],
|
|
cargo_profile = "release",
|
|
target = "x86_64-unknown-linux-musl",
|
|
artifacts = ["{TARGET_DIR}/x86_64-unknown-linux-musl/release/"],
|
|
},
|
|
|
|
sbom = {
|
|
id = "sbom",
|
|
kind = 'SBOM,
|
|
tool = "cargo-sbom",
|
|
args = [],
|
|
cargo_profile = "",
|
|
target = "",
|
|
artifacts = ["{ROOT}/sbom.json"],
|
|
},
|
|
|
|
docs-html = {
|
|
id = "docs-html",
|
|
kind = 'Docs,
|
|
tool = "cargo",
|
|
args = ["doc", "--no-deps", "--workspace"],
|
|
cargo_profile = "release",
|
|
target = "",
|
|
artifacts = ["{TARGET_DIR}/doc/"],
|
|
},
|
|
},
|
|
|
|
distributions = {},
|
|
}
|