341 lines
19 KiB
Text
341 lines
19 KiB
Text
|
let m = import "ontology/defaults/manifest.ncl" in
|
||
|
|
|
||
|
|
m.make_manifest {
|
||
|
|
project = "provisioning",
|
||
|
|
repo_kind = 'Mixed,
|
||
|
|
|
||
|
|
description = "Multi-crate Rust platform for cloud infrastructure provisioning: typed Nickel schemas validated at the NCL layer, formula DAG execution engine, SOLID-enforced service boundaries, pluggable providers and taskservs, NATS-brokered orchestration, Cedar authorization, and full-architecture solo mode for single-operator deployments.",
|
||
|
|
|
||
|
|
consumption_modes = [
|
||
|
|
m.make_consumption_mode {
|
||
|
|
consumer = 'Developer,
|
||
|
|
needs = ['OntologyExport],
|
||
|
|
audit_level = 'Standard,
|
||
|
|
description = "Uses provisioning CLI and workspace definitions to manage infrastructure. Extends via providers and taskservs.",
|
||
|
|
},
|
||
|
|
m.make_consumption_mode {
|
||
|
|
consumer = 'Agent,
|
||
|
|
needs = ['OntologyExport, 'JsonSchema],
|
||
|
|
audit_level = 'Quick,
|
||
|
|
description = "Reads .ontology/core.ncl to understand constraints and boundaries. Uses CLI and orchestrator APIs for infrastructure operations.",
|
||
|
|
},
|
||
|
|
],
|
||
|
|
|
||
|
|
layers = [
|
||
|
|
m.make_layer {
|
||
|
|
id = "schemas",
|
||
|
|
paths = ["schemas/"],
|
||
|
|
committed = true,
|
||
|
|
description = "Nickel type schemas for all infrastructure configuration: providers, workspaces, platform services, extensions.",
|
||
|
|
},
|
||
|
|
m.make_layer {
|
||
|
|
id = "core",
|
||
|
|
paths = ["core/"],
|
||
|
|
committed = true,
|
||
|
|
description = "CLI, libraries, plugins, Nushell scripts — the user-facing surface of provisioning.",
|
||
|
|
},
|
||
|
|
m.make_layer {
|
||
|
|
id = "platform",
|
||
|
|
paths = ["platform/"],
|
||
|
|
committed = true,
|
||
|
|
description = "Orchestrator, Control Center, Vault, Extension Registry — the control plane services.",
|
||
|
|
},
|
||
|
|
m.make_layer {
|
||
|
|
id = "catalog",
|
||
|
|
paths = ["catalog/"],
|
||
|
|
committed = true,
|
||
|
|
description = "Providers, taskservs, clusters, components, domain artifacts — IaC building block catalog and federated integration domain contracts.",
|
||
|
|
},
|
||
|
|
m.make_layer {
|
||
|
|
id = "config",
|
||
|
|
paths = ["config/", "templates/"],
|
||
|
|
committed = true,
|
||
|
|
description = "Default configuration files and infrastructure templates.",
|
||
|
|
},
|
||
|
|
m.make_layer {
|
||
|
|
id = "self-description",
|
||
|
|
paths = [".ontology/"],
|
||
|
|
committed = true,
|
||
|
|
description = "Provisioning consuming on+re: axioms, tensions, practices, state, gates, ADRs.",
|
||
|
|
},
|
||
|
|
],
|
||
|
|
|
||
|
|
operational_modes = [
|
||
|
|
m.make_op_mode {
|
||
|
|
id = "dev",
|
||
|
|
visible_layers = ["schemas", "core", "platform", "catalog", "config", "self-description"],
|
||
|
|
description = "Full development view — all layers visible.",
|
||
|
|
},
|
||
|
|
m.make_op_mode {
|
||
|
|
id = "platform-focus",
|
||
|
|
visible_layers = ["schemas", "platform", "config"],
|
||
|
|
description = "Platform engineering focus — schemas, platform services, and configuration.",
|
||
|
|
},
|
||
|
|
m.make_op_mode {
|
||
|
|
id = "catalog-focus",
|
||
|
|
visible_layers = ["schemas", "catalog", "config"],
|
||
|
|
description = "Catalog development focus — schemas, providers, taskservs, components, and configuration.",
|
||
|
|
},
|
||
|
|
],
|
||
|
|
|
||
|
|
config_surface = m.make_config_surface {
|
||
|
|
config_root = ".typedialog/provisioning/",
|
||
|
|
entry_point = "config.ncl",
|
||
|
|
kind = 'TypeDialog,
|
||
|
|
contracts_path = ".typedialog/provisioning/schemas",
|
||
|
|
overrides_dir = ".typedialog/provisioning/generated",
|
||
|
|
sections = [
|
||
|
|
m.make_config_section {
|
||
|
|
id = "provisioning",
|
||
|
|
file = "config.ncl",
|
||
|
|
contract = "schemas/provisioning-config.ncl",
|
||
|
|
description = "Root workspace configuration generated by TypeDialog — project metadata, services, database, deployment target, network, storage, monitoring, security.",
|
||
|
|
rationale = "Consumer projects declare what infrastructure they need via an interactive TypeDialog form. The NCL output is the single source of truth fed to the orchestrator. TypeDialog fragments (database-postgres, deployment-k8s, etc.) ensure only valid combinations are generated.",
|
||
|
|
mutable = true,
|
||
|
|
consumers = [
|
||
|
|
m.make_config_consumer { id = "orchestrator", kind = 'RustStruct, ref = "provisioning_orchestrator::config::OrchestratorConfig", fields = ["services", "deployment", "database"] },
|
||
|
|
m.make_config_consumer { id = "configure-nu", kind = 'NuScript, ref = ".typedialog/provisioning/configure.nu" },
|
||
|
|
m.make_config_consumer { id = "ci-woodpecker", kind = 'CiPipeline, ref = ".woodpecker/ci.yml" },
|
||
|
|
],
|
||
|
|
},
|
||
|
|
m.make_config_section {
|
||
|
|
id = "database",
|
||
|
|
file = "schemas/database.ncl",
|
||
|
|
contract = "schemas/database.ncl",
|
||
|
|
description = "Database type and connection parameters — supports sqlite, postgres, surrealdb, mysql. Generated into the root config via TypeDialog database-* fragments.",
|
||
|
|
rationale = "Database configuration is the most provider-specific section. TypeDialog fragments enforce valid parameter combinations per engine (e.g. journal_mode only valid for SQLite).",
|
||
|
|
mutable = false,
|
||
|
|
consumers = [
|
||
|
|
m.make_config_consumer { id = "orchestrator", kind = 'RustStruct, ref = "provisioning_orchestrator::config::OrchestratorConfig", fields = ["database"] },
|
||
|
|
],
|
||
|
|
},
|
||
|
|
m.make_config_section {
|
||
|
|
id = "deployment",
|
||
|
|
file = "schemas/deployment.ncl",
|
||
|
|
contract = "schemas/deployment.ncl",
|
||
|
|
description = "Deployment target — docker-compose or kubernetes. Drives which taskservs are activated and which providers are called.",
|
||
|
|
rationale = "Deployment target selection is the primary branching decision in workspace execution. TypeDialog deployment-docker and deployment-k8s fragments capture the full parameter space for each target.",
|
||
|
|
mutable = false,
|
||
|
|
consumers = [
|
||
|
|
m.make_config_consumer { id = "orchestrator", kind = 'RustStruct, ref = "provisioning_orchestrator::config::OrchestratorConfig", fields = ["deployment"] },
|
||
|
|
],
|
||
|
|
},
|
||
|
|
m.make_config_section {
|
||
|
|
id = "monitoring",
|
||
|
|
file = "schemas/monitoring.ncl",
|
||
|
|
contract = "schemas/monitoring.ncl",
|
||
|
|
description = "Observability configuration — metrics, logging, alerting. Optional; defaults from .typedialog/provisioning/defaults/monitoring-defaults.ncl.",
|
||
|
|
mutable = false,
|
||
|
|
consumers = [
|
||
|
|
m.make_config_consumer { id = "orchestrator", kind = 'RustStruct, ref = "provisioning_orchestrator::config::OrchestratorConfig", fields = ["monitoring"] },
|
||
|
|
],
|
||
|
|
},
|
||
|
|
],
|
||
|
|
},
|
||
|
|
|
||
|
|
capabilities = [
|
||
|
|
m.make_capability {
|
||
|
|
id = "formula-dag-execution",
|
||
|
|
name = "Formula DAG Execution Engine",
|
||
|
|
summary = "Typed DAG-based workflow execution with topological parallelism, retry, and rollback.",
|
||
|
|
rationale = "Positional task arrays collapse on dependency ambiguity and lack parallelism signals. Formula nodes declare depends_on, on_error, parallel, max_retries — enabling the orchestrator to derive a topological execution plan without imperative scripting.",
|
||
|
|
how = "Workspace TOML declares Formula nodes; orchestrator's formula.rs converts to DependencyGraph via topological sort; BatchExecutor executes ready nodes in parallel via NATS work queues.",
|
||
|
|
artifacts = ["schemas/lib/formula.ncl", "platform/crates/orchestrator/src/formula.rs", "platform/crates/orchestrator/src/batch.rs"],
|
||
|
|
adrs = ["adr-016-workspace-formula-dag"],
|
||
|
|
nodes = ["formula-dag-execution"],
|
||
|
|
},
|
||
|
|
m.make_capability {
|
||
|
|
id = "workspace-contract",
|
||
|
|
name = "Typed Workspace Contracts",
|
||
|
|
summary = "Nickel-validated workspace definitions that compose providers, taskservs, and ingredients into infrastructure DAGs.",
|
||
|
|
rationale = "Raw TOML workspace files have no type safety — invalid configs surface as runtime errors. Nickel schemas catch structural errors at write time, before any provider API is called.",
|
||
|
|
how = "CLI validates workspace TOML against schemas/config/workspace_config/ contracts via nickel export before submitting to orchestrator. Orchestrator re-validates on receipt.",
|
||
|
|
artifacts = ["schemas/config/workspace_config/", "core/crates/", "examples/workspaces/"],
|
||
|
|
nodes = ["workspace-contract"],
|
||
|
|
},
|
||
|
|
m.make_capability {
|
||
|
|
id = "provider-plugin-system",
|
||
|
|
name = "Provider Plugin System",
|
||
|
|
summary = "25-function pluggable interface for infrastructure providers — add a provider without changing the platform.",
|
||
|
|
rationale = "Hardcoded provider logic makes multi-cloud support a fork, not an extension. The provider interface isolates provider specifics behind a stable contract.",
|
||
|
|
how = "Each provider implements the ProviderInterface trait (25 functions). Orchestrator dispatches operations via the interface; provider implementations are loaded from catalog/providers/.",
|
||
|
|
artifacts = ["catalog/providers/", "platform/crates/orchestrator/src/"],
|
||
|
|
nodes = ["provider-abstraction", "taskserv-pattern"],
|
||
|
|
},
|
||
|
|
m.make_capability {
|
||
|
|
id = "solo-mode-deployment",
|
||
|
|
name = "Solo Mode — Full-Architecture Single-Operator Deployment",
|
||
|
|
summary = "Run the full platform on a laptop: embedded SurrealDB (RocksDB), child NATS server, solo_auth_middleware replacing JWT+Cedar.",
|
||
|
|
rationale = "Simplified mono-binary for solo creates two divergent code paths. Solo mode keeps the same binaries and NATS subjects — scripts written for solo work in multi-user unchanged.",
|
||
|
|
how = "--mode solo flag activates solo_auth_middleware (auto-injects admin session), SurrealDB switches to kv-surrealkv (RocksDB), NATS starts as child process. service-manager.nu orchestrates startup.",
|
||
|
|
artifacts = ["platform/crates/control-center/src/middleware/", "platform/crates/orchestrator/src/nats.rs"],
|
||
|
|
adrs = ["adr-015-solo-mode-architecture"],
|
||
|
|
nodes = ["solo-mode"],
|
||
|
|
},
|
||
|
|
m.make_capability {
|
||
|
|
id = "nats-brokered-orchestration",
|
||
|
|
name = "NATS JetStream Orchestration",
|
||
|
|
summary = "All inter-service task dispatch via NATS JetStream work queues with at-least-once delivery and state machine tracking.",
|
||
|
|
rationale = "HTTP synchronous task dispatch couples orchestrator latency to provider API latency. NATS decouples dispatch from execution, enables fan-out to taskserv workers, and provides durable state even if a worker crashes mid-task.",
|
||
|
|
how = "Orchestrator publishes tasks to JetStream streams per provider type. Taskserv workers consume via pull consumers with ack/nack. Task state machine tracks pending → running → completed/failed in SurrealDB.",
|
||
|
|
artifacts = ["platform/crates/orchestrator/src/workflow.rs", "platform/crates/platform-nats/"],
|
||
|
|
adrs = ["adr-012-nats-event-broker"],
|
||
|
|
nodes = ["platform-dispatch"],
|
||
|
|
},
|
||
|
|
m.make_capability {
|
||
|
|
id = "nickel-config-hierarchy",
|
||
|
|
name = "Nickel-Validated Configuration Hierarchy",
|
||
|
|
summary = "5-level config precedence with NCL contracts: runtime args > env vars > user config > infra config > system defaults.",
|
||
|
|
rationale = "Ad-hoc env var overrides without schema validation cause silent misconfiguration. The Nickel merge layer validates every override level against the same contracts before deserialization.",
|
||
|
|
how = "platform-config's ConfigLoader trait runs collect_env_overrides() → nickel export → serde::Deserialize. Override files are written to config/*.overrides.ncl and merged via & at the entry point.",
|
||
|
|
artifacts = ["platform/crates/platform-config/src/format.rs", "schemas/config/"],
|
||
|
|
adrs = ["adr-013-surrealdb-global-store"],
|
||
|
|
nodes = ["config-hierarchy", "type-safety-nickel"],
|
||
|
|
},
|
||
|
|
m.make_capability {
|
||
|
|
id = "solid-enforcement",
|
||
|
|
name = "SOLID Boundary Enforcement",
|
||
|
|
summary = "6 compile-time and runtime SOLID boundaries: orchestrator-only provider calls, control-center-only auth, vault-only secrets.",
|
||
|
|
rationale = "Without enforced boundaries, authorization and secrets logic diffuses across services. ADR-014 documents 6 hard boundaries with 6 enforcement layers (compile-time, dev-time, pre-commit, CI, runtime, audit).",
|
||
|
|
how = "Clippy rules, grep CI checks, Cedar policies, and runtime middleware enforce the boundaries. solo_auth_middleware is the only documented auth bypass and requires --mode solo.",
|
||
|
|
artifacts = ["platform/crates/orchestrator/", "platform/crates/control-center/", "platform/secretumvault/"],
|
||
|
|
adrs = ["adr-014-solid-enforcement"],
|
||
|
|
nodes = ["solid-boundaries"],
|
||
|
|
},
|
||
|
|
],
|
||
|
|
|
||
|
|
requirements = [
|
||
|
|
m.make_requirement {
|
||
|
|
id = "rust",
|
||
|
|
name = "Rust toolchain",
|
||
|
|
kind = 'Tool,
|
||
|
|
env = 'Development,
|
||
|
|
version = "1.75+",
|
||
|
|
impact = "Platform services and CLI cannot compile.",
|
||
|
|
provision = "rustup toolchain install stable",
|
||
|
|
},
|
||
|
|
m.make_requirement {
|
||
|
|
id = "nushell",
|
||
|
|
name = "Nushell",
|
||
|
|
kind = 'Tool,
|
||
|
|
env = 'Both,
|
||
|
|
version = "0.110+",
|
||
|
|
impact = "Reflection modes, service-manager.nu, and CLI scripts cannot execute.",
|
||
|
|
provision = "cargo install nu",
|
||
|
|
},
|
||
|
|
m.make_requirement {
|
||
|
|
id = "nickel",
|
||
|
|
name = "Nickel",
|
||
|
|
kind = 'Tool,
|
||
|
|
env = 'Both,
|
||
|
|
version = "1.15+",
|
||
|
|
impact = "Schema validation and config export cannot run. platform-config's ConfigLoader cannot operate.",
|
||
|
|
provision = "cargo install nickel-lang-cli",
|
||
|
|
},
|
||
|
|
m.make_requirement {
|
||
|
|
id = "surrealdb",
|
||
|
|
name = "SurrealDB",
|
||
|
|
kind = 'Service,
|
||
|
|
env = 'Production,
|
||
|
|
version = "2.3+",
|
||
|
|
required = false,
|
||
|
|
impact = "Multi-user deployments cannot persist task state, Cedar policies, or audit logs. Solo mode uses embedded RocksDB.",
|
||
|
|
provision = "Deploy surrealdb container or binary; solo mode uses kv-surrealkv.",
|
||
|
|
},
|
||
|
|
m.make_requirement {
|
||
|
|
id = "nats-server",
|
||
|
|
name = "NATS Server (JetStream)",
|
||
|
|
kind = 'Service,
|
||
|
|
env = 'Both,
|
||
|
|
impact = "Orchestrator cannot dispatch tasks; taskserv workers cannot receive work items. Solo mode manages nats-server as a child process.",
|
||
|
|
provision = "Install nats-server in PATH for solo mode; deploy NATS cluster for multi-user.",
|
||
|
|
},
|
||
|
|
m.make_requirement {
|
||
|
|
id = "cedar-policy",
|
||
|
|
name = "Cedar policy engine",
|
||
|
|
kind = 'Infrastructure,
|
||
|
|
env = 'Production,
|
||
|
|
required = false,
|
||
|
|
impact = "Cedar-based authorization unavailable in multi-user mode. Solo mode uses solo_auth_middleware which bypasses Cedar entirely.",
|
||
|
|
provision = "Policies stored in SurrealDB; loaded by control-center at startup.",
|
||
|
|
},
|
||
|
|
],
|
||
|
|
|
||
|
|
critical_deps = [
|
||
|
|
m.make_critical_dep {
|
||
|
|
id = "surrealdb-crate",
|
||
|
|
name = "SurrealDB client crate",
|
||
|
|
ref = "surrealdb@3",
|
||
|
|
used_for = "Task state machine persistence, Cedar policy storage, audit log, workspace history.",
|
||
|
|
failure_impact = "All stateful operations (task tracking, policy evaluation, audit) stop. Solo mode continues via kv-surrealkv but loses SurrealDB WS protocol.",
|
||
|
|
mitigation = "Feature-gated: --no-default-features disables SurrealDB for dev builds. Solo mode uses embedded kv-surrealkv (RocksDB).",
|
||
|
|
},
|
||
|
|
m.make_critical_dep {
|
||
|
|
id = "async-nats",
|
||
|
|
name = "async-nats",
|
||
|
|
ref = "async-nats@0.46",
|
||
|
|
used_for = "All inter-service task dispatch, NATS JetStream work queues, taskserv worker consumers.",
|
||
|
|
failure_impact = "Orchestrator cannot dispatch workflows; taskserv workers go idle. Solo mode manages nats-server as child — child crash is fatal.",
|
||
|
|
mitigation = "Feature-gated via platform-nats crate. Solo mode restarts nats-server on SIGTERM.",
|
||
|
|
},
|
||
|
|
m.make_critical_dep {
|
||
|
|
id = "cedar-policy-crate",
|
||
|
|
name = "cedar-policy",
|
||
|
|
ref = "cedar-policy@4.8",
|
||
|
|
used_for = "Authorization decisions in control-center: policy evaluation, RBAC, resource-level access control.",
|
||
|
|
failure_impact = "All authorization decisions in multi-user mode fail closed. Solo mode unaffected (solo_auth_middleware bypasses Cedar).",
|
||
|
|
mitigation = "Compile-time link; no runtime loading. cedar-policy is the Cedar Reference Implementation — stable API surface.",
|
||
|
|
},
|
||
|
|
m.make_critical_dep {
|
||
|
|
id = "secretumvault",
|
||
|
|
name = "secretumvault",
|
||
|
|
ref = "secretumvault (local path ../../../Development/secretumvault)",
|
||
|
|
used_for = "Secrets management: age key management, Shamir threshold unsealing, secret storage for provider credentials.",
|
||
|
|
failure_impact = "Vault service cannot start; provider credential injection fails. All infrastructure operations that require provider API keys stop.",
|
||
|
|
mitigation = "Local path dependency — pinned to checkout. Solo mode uses filesystem backend (age key).",
|
||
|
|
},
|
||
|
|
m.make_critical_dep {
|
||
|
|
id = "axum",
|
||
|
|
name = "axum",
|
||
|
|
ref = "axum@0.8",
|
||
|
|
used_for = "HTTP API layer for orchestrator, control-center, extension-registry, ai-service, mcp-server.",
|
||
|
|
failure_impact = "All HTTP API surfaces become unavailable. CLI falls back to NATS direct where supported.",
|
||
|
|
mitigation = "axum@0.8 is maintained by the Tokio project; API stability is high.",
|
||
|
|
},
|
||
|
|
],
|
||
|
|
|
||
|
|
domain_provides = {
|
||
|
|
id = "provisioning-platform",
|
||
|
|
name = "Provisioning Platform",
|
||
|
|
schema_path = "reflection/schemas/",
|
||
|
|
impl_repo_kind = "DevWorkspace",
|
||
|
|
kind = 'Implicit,
|
||
|
|
description = "Workspace infrastructure contracts: cluster topology, state dimensions, gate membranes, and operational modes for DevWorkspace projects.",
|
||
|
|
},
|
||
|
|
|
||
|
|
registry_provides = m.make_registry_provides {
|
||
|
|
participant = "provisioning",
|
||
|
|
registries = m.make_registries_config {
|
||
|
|
default = "primary",
|
||
|
|
registries = [
|
||
|
|
m.make_registry_entry {
|
||
|
|
id = "primary",
|
||
|
|
endpoint = "reg.librecloud.online",
|
||
|
|
role = 'primary,
|
||
|
|
tls = true,
|
||
|
|
namespaces = {
|
||
|
|
own = ["domains/provisioning/", "modes/provisioning/"],
|
||
|
|
prefixes = ["domains/provisioning/", "modes/provisioning/"],
|
||
|
|
},
|
||
|
|
},
|
||
|
|
],
|
||
|
|
},
|
||
|
|
},
|
||
|
|
|
||
|
|
level = {
|
||
|
|
index = 'Domain,
|
||
|
|
name = "provisioning-domain",
|
||
|
|
parent = "ontoref-base",
|
||
|
|
},
|
||
|
|
}
|