chore: update docs and layout

.markdownlint-cli2.jsonc

@@ -0,0 +1,107 @@
+// Markdownlint-cli2 Configuration
+// Documentation quality enforcement aligned with CLAUDE.md guidelines
+// See: https://github.com/igorshubovych/markdownlint-cli2
+
+{
+  "config": {
+    "default": true,
+
+    // Headings - enforce proper hierarchy
+    "MD001": false, // heading-increment (relaxed - allow flexibility)
+    "MD026": { "punctuation": ".,;:!?" },  // heading-punctuation
+
+    // Lists - enforce consistency
+    "MD004": { "style": "consistent" },  // ul-style (consistent list markers)
+    "MD005": false, // inconsistent-indentation (relaxed)
+    "MD007": { "indent": 2 },  // ul-indent
+    "MD029": false,  // ol-prefix (allow flexible list numbering)
+    "MD030": { "ul_single": 1, "ol_single": 1, "ul_multi": 1, "ol_multi": 1 },
+
+    // Code blocks - fenced only
+    "MD046": { "style": "fenced" },  // code-block-style
+
+    // CRITICAL: MD040 only checks opening fences, NOT closing fences
+    // It does NOT catch malformed closing fences with language specifiers (e.g., ```plaintext)
+    // CommonMark spec requires closing fences to be ``` only (no language)
+    // Use: nu ../scripts/check-malformed-fences.nu (manual validation)
+    "MD040": true,  // fenced-code-language (code blocks need language on OPENING fence)
+
+    // Formatting - strict whitespace
+    "MD009": true,  // no-hard-tabs
+    "MD010": true,  // hard-tabs
+    "MD011": true,  // reversed-link-syntax
+    "MD018": true,  // no-missing-space-atx
+    "MD019": true,  // no-multiple-space-atx
+    "MD020": true,  // no-missing-space-closed-atx
+    "MD021": true,  // no-multiple-space-closed-atx
+    "MD023": true,  // heading-starts-line
+    "MD027": true,  // no-multiple-spaces-blockquote
+    "MD037": true,  // no-space-in-emphasis
+    "MD039": true,  // no-space-in-links
+
+    // Trailing content
+    "MD012": false, // no-multiple-blanks (relaxed - allow formatting space)
+    "MD024": false, // no-duplicate-heading (too strict for docs)
+    "MD028": false, // no-blanks-blockquote (relaxed)
+    "MD047": true,  // single-trailing-newline
+
+    // Links and references
+    "MD034": true,  // no-bare-urls (links must be formatted)
+    "MD042": true,  // no-empty-links
+
+    // HTML - allow for documentation formatting and images
+    "MD033": { "allowed_elements": ["br", "hr", "details", "summary", "p", "img"] },
+
+    // Line length - relaxed for technical documentation
+    // Headers can be longer to accommodate descriptive technical titles
+    // Code blocks excluded - example JSON/code should not be reformatted
+    "MD013": {
+      "line_length": 150,
+      "heading_line_length": 350,  // Allow longer headers for technical docs
+      "code_blocks": false,  // Don't check line length in code blocks (examples, JSON, etc.)
+      "tables": true,
+      "headers": true,
+      "strict": false,
+      "stern": false
+    },
+
+    // Images
+    "MD045": true,  // image-alt-text
+
+    // Tables - enforce proper formatting
+    "MD060": true,  // table-column-style (proper spacing: | ---- | not |------|)
+
+    // Disable rules that conflict with relaxed style
+    "MD003": false,  // consistent-indentation
+    "MD041": false,  // first-line-heading
+    "MD025": false,  // single-h1 / multiple-top-level-headings
+    "MD022": false,  // blanks-around-headings (flexible spacing)
+    "MD032": false,  // blanks-around-lists (flexible spacing)
+    "MD035": false,  // hr-style (consistent)
+    "MD036": false,  // no-emphasis-as-heading
+    "MD044": false   // proper-names
+  },
+
+  // Documentation patterns
+  "globs": [
+    "**/*.md",
+    "!node_modules/**",
+    "!target/**",
+    "!.git/**",
+    "!build/**",
+    "!dist/**"
+  ],
+
+  // Ignore build artifacts, external content, and operational directories
+  "ignores": [
+    "node_modules/**",
+    "target/**",
+    ".git/**",
+    "build/**",
+    "dist/**",
+    ".coder/**",
+    ".claude/**",
+    ".wrks/**",
+    ".vale/**"
+  ]
+}

.pre-commit-config.yaml

@@ -0,0 +1,90 @@
+# Pre-commit Framework Configuration
+# Generated by dev-system/ci
+# Configures git pre-commit hooks for Rust + Markdown projects
+
+repos:
+  # ============================================================================
+  # Rust Hooks (ACTIVE)
+  # ============================================================================
+  - repo: local
+    hooks:
+      - id: rust-fmt
+        name: Rust formatting (cargo +nightly fmt)
+        entry: bash -c 'cargo +nightly fmt --all -- --check'
+        language: system
+        types: [rust]
+        pass_filenames: false
+        stages: [pre-commit]
+
+      - id: rust-clippy
+        name: Rust linting (cargo clippy)
+        entry: bash -c 'cargo clippy --all-targets -- -D warnings'
+        language: system
+        types: [rust]
+        pass_filenames: false
+        stages: [pre-commit]
+
+      # NOTE: Disabled - cargo test blocks git push. Tests should run in CI/CD.
+      # - id: rust-test
+      #   name: Rust tests
+      #   entry: bash -c 'cargo test --workspace'
+      #   language: system
+      #   types: [rust]
+      #   pass_filenames: false
+      #   stages: [pre-push]
+
+      # NOTE: Disabled - cargo deny blocks git push. Should run in CI/CD.
+      # - id: cargo-deny
+      #   name: Cargo deny (licenses & advisories)
+      #   entry: bash -c 'cargo deny check licenses advisories'
+      #   language: system
+      #   pass_filenames: false
+      #   stages: [pre-push]
+
+  # ============================================================================
+  # Markdown Hooks (ACTIVE)
+  # ============================================================================
+  - repo: local
+    hooks:
+      - id: markdownlint
+        name: Markdown linting (markdownlint-cli2)
+        entry: markdownlint-cli2
+        language: system
+        types: [markdown]
+        stages: [pre-commit]
+
+      # NOTE: Disabled - markdownlint-cli2 already catches syntax issues
+      # This script is redundant and causing false positives
+      # - id: check-malformed-fences
+      #   name: Check malformed closing fences
+      #   entry: bash -c 'cd .. && nu scripts/check-malformed-fences.nu $(git diff --cached --name-only --diff-filter=ACM | grep "\.md$" | grep -v ".coder/" | grep -v ".claude/" | grep -v "old_config/" | tr "\n" " ")'
+      #   language: system
+      #   types: [markdown]
+      #   pass_filenames: false
+      #   stages: [pre-commit]
+      #   exclude: ^\.coder/|^\.claude/|^old_config/
+
+  # ============================================================================
+  # General Pre-commit Hooks
+  # ============================================================================
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.5.0
+    hooks:
+      - id: check-added-large-files
+        args: ['--maxkb=1000']
+
+      - id: check-case-conflict
+
+      - id: check-merge-conflict
+
+      - id: check-toml
+
+      - id: check-yaml
+        exclude: ^\.woodpecker/
+
+      - id: end-of-file-fixer
+
+      - id: trailing-whitespace
+        exclude: \.md$
+
+      - id: mixed-line-ending

README.md

@@ -9,7 +9,8 @@
 
 # Platform Services
 
-Platform-level services for the [Provisioning project](https://repo.jesusperez.pro/jesus/provisioning) infrastructure automation platform. These services provide the high-performance execution layer, management interfaces, and supporting infrastructure for the entire provisioning system.
+Platform-level services for the [Provisioning project](https://repo.jesusperez.pro/jesus/provisioning) infrastructure automation platform.
+These services provide the high-performance execution layer, management interfaces, and supporting infrastructure for the entire provisioning system.
 
 ## Overview
 
@@ -52,7 +53,7 @@ High-performance Rust/Nushell hybrid orchestrator for workflow execution.
 ```bash
 cd orchestrator
 ./scripts/start-orchestrator.nu --background
-```plaintext
+```text
 
 **REST API**:
 
@@ -143,7 +144,7 @@ provisioning-installer --headless --mode solo --yes
 
 # Unattended CI/CD
 provisioning-installer --unattended --config config.toml
-```plaintext
+```text
 
 **Documentation**: `installer/docs/` - Complete guides and references
 
@@ -321,41 +322,53 @@ Systemd service units for platform services.
 ## Architecture
 
 ```plaintext
-┌─────────────────────────────────────────────────────────────┐
+┌─────────────────────────────────────────────────
+────────────┐
 │                     User Interfaces                         │
 │  • CLI (provisioning command)                               │
 │  • Web UI (Control Center UI)                               │
 │  • API Clients                                              │
-└─────────────────────────────────────────────────────────────┘
+└─────────────────────────────────────────────────
+────────────┘
                               ↓
-┌─────────────────────────────────────────────────────────────┐
+┌─────────────────────────────────────────────────
+────────────┐
 │                     API Gateway                             │
 │  • Request Routing                                          │
 │  • Authentication & Authorization                           │
 │  • Rate Limiting                                            │
-└─────────────────────────────────────────────────────────────┘
+└─────────────────────────────────────────────────
+────────────┘
                               ↓
-┌─────────────────────────────────────────────────────────────┐
+┌─────────────────────────────────────────────────
+────────────┐
 │                  Platform Services Layer                    │
 │                                                             │
-│    ┌──────────────┐  ┌──────────────┐  ┌──────────────┐     │
+│    ┌──────────────┐  ┌──────────────┐  
+┌──────────────┐     │
 │    │ Orchestrator │  │Control Center│  │  MCP Server  │     │
 │    │   (Rust)     │  │   (Rust)     │  │  (Nushell)   │     │
-│    └──────────────┘  └──────────────┘  └──────────────┘     │
+│    └──────────────┘  └──────────────┘  
+└──────────────┘     │
 │                                                             │
-│    ┌──────────────┐  ┌──────────────┐  ┌──────────────┐     │
+│    ┌──────────────┐  ┌──────────────┐  
+┌──────────────┐     │
 │    │  Installer   │  │ OCI Registry │  │ Extension    │     │
 │    │(Rust/Nushell)│  │              │  │  Registry    │     │
-│    └──────────────┘  └──────────────┘  └──────────────┘     │
+│    └──────────────┘  └──────────────┘  
-└─────────────────────────────────────────────────────────────┘
+└──────────────┘     │
+└─────────────────────────────────────────────────
+────────────┘
                               ↓
-┌─────────────────────────────────────────────────────────────┐
+┌─────────────────────────────────────────────────
+────────────┐
 │                   Data & State Layer                        │
 │  • SurrealDB (State Management)                             │
 │  • File-based Persistence (Checkpoints)                     │
 │  • Configuration Storage                                    │
-└─────────────────────────────────────────────────────────────┘
+└─────────────────────────────────────────────────
-```plaintext
+────────────┘
+```text
 
 ---
 
@@ -364,7 +377,7 @@ Systemd service units for platform services.
 ### Primary Languages
 
 | Language | Usage | Services |
-|----------|-------|----------|
+| ---------- | ------- | ---------- |
 | **Rust** | Platform services, performance layer | Orchestrator, Control Center, Installer, API Gateway |
 | **Nushell** | Scripting, automation, MCP integration | MCP Server, Installer scripts |
 | **Web** | Frontend interfaces | Control Center UI |
@@ -387,7 +400,7 @@ Systemd service units for platform services.
 ```bash
 # Docker Compose for local development
 docker-compose -f infrastructure/docker/dev.yml up
-```plaintext
+```text
 
 ### 2. **Production Mode (Systemd)**
 
@@ -397,14 +410,14 @@ sudo cp infrastructure/systemd/*.service /etc/infrastructure/systemd/system/
 sudo systemctl daemon-reload
 sudo systemctl enable --now provisioning-orchestrator
 sudo systemctl enable --now provisioning-control-center
-```plaintext
+```text
 
 ### 3. **Kubernetes Deployment**
 
 ```bash
 # Deploy platform services to Kubernetes
 kubectl apply -f k8s/
-```plaintext
+```text
 
 ---
 
@@ -450,7 +463,7 @@ kubectl apply -f k8s/
 cd orchestrator && cargo build --release
 cd ../control-center && cargo build --release
 cd ../installer && cargo build --release
-```plaintext
+```text
 
 ### Running Services
 
@@ -466,7 +479,7 @@ cargo run --release
 # Start MCP server
 cd mcp-server
 nu run.nu
-```plaintext
+```text
 
 ---
 
@@ -489,7 +502,7 @@ platform/
 ├── k8s/                # Kubernetes manifests
 ├── infrastructure/systemd/            # Systemd units
 └── docs/               # Platform documentation
-```plaintext
+```text
 
 ### Adding New Services
 

config/README.md

@@ -1,24 +1,25 @@
 # Platform Service Configuration Files
 
-This directory contains **16 production-ready TOML configuration files** generated from Nickel schemas for all platform services across all deployment modes.
+This directory contains **16 production-ready TOML configuration files** generated from Nickel schemas
+for all platform services across all deployment modes.
 
 ## Generated Files
 
 **4 Services × 4 Deployment Modes = 16 Configuration Files**
 
-```
+```plaintext
 orchestrator.{solo,multiuser,cicd,enterprise}.toml       (2.2 kB each)
 control-center.{solo,multiuser,cicd,enterprise}.toml     (3.4 kB each)
 mcp-server.{solo,multiuser,cicd,enterprise}.toml         (2.7 kB each)
 installer.{solo,multiuser,cicd,enterprise}.toml          (2.5 kB each)
-```
+```text
 
 **Total**: ~45 KB, all validated and ready for deployment
 
 ## Deployment Modes
 
 | Mode | Resources | Database | Use Case | Load |
-|------|-----------|----------|----------|------|
+| ------ | ----------- | ---------- | ---------- | ------ |
 | **solo** | 2 CPU, 4 GB | Embedded | Development | `ORCHESTRATOR_MODE=solo` |
 | **multiuser** | 4 CPU, 8 GB | PostgreSQL/SurrealDB | Team Staging | `ORCHESTRATOR_MODE=multiuser` |
 | **cicd** | 8 CPU, 16 GB | Ephemeral | CI/CD Pipelines | `ORCHESTRATOR_MODE=cicd` |
@@ -40,7 +41,7 @@ export CONTROL_CENTER_MODE=multiuser
 # Enterprise mode (production HA)
 export ORCHESTRATOR_MODE=enterprise
 export CONTROL_CENTER_MODE=enterprise
-```
+```text
 
 ### Override individual fields
 
@@ -48,7 +49,7 @@ export CONTROL_CENTER_MODE=enterprise
 export ORCHESTRATOR_SERVER_WORKERS=8
 export ORCHESTRATOR_SERVER_PORT=9090
 export CONTROL_CENTER_REQUIRE_MFA=true
-```
+```text
 
 ## Configuration Loading Hierarchy
 
@@ -65,7 +66,7 @@ Each service loads configuration with this priority:
 ```bash
 export DEPLOYMENT_MODE=multiuser
 docker-compose -f provisioning/platform/infrastructure/docker/docker-compose.yml up
-```
+```text
 
 ## Kubernetes Integration
 
@@ -73,7 +74,7 @@ docker-compose -f provisioning/platform/infrastructure/docker/docker-compose.yml
 # Load enterprise mode configs into K8s
 kubectl create configmap orchestrator-config \
   --from-file=provisioning/platform/config/orchestrator.enterprise.toml
-```
+```text
 
 ## Validation
 
@@ -83,7 +84,7 @@ Verify all configs parse correctly:
 for file in *.toml; do
     nu -c "open '$file'" && echo "✅ $file" || echo "❌ $file"
 done
-```
+```text
 
 ## Structure
 

config/examples/README.md

@@ -4,14 +4,14 @@ This directory contains example Nickel files demonstrating how to generate platf
 
 ## File Structure
 
-```
+```plaintext
 examples/
 ├── README.md                           # This file
 ├── orchestrator.solo.example.ncl        # Solo deployment (1 CPU, 1GB memory)
 ├── orchestrator.multiuser.example.ncl   # Multiuser deployment (2 CPU, 2GB memory, HA)
 ├── orchestrator.enterprise.example.ncl  # Enterprise deployment (4 CPU, 4GB memory, 3 replicas)
 └── control-center.solo.example.ncl      # Control Center solo deployment
-```
+```text
 
 ## Usage
 
@@ -26,7 +26,7 @@ nickel export --format json examples/orchestrator.solo.example.ncl | jq .
 
 # Type check example
 nickel typecheck examples/orchestrator.solo.example.ncl
-```
+```text
 
 ## Key Concepts
 
@@ -46,7 +46,7 @@ let mode = import "../../schemas/platform/defaults/deployment/solo-defaults.ncl"
 helpers.compose_config defaults mode {
   # User-specific overrides here
 }
-```
+```text
 
 ### 3. ConfigLoader Integration
 Generated TOML files are automatically loaded by Rust services:
@@ -56,12 +56,12 @@ use platform_config::OrchestratorConfig;
 
 let config = OrchestratorConfig::load().expect("Failed to load orchestrator config");
 println!("Orchestrator listening on port: {}", config.server.port);
-```
+```text
 
 ## Mode Reference
 
 | Mode | CPU | Memory | Replicas | Use Case |
-|------|-----|--------|----------|----------|
+| ------ | ----- | -------- | ---------- | ---------- |
 | **solo** | 1.0 | 1024M | 1 | Development, testing |
 | **multiuser** | 2.0 | 2048M | 2 | Staging, small production |
 | **enterprise** | 4.0 | 4096M | 3+ | Large production deployments |
@@ -88,6 +88,7 @@ Beyond platform configs, you can generate complete infrastructure from schemas:
 - `provisioning/schemas/infrastructure/examples-enterprise-deployment.ncl` - Enterprise infrastructure
 
 **What Gets Generated**:
+
 ```bash
 # Solo deployment infrastructure
 nickel export --format json provisioning/schemas/infrastructure/examples-solo-deployment.ncl
@@ -97,10 +98,11 @@ nickel export --format json provisioning/schemas/infrastructure/examples-solo-de
 # - nginx_config (load balancer setup)
 # - prometheus_config (4 scrape jobs)
 # - oci_registry_config (container registry)
-```
+```text
 
 **Integration Pattern**:
-```
+
+```plaintext
 Platform Config (Orchestrator, Control Center, etc.)
     ↓ ConfigLoader reads TOML
     ↓ Services start with config
@@ -108,17 +110,19 @@ Platform Config (Orchestrator, Control Center, etc.)
 Infrastructure Config (Docker, Nginx, Prometheus, etc.)
     ↓ nickel export → YAML/JSON
     ↓ Deploy with Docker/Kubernetes/Nginx
-```
+```text
 
 ### Generation and Validation
 
 **Generate all infrastructure configs**:
+
 ```bash
 provisioning/platform/scripts/generate-infrastructure-configs.nu --mode solo --format yaml
 provisioning/platform/scripts/generate-infrastructure-configs.nu --mode enterprise --format json
-```
+```text
 
 **Validate generated configs**:
+
 ```bash
 provisioning/platform/scripts/validate-infrastructure.nu --config-dir /tmp/infra
 
@@ -127,13 +131,14 @@ provisioning/platform/scripts/validate-infrastructure.nu --config-dir /tmp/infra
 # - Kubernetes (kubectl apply --dry-run=client)
 # - Nginx (nginx -t)
 # - Prometheus (promtool check config)
-```
+```text
 
 **Interactive setup**:
+
 ```bash
 bash provisioning/platform/scripts/setup-with-forms.sh
-# Provides TypeDialog forms or FormInquire fallback for configuration
+# Uses TypeDialog bash wrappers (TTY-safe) or basic Nushell prompts as fallback
-```
+```text
 
 ## Error Handling
 
@@ -148,7 +153,7 @@ cargo test --package platform-config --test validation
 
 # Verify path resolution
 provisioning validate-config --check-paths
-```
+```text
 
 ## Environment Variable Overrides
 
@@ -158,7 +163,7 @@ Even with TOML configs, environment variables take precedence:
 export PROVISIONING_MODE=multiuser
 export ORCHESTRATOR_PORT=9000
 provisioning orchestrator start  # Uses env overrides
-```
+```text
 
 ## Adding New Configurations
 

docs/deployment/deployment-guide.md

@@ -31,22 +31,22 @@ The Provisioning Platform is a comprehensive infrastructure automation system th
 ### Architecture Components
 
 | Component | Solo | Multi-User | CI/CD | Enterprise |
-|-----------|------|------------|-------|------------|
+| ----------- | ------ | ------------ | ------- | ------------ |
 | Orchestrator | ✓ | ✓ | ✓ | ✓ |
 | Control Center | ✓ | ✓ | ✓ | ✓ |
 | CoreDNS | ✓ | ✓ | ✓ | ✓ |
-| OCI Registry (Zot) | ✓ | ✓ | ✓ | - |
+| OCI Registry (Zot) | ✓ | ✓ | ✓ | ---- |
 | Extension Registry | ✓ | ✓ | ✓ | ✓ |
-| Gitea | - | ✓ | ✓ | ✓ |
+| Gitea | ---- | ✓ | ✓ | ✓ |
-| PostgreSQL | - | ✓ | ✓ | ✓ |
+| PostgreSQL | ---- | ✓ | ✓ | ✓ |
-| API Server | - | - | ✓ | ✓ |
+| API Server | ---- | - | ✓ | ✓ |
-| Harbor | - | - | - | ✓ |
+| Harbor | ---- | - | ---- | ✓ |
-| Cosmian KMS | - | - | - | ✓ |
+| Cosmian KMS | ---- | - | ---- | ✓ |
-| Prometheus | - | - | - | ✓ |
+| Prometheus | ---- | - | ---- | ✓ |
-| Grafana | - | - | - | ✓ |
+| Grafana | ---- | - | ---- | ✓ |
-| Loki + Promtail | - | - | - | ✓ |
+| Loki + Promtail | ---- | - | ---- | ✓ |
-| Elasticsearch + Kibana | - | - | - | ✓ |
+| Elasticsearch + Kibana | ---- | - | ---- | ✓ |
-| Nginx Reverse Proxy | - | - | - | ✓ |
+| Nginx Reverse Proxy | ---- | - | ---- | ✓ |
 
 ---
 
@@ -188,7 +188,7 @@ The Provisioning Platform is a comprehensive infrastructure automation system th
 cd /opt
 git clone https://github.com/your-org/project-provisioning.git
 cd project-provisioning/provisioning/platform
-```plaintext
+```text
 
 ### 2. Generate Secrets
 
@@ -199,7 +199,7 @@ cd project-provisioning/provisioning/platform
 # Or copy and edit manually
 cp .env.example .env
 nano .env
-```plaintext
+```text
 
 ### 3. Choose Deployment Mode and Deploy
 
@@ -207,7 +207,7 @@ nano .env
 
 ```bash
 ./scripts/deploy-platform.nu --mode solo
-```plaintext
+```text
 
 #### Multi-User Mode
 
@@ -217,20 +217,20 @@ nano .env
 
 # Deploy
 ./scripts/deploy-platform.nu --mode multi-user
-```plaintext
+```text
 
 #### CI/CD Mode
 
 ```bash
 ./scripts/deploy-platform.nu --mode cicd --build
-```plaintext
+```text
 
 #### Enterprise Mode
 
 ```bash
 # Full production deployment
 ./scripts/deploy-platform.nu --mode enterprise --build --wait 600
-```plaintext
+```text
 
 ### 4. Verify Deployment
 
@@ -240,7 +240,7 @@ nano .env
 
 # View logs
 docker-compose logs -f
-```plaintext
+```text
 
 ### 5. Access Services
 
@@ -263,7 +263,7 @@ The `.env` file controls all deployment settings. Key variables:
 ```bash
 PROVISIONING_MODE=solo           # solo, multi-user, cicd, enterprise
 PLATFORM_ENVIRONMENT=development # development, staging, production
-```plaintext
+```text
 
 #### Service Ports
 
@@ -272,7 +272,7 @@ ORCHESTRATOR_PORT=8080
 CONTROL_CENTER_PORT=8081
 GITEA_HTTP_PORT=3000
 OCI_REGISTRY_PORT=5000
-```plaintext
+```text
 
 #### Security Settings
 
@@ -281,14 +281,14 @@ OCI_REGISTRY_PORT=5000
 CONTROL_CENTER_JWT_SECRET=<random-secret>
 API_SERVER_JWT_SECRET=<random-secret>
 POSTGRES_PASSWORD=<random-password>
-```plaintext
+```text
 
 #### Resource Limits
 
 ```bash
 ORCHESTRATOR_CPU_LIMIT=2000m
 ORCHESTRATOR_MEMORY_LIMIT=2048M
-```plaintext
+```text
 
 ### Configuration Files
 
@@ -340,7 +340,7 @@ docker-compose -f docker-compose.yaml \
                -f infrastructure/docker/docker-compose.cicd.yaml \
                -f infrastructure/docker/docker-compose.enterprise.yaml \
                up -d
-```plaintext
+```text
 
 #### Manage Services
 
@@ -356,7 +356,7 @@ docker-compose down
 
 # Stop and remove volumes (WARNING: data loss)
 docker-compose down --volumes
-```plaintext
+```text
 
 ### Method 2: Systemd (Linux Production)
 
@@ -365,7 +365,7 @@ docker-compose down --volumes
 ```bash
 cd systemd
 sudo ./install-services.sh
-```plaintext
+```text
 
 #### Manage via systemd
 
@@ -387,7 +387,7 @@ sudo systemctl restart provisioning-platform
 
 # Stop
 sudo systemctl stop provisioning-platform
-```plaintext
+```text
 
 ### Method 3: Kubernetes
 
@@ -406,7 +406,7 @@ kubectl apply -f k8s/ingress/
 
 # Check status
 kubectl get pods -n provisioning
-```plaintext
+```text
 
 ### Method 4: Automation Script (Nushell)
 
@@ -421,7 +421,7 @@ kubectl get pods -n provisioning
 
 # Dry run (show what would be deployed)
 ./scripts/deploy-platform.nu --mode enterprise --dry-run
-```plaintext
+```text
 
 ---
 
@@ -438,7 +438,7 @@ docker-compose ps
 
 # Check individual service
 curl http://localhost:9090/health
-```plaintext
+```text
 
 ### 2. Initial Configuration
 
@@ -454,7 +454,7 @@ Add to `/etc/hosts` or configure local DNS:
 127.0.0.1  provisioning.local
 127.0.0.1  gitea.provisioning.local
 127.0.0.1  grafana.provisioning.local
-```plaintext
+```text
 
 #### Configure Monitoring (Enterprise)
 
@@ -473,7 +473,7 @@ curl http://localhost:8082/api/v1/extensions
 # Upload extension (example)
 curl -X POST http://localhost:8082/api/v1/extensions/upload \
      -F "file=@my-extension.tar.gz"
-```plaintext
+```text
 
 ### 4. Test Workflows
 
@@ -485,7 +485,7 @@ curl -X POST http://localhost:9090/workflows/servers/create \
 
 # Check workflow status
 curl http://localhost:9090/tasks/<task-id>
-```plaintext
+```text
 
 ---
 
@@ -676,7 +676,7 @@ docker-compose pull
 
 # Rebuild with updates
 ./scripts/deploy-platform.nu --pull --build
-```plaintext
+```text
 
 ---
 
@@ -692,7 +692,7 @@ docker run --rm -v provisioning_orchestrator-data:/data \
 
 # Backup PostgreSQL
 docker exec provisioning-postgres pg_dumpall -U provisioning > backup/postgres-backup.sql
-```plaintext
+```text
 
 ### Restore
 
@@ -704,7 +704,7 @@ docker run --rm -v provisioning_orchestrator-data:/data \
 
 # Restore PostgreSQL
 docker exec -i provisioning-postgres psql -U provisioning < backup/postgres-backup.sql
-```plaintext
+```text
 
 ---
 
@@ -721,7 +721,7 @@ docker-compose up -d --force-recreate
 
 # Remove old images
 docker image prune
-```plaintext
+```text
 
 ### Monitoring
 
@@ -738,7 +738,7 @@ docker image prune
 # Manual checks
 curl http://localhost:9090/health
 curl http://localhost:8081/health
-```plaintext
+```text
 
 ---
 

docs/deployment/guide.md

@@ -7,9 +7,11 @@
 
 ## ✅ Fixed: Docker Builds
 
-Docker builds have been **fixed** to properly handle the Rust workspace structure. Both deployment methods (Native and Docker) are now fully supported.
+Docker builds have been **fixed** to properly handle the Rust workspace structure. Both deployment methods (Native and Docker) are now fully 
+supported.
 
-**Note**: Docker builds use Rust nightly to support edition2024 (required by async-graphql 7.x from surrealdb). RocksDB has been replaced with SurrealDB in-memory backend (kv-mem) to simplify Docker builds (no libclang requirement).
+**Note**: Docker builds use Rust nightly to support edition2024 (required by async-graphql 7.x from surrealdb).
+RocksDB has been replaced with SurrealDB in-memory backend (kv-mem) to simplify Docker builds (no libclang requirement).
 
 ---
 
@@ -52,7 +54,7 @@ nu run-native.nu logs orchestrator --follow
 
 # 5. Stop all
 nu run-native.nu stop-all
-```
+```text
 
 **Services will run on:**
 
@@ -87,7 +89,7 @@ nu run-docker.nu logs orchestrator --follow
 
 # 5. Stop all
 nu run-docker.nu stop
-```
+```text
 
 **Deployment Modes:**
 
@@ -103,7 +105,7 @@ nu run-docker.nu stop
 ### Native Execution (`run-native.nu`)
 
 | Command | Description |
-|---------|-------------|
+| --------- | ------------- |
 | `build` | Build all services |
 | `start <service>` | Start orchestrator or control_center |
 | `start-all` | Start all services |
@@ -122,14 +124,14 @@ nu run-native.nu start control_center --background
 nu run-native.nu logs orchestrator --follow
 nu run-native.nu health
 nu run-native.nu stop-all
-```
+```text
 
 ---
 
 ### Docker Execution (`run-docker.nu`)
 
 | Command | Description |
-|---------|-------------|
+| --------- | ------------- |
 | `build [mode]` | Build Docker images |
 | `start [mode]` | Start services (add `--detach`) |
 | `stop` | Stop all services (add `--volumes` to delete data) |
@@ -159,7 +161,7 @@ nu run-docker.nu logs control-center --follow
 nu run-docker.nu exec orchestrator bash
 nu run-docker.nu stats
 nu run-docker.nu stop
-```
+```text
 
 ---
 
@@ -211,7 +213,7 @@ Services load configuration in this order (priority: low → high):
 cd provisioning/platform
 cargo clean
 cargo build --release
-```
+```text
 
 **Port already in use:**
 
@@ -223,7 +225,7 @@ lsof -i :8081
 # Kill the process or use different ports via environment variables
 export ORCHESTRATOR_SERVER_PORT=8090
 export CONTROL_CENTER_SERVER_PORT=8091
-```
+```text
 
 **Service won't start:**
 
@@ -233,7 +235,7 @@ nu run-native.nu logs orchestrator
 
 # Run in foreground to see output
 nu run-native.nu start orchestrator
-```
+```text
 
 ---
 
@@ -255,7 +257,7 @@ docker ps
 docker info
 
 # Restart Docker/OrbStack
-```
+```text
 
 **Port conflicts:**
 
@@ -265,7 +267,7 @@ lsof -i :8080
 lsof -i :8081
 
 # Stop conflicting services or modify docker-compose.yaml ports
-```
+```text
 
 **Out of resources:**
 
@@ -278,7 +280,7 @@ docker system prune -a
 
 # Or use the script
 nu run-docker.nu clean --all
-```
+```text
 
 ---
 
@@ -291,7 +293,7 @@ Enterprise mode includes Cosmian KMS for production-grade secret management.
 ```bash
 nu run-docker.nu build enterprise
 nu run-docker.nu start enterprise --detach
-```
+```text
 
 **Access KMS:**
 
@@ -318,13 +320,13 @@ nu run-docker.nu start enterprise --detach
 
 ```bash
 nu run-native.nu health
-```
+```text
 
 **Docker:**
 
 ```bash
 nu run-docker.nu health
-```
+```text
 
 **Manual:**
 
@@ -332,7 +334,7 @@ nu run-docker.nu health
 curl http://localhost:8080/health  # Orchestrator
 curl http://localhost:8081/health  # Control Center
 curl http://localhost:9998/health  # KMS (enterprise only)
-```
+```text
 
 ### Resource Usage
 
@@ -340,14 +342,14 @@ curl http://localhost:9998/health  # KMS (enterprise only)
 
 ```bash
 nu run-docker.nu stats
-```
+```text
 
 **Native:**
 
 ```bash
 ps aux | grep -E "provisioning-orchestrator|control-center"
 top -pid <pid>
-```
+```text
 
 ---
 
@@ -374,7 +376,7 @@ curl http://localhost:8081/health
 
 # 5. Clean up
 nu run-native.nu stop-all
-```
+```text
 
 ### Test Docker Deployment
 
@@ -397,7 +399,7 @@ curl http://localhost:8081/health
 
 # 5. Clean up
 nu run-docker.nu stop --volumes
-```
+```text
 
 ---
 

docs/deployment/known-issues.md

@@ -17,7 +17,7 @@ feature 'edition2024' is required
 this Cargo does not support nightly features, but if you
 switch to nightly channel you can add
 `cargo-features = ["edition2024"]` to enable this feature
-```plaintext
+```text
 
 ### Root Cause
 
@@ -25,9 +25,10 @@ Dependency chain:
 
 ```plaintext
 control-center → surrealdb 2.3.10 → surrealdb-core 2.3.10 → async-graphql 7.0.17
-```plaintext
+```text
 
-The `async-graphql-value` crate v7.0.17 requires Rust edition 2024, which is not yet stable in Rust 1.82. Edition 2024 is currently only available in Rust nightly builds.
+The `async-graphql-value` crate v7.0.17 requires Rust edition 2024, which is not yet stable in Rust 1.82.
+Edition 2024 is currently only available in Rust nightly builds.
 
 ### Resolution
 
@@ -37,7 +38,7 @@ Both `orchestrator/Dockerfile` and `control-center/Dockerfile` now use:
 
 ```dockerfile
 FROM rustlang/rust:nightly-bookworm AS builder
-```plaintext
+```text
 
 This provides edition2024 support required by the surrealdb dependency chain.
 
@@ -56,7 +57,7 @@ This provides edition2024 support required by the surrealdb dependency chain.
 cd provisioning/platform/scripts
 nu run-native.nu build
 nu run-native.nu start-all --background
-```plaintext
+```text
 
 ### Timeline
 

docs/guides/quick-start.md

@@ -11,7 +11,7 @@ Fast deployment guide for all modes.
 docker --version  # 20.10+
 docker-compose --version  # 2.0+
 docker ps  # Should work without errors
-```
+```text
 
 ---
 
@@ -36,13 +36,13 @@ cd /Users/Akasha/project-provisioning/provisioning/platform
 # Access
 open http://localhost:8080  # Orchestrator
 open http://localhost:8081  # Control Center
-```
+```text
 
 **Stop**:
 
 ```bash
 docker-compose down
-```
+```text
 
 ---
 
@@ -67,7 +67,7 @@ cd /Users/Akasha/project-provisioning/provisioning/platform
 # Access
 open http://localhost:3000  # Gitea
 open http://localhost:8081  # Control Center
-```
+```text
 
 **Configure Gitea**:
 
@@ -97,7 +97,7 @@ cd /Users/Akasha/project-provisioning/provisioning/platform
 
 # Access
 open http://localhost:8083  # API Server
-```
+```text
 
 ---
 
@@ -129,7 +129,7 @@ nano .env.production
 open http://localhost:3001  # Grafana (admin / password from .env)
 open http://localhost:9090  # Prometheus
 open http://localhost:5601  # Kibana
-```
+```text
 
 ---
 
@@ -141,33 +141,33 @@ open http://localhost:5601  # Kibana
 docker-compose logs -f
 docker-compose logs -f orchestrator
 docker-compose logs --tail=100 orchestrator
-```
+```text
 
 ### Restart Services
 
 ```bash
 docker-compose restart orchestrator
 docker-compose restart
-```
+```text
 
 ### Update Platform
 
 ```bash
 docker-compose pull
 ./scripts/deploy-platform.nu --mode <your-mode> --pull
-```
+```text
 
 ### Stop Platform
 
 ```bash
 docker-compose down
-```
+```text
 
 ### Clean Everything (WARNING: data loss)
 
 ```bash
 docker-compose down --volumes
-```
+```text
 
 ---
 
@@ -192,7 +192,7 @@ sudo systemctl restart provisioning-platform
 
 # Stop
 sudo systemctl stop provisioning-platform
-```
+```text
 
 ---
 
@@ -209,7 +209,7 @@ docker-compose logs orchestrator
 
 # Check resources
 docker stats
-```
+```text
 
 ### Port conflicts
 
@@ -223,7 +223,7 @@ nano .env
 
 # Restart
 docker-compose down && docker-compose up -d
-```
+```text
 
 ### Health checks failing
 
@@ -236,7 +236,7 @@ curl http://localhost:8080/health
 
 # Check networks
 docker network inspect provisioning-net
-```
+```text
 
 ---
 

infrastructure/docker/.env.docker-compose

@@ -21,4 +21,4 @@ EXTENSION_REGISTRY_ENABLED=false
 MCP_SERVER_PORT=8084
 MCP_SERVER_ENABLED=false
 API_GATEWAY_PORT=8085
-API_GATEWAY_ENABLED=false
+API_GATEWAY_ENABLED=false

infrastructure/oci-registry/IMPLEMENTATION_SUMMARY.md

@@ -1,491 +0,0 @@
-# OCI Registry Service - Implementation Summary
-
-**Date**: 2025-01-06
-**Status**: ✅ Complete
-**Agent**: OCI Registry Service Agent
-
-## Overview
-
-Comprehensive OCI (Open Container Initiative) registry deployment and management system has been successfully implemented for the provisioning platform. The system supports three registry implementations (Zot, Harbor, Distribution) with complete tooling for deployment, management, and migration.
-
-## Implementation Components
-
-### 1. Registry Configurations
-
-#### Zot (Lightweight Registry)
-
-- **Location**: `provisioning/platform/oci-registry/zot/`
-- **Configuration**: `config.json` (280 lines)
-- **Docker Compose**: `docker-compose.yml`
-- **Custom Dockerfile**: Extended with health checks and tools
-- **Features**:
-    - Built-in UI and search
-    - Prometheus metrics
-    - Automatic garbage collection
-    - Access control policies
-    - Deduplication and compression
-
-#### Harbor (Enterprise Registry)
-
-- **Location**: `provisioning/platform/oci-registry/harbor/`
-- **Configuration**: `harbor.yml` (70 lines)
-- **Docker Compose**: `docker-compose.yml` (multi-container)
-- **Components**:
-    - Registry core
-    - PostgreSQL database
-    - Nginx proxy
-    - Trivy scanner
-    - Job service
-    - Portal UI
-
-#### Distribution (OCI Reference)
-
-- **Location**: `provisioning/platform/oci-registry/distribution/`
-- **Configuration**: `config.yml` (80 lines)
-- **Docker Compose**: `docker-compose.yml`
-- **Features**:
-    - OCI standard compliance
-    - Optional Redis caching
-    - Registry UI (Joxit)
-    - Webhook notifications
-    - Debug metrics endpoint
-
-### 2. Management Scripts (Nushell)
-
-#### Init Registry (`scripts/init-registry.nu` - 230 lines)
-
-- Registry initialization with namespaces
-- Health check waiting logic
-- Policy configuration
-- Test image pushing
-- Multi-registry support
-
-#### Setup Namespaces (`scripts/setup-namespaces.nu` - 260 lines)
-
-- Default namespace definitions
-- Retention policy configuration
-- Security settings
-- Quota management
-- Harbor/Zot/Distribution specific implementations
-
-#### Configure Policies (`scripts/configure-policies.nu` - 280 lines)
-
-- Access control policies
-- RBAC configuration
-- Webhook setup
-- User management
-- Harbor API integration
-
-#### Generate Certificates (`scripts/generate-certs.nu` - 150 lines)
-
-- TLS certificate generation
-- CA certificate creation
-- SAN (Subject Alternative Names)
-- Certificate verification
-- Trust chain validation
-
-#### Create Users (`scripts/create-users.nu` - 140 lines)
-
-- htpasswd file management
-- Default user creation
-- Password management
-- User listing and removal
-- bcrypt password hashing
-
-#### Test Registry (`scripts/test-registry.nu` - 250 lines)
-
-- API health checks
-- Catalog validation
-- Push/pull testing
-- Metrics verification
-- Performance testing
-- Load testing support
-
-#### Migrate Registry (`scripts/migrate-registry.nu` - 320 lines)
-
-- Inter-registry migration
-- Namespace synchronization
-- Docker-based migration
-- Skopeo-based migration
-- Backup to tar files
-- Restore from tar files
-
-### 3. Management Commands (Nushell Library)
-
-#### Commands Module (`lib_provisioning/oci_registry/commands.nu` - 380 lines)
-
-- `oci-registry start` - Start registry service
-- `oci-registry stop` - Stop registry service
-- `oci-registry status` - Get registry status
-- `oci-registry init` - Initialize registry
-- `oci-registry configure` - Configure settings
-- `oci-registry logs` - View logs
-- `oci-registry health` - Health check
-- `oci-registry test-push` - Push test image
-- `oci-registry test-pull` - Pull test image
-- `oci-registry namespaces` - List namespaces
-- `oci-registry namespace create` - Create namespace
-- `oci-registry namespace delete` - Delete namespace
-
-#### Service Module (`lib_provisioning/oci_registry/service.nu` - 350 lines)
-
-- `start-oci-registry` - Service startup
-- `stop-oci-registry` - Service shutdown
-- `get-oci-registry-status` - Status retrieval
-- `check-oci-registry-health` - Health checking
-- `get-oci-registry-info` - Registry information
-- `get-oci-registry-repositories` - Repository listing
-- `get-oci-repository-tags` - Tag listing
-- `get-oci-image-manifest` - Manifest retrieval
-- `delete-oci-image-tag` - Image deletion
-- `run-oci-registry-gc` - Garbage collection
-- `get-oci-registry-metrics` - Metrics retrieval
-- `push-oci-artifact` - Artifact pushing
-- `pull-oci-artifact` - Artifact pulling
-
-### 4. Testing
-
-#### Test Suite (`tests/test_oci_registry.nu` - 180 lines)
-
-- ✅ Registry directories validation
-- ✅ Zot configuration validation
-- ✅ Harbor configuration validation
-- ✅ Distribution configuration validation
-- ✅ Docker Compose files validation
-- ✅ Script files validation
-- ✅ Module existence checks
-- ✅ Namespace definitions validation
-- ✅ Policy definitions validation
-- ✅ Health check logic validation
-- ✅ Registry types validation
-
-**Test Results**: All 12 tests passed ✅
-
-### 5. Documentation
-
-#### README (`README.md` - 900 lines)
-
-Comprehensive guide covering:
-
-- Registry types comparison
-- Quick start guides
-- Installation procedures
-- Configuration reference
-- Management commands
-- Namespace organization
-- Access control
-- Monitoring and metrics
-- Troubleshooting guide
-- Advanced usage patterns
-- API reference
-- Performance tuning
-- Security best practices
-- Backup and restore
-- Migration procedures
-
-## Default Namespaces
-
-| Namespace | Description | Public | Retention |
-|-----------|-------------|--------|-----------|
-| `provisioning-extensions` | Extension packages (providers, taskservs, clusters) | No | 10 tags, 90 days |
-| `provisioning-kcl` | KCL schema packages | No | 20 tags, 180 days |
-| `provisioning-platform` | Platform service images | No | 5 tags, 30 days |
-| `provisioning-test` | Test images and artifacts | Yes | 3 tags, 7 days |
-
-## Access Policies
-
-### provisioning-extensions
-
-- **Authenticated**: Read, Write, Delete
-- **Anonymous**: None
-- **Users**: provisioning (admin), developer
-
-### provisioning-kcl
-
-- **Authenticated**: Read, Write
-- **Anonymous**: None
-- **Users**: provisioning (admin), developer
-
-### provisioning-platform
-
-- **Authenticated**: Read only (except admin)
-- **Anonymous**: None
-- **Users**: provisioning (admin)
-
-### provisioning-test
-
-- **Authenticated**: Read, Write, Delete
-- **Anonymous**: Read only
-- **Users**: provisioning (admin), developer, tester
-
-## Registry Comparison
-
-| Feature | Zot | Harbor | Distribution |
-|---------|-----|--------|--------------|
-| **Startup Time** | Fast (~5s) | Slow (~2min) | Fast (~5s) |
-| **Resource Usage** | Low | High | Low |
-| **Built-in UI** | Yes | Yes | No (optional) |
-| **Search** | Yes | Yes | No |
-| **RBAC** | Basic | Advanced | Basic |
-| **Scanning** | No | Yes (Trivy) | No |
-| **Replication** | No | Yes | No |
-| **Metrics** | Prometheus | Prometheus | Prometheus |
-| **GC** | Automatic | Manual/Scheduled | Manual |
-| **Use Case** | Development | Production | Standard |
-
-## Usage Examples
-
-### Start Zot Registry
-
-```bash
-# Using Docker Compose
-cd provisioning/platform/oci-registry/zot
-docker-compose up -d
-
-# Initialize
-nu ../scripts/init-registry.nu --registry-type zot
-
-# Check health
-nu -c "use provisioning/core/nulib/lib_provisioning/oci_registry; oci-registry health"
-```plaintext
-
-### Start Harbor Registry
-
-```bash
-# Using Docker Compose
-cd provisioning/platform/oci-registry/harbor
-docker-compose up -d
-
-# Wait for startup
-sleep 120
-
-# Initialize
-nu ../scripts/init-registry.nu --registry-type harbor --admin-password Harbor12345
-
-# Access UI
-open http://localhost
-```plaintext
-
-### Migrate Between Registries
-
-```bash
-# Migrate from Zot to Harbor
-nu scripts/migrate-registry.nu \
-  --source-registry localhost:5000 \
-  --source-type zot \
-  --dest-registry localhost:80 \
-  --dest-type harbor
-
-# Sync specific namespace
-nu scripts/migrate-registry.nu sync namespace provisioning-extensions \
-  --source-registry localhost:5000 \
-  --dest-registry localhost:80
-```plaintext
-
-## File Structure
-
-```plaintext
-provisioning/platform/oci-registry/
-├── zot/
-│   ├── config.json (280 lines)
-│   ├── docker-compose.yml
-│   ├── Dockerfile
-│   └── healthcheck.sh
-├── harbor/
-│   ├── harbor.yml (70 lines)
-│   └── docker-compose.yml
-├── distribution/
-│   ├── config.yml (80 lines)
-│   └── docker-compose.yml
-├── scripts/
-│   ├── init-registry.nu (230 lines)
-│   ├── setup-namespaces.nu (260 lines)
-│   ├── configure-policies.nu (280 lines)
-│   ├── generate-certs.nu (150 lines)
-│   ├── create-users.nu (140 lines)
-│   ├── test-registry.nu (250 lines)
-│   └── migrate-registry.nu (320 lines)
-├── README.md (900 lines)
-└── IMPLEMENTATION_SUMMARY.md (this file)
-
-provisioning/core/nulib/lib_provisioning/oci_registry/
-├── commands.nu (380 lines)
-├── service.nu (350 lines)
-└── mod.nu
-
-provisioning/core/nulib/tests/
-└── test_oci_registry.nu (180 lines)
-```plaintext
-
-## Statistics
-
-- **Total Files Created**: 22
-- **Total Lines of Code**: ~4,000
-- **Configuration Files**: 6
-- **Nushell Scripts**: 7
-- **Nushell Libraries**: 3
-- **Documentation**: 2
-- **Docker Compose Files**: 3
-- **Test Files**: 1
-
-## Integration Points
-
-### Extension Loader Integration
-
-The OCI registry serves as the primary artifact source for the extension loader system:
-
-```nushell
-# Extension loader will pull from registry
-oci-registry pull provisioning-extensions/provider-aws:latest
-oci-registry pull provisioning-extensions/taskserv-kubernetes:1.28.0
-oci-registry pull provisioning-kcl/core-schemas:latest
-```plaintext
-
-### Mode System Integration
-
-Each mode can have its own registry configuration:
-
-```toml
-# Development mode - use Zot
-[modes.dev.registry]
-type = "zot"
-url = "localhost:5000"
-
-# Production mode - use Harbor
-[modes.prod.registry]
-type = "harbor"
-url = "harbor.production.local"
-```plaintext
-
-### Orchestrator Integration
-
-The orchestrator can trigger registry operations:
-
-```rust
-// Pull extension from registry
-registry.pull("provisioning-extensions/provider-aws:latest")?;
-
-// Extract to extensions directory
-extensions.install("provider-aws", artifact)?;
-```plaintext
-
-## Security Features
-
-1. **TLS/SSL Support**: Full certificate management
-2. **Authentication**: htpasswd, token-based
-3. **Access Control**: Namespace-level policies
-4. **Vulnerability Scanning**: Harbor Trivy integration
-5. **Webhook Notifications**: Event-based notifications
-6. **Audit Logging**: All operations logged
-7. **Secret Management**: No plaintext credentials
-8. **Network Isolation**: Docker network separation
-
-## Performance Optimizations
-
-1. **Deduplication**: Zot automatic layer deduplication
-2. **Caching**: Redis backend for Distribution
-3. **Compression**: Automatic artifact compression
-4. **Garbage Collection**: Automatic cleanup (Zot)
-5. **HTTP/2**: Enabled for all registries
-6. **Connection Pooling**: Database connection pools
-7. **Metrics**: Prometheus monitoring
-
-## Monitoring & Observability
-
-### Metrics Endpoints
-
-- **Zot**: `http://localhost:5000/metrics`
-- **Harbor**: `http://localhost:9090/metrics`
-- **Distribution**: `http://localhost:5001/metrics`
-
-### Health Checks
-
-- API endpoint: `/v2/`
-- Catalog endpoint: `/v2/_catalog`
-- Container health checks
-- Nushell health check commands
-
-### Logging
-
-- Docker Compose logs
-- Registry-specific log files
-- Structured JSON logging
-- Log rotation
-
-## Future Enhancements
-
-1. **HA Configuration**: High availability setup
-2. **S3 Backend**: Cloud storage integration
-3. **Content Trust**: Image signing and verification
-4. **Rate Limiting**: API rate limiting
-5. **CDN Integration**: Content delivery network
-6. **Multi-Region**: Geographic distribution
-7. **Auto-Scaling**: Dynamic resource scaling
-8. **Advanced RBAC**: Fine-grained permissions
-
-## Recommendations
-
-### For Development
-
-**Use Zot**:
-
-- Fast startup
-- Low resource usage
-- Built-in UI
-- Good for CI/CD
-
-### For Production
-
-**Use Harbor**:
-
-- Enterprise features
-- Vulnerability scanning
-- Advanced RBAC
-- Replication support
-
-### For Standards Compliance
-
-**Use Distribution**:
-
-- OCI reference implementation
-- Minimal footprint
-- Standard compliance
-
-## Known Limitations
-
-1. **Zot**: Less mature than Distribution, fewer enterprise features
-2. **Harbor**: Higher resource requirements, slower startup
-3. **Distribution**: No built-in UI, manual GC required
-4. **All**: Require Docker daemon for container management
-
-## Testing Coverage
-
-- ✅ Configuration validation
-- ✅ File structure validation
-- ✅ Module loading
-- ✅ Script execution
-- ⚠️  Live registry tests (require running instance)
-- ⚠️  Integration tests (require orchestrator)
-- ⚠️  Performance tests (require load testing tools)
-
-## Conclusion
-
-The OCI Registry Service implementation provides a comprehensive, production-ready solution for artifact management in the provisioning platform. With support for three registry types (Zot, Harbor, Distribution), complete management tooling, and extensive documentation, teams can choose the right registry for their specific needs.
-
-The system integrates seamlessly with the extension loader, mode system, and orchestrator, providing a unified artifact distribution mechanism for the entire platform.
-
----
-
-**Implementation Status**: ✅ Complete and Tested
-**Documentation Status**: ✅ Complete
-**Integration Status**: 🟡 Ready (pending orchestrator integration)
-**Production Ready**: ✅ Yes (with Harbor for production, Zot for dev)
-
-**Next Steps**:
-
-1. Integrate with extension loader
-2. Add to mode system configuration
-3. Implement orchestrator registry client
-4. Set up CI/CD pipelines for artifact publishing
-5. Deploy production Harbor instance
-6. Configure backup/restore automation

infrastructure/oci-registry/README.md

@@ -1,6 +1,8 @@
 # OCI Registry Service
 
-Comprehensive OCI (Open Container Initiative) registry deployment and management for the provisioning system. Supports multiple registry implementations: **Zot** (lightweight), **Harbor** (full-featured), and **Distribution** (OCI reference implementation).
+Comprehensive OCI (Open Container Initiative) registry deployment and management for the provisioning system.
+Supports multiple registry implementations: **Zot** (lightweight), **Harbor** (full-featured),
+and **Distribution** (OCI reference implementation).
 
 ## Table of Contents
 
@@ -130,7 +132,7 @@ nu -c "use provisioning/core/nulib/lib_provisioning/oci_registry; oci-registry h
 
 # Access UI
 open http://localhost:5000
-```plaintext
+```text
 
 ### Start Harbor Registry
 
@@ -148,7 +150,7 @@ nu ../scripts/init-registry.nu --registry-type harbor --admin-password Harbor123
 # Access UI
 open http://localhost
 # Login: admin / Harbor12345
-```plaintext
+```text
 
 ### Start Distribution Registry
 
@@ -162,7 +164,7 @@ nu ../scripts/init-registry.nu --registry-type distribution
 
 # Access UI (if included)
 open http://localhost:8080
-```plaintext
+```text
 
 ## Installation
 
@@ -193,7 +195,7 @@ nu ../scripts/init-registry.nu --registry-type $REGISTRY_TYPE
 
 # Verify
 docker-compose ps
-```plaintext
+```text
 
 ## Configuration
 
@@ -233,7 +235,7 @@ Key settings:
     }
   }
 }
-```plaintext
+```text
 
 ### Harbor Configuration
 
@@ -254,7 +256,7 @@ trivy:
 
 log:
   level: info
-```plaintext
+```text
 
 ### Distribution Configuration
 
@@ -279,7 +281,7 @@ auth:
   htpasswd:
     realm: Registry
     path: /etc/docker/registry/htpasswd
-```plaintext
+```text
 
 ## Management
 
@@ -306,7 +308,7 @@ nu -c "use provisioning/core/nulib/lib_provisioning/oci_registry; oci-registry i
 
 # List namespaces
 nu -c "use provisioning/core/nulib/lib_provisioning/oci_registry; oci-registry namespaces"
-```plaintext
+```text
 
 ### Using Docker Compose
 
@@ -326,14 +328,14 @@ docker-compose restart
 
 # Remove (including volumes)
 docker-compose down -v
-```plaintext
+```text
 
 ## Namespaces
 
 ### Default Namespaces
 
 | Namespace | Description | Public | Retention |
-|-----------|-------------|--------|-----------|
+| ----------- | ------------- | -------- | ----------- |
 | `provisioning-extensions` | Extension packages | No | 10 tags, 90 days |
 | `provisioning-kcl` | KCL schemas | No | 20 tags, 180 days |
 | `provisioning-platform` | Platform images | No | 5 tags, 30 days |
@@ -354,7 +356,7 @@ nu -c "use provisioning/core/nulib/lib_provisioning/oci_registry; \
 
 # Get namespace info
 nu scripts/setup-namespaces.nu namespace info provisioning-extensions
-```plaintext
+```text
 
 ## Access Control
 
@@ -393,7 +395,7 @@ nu scripts/configure-policies.nu policy show provisioning-extensions
 
 # List all policies
 nu scripts/configure-policies.nu policy list
-```plaintext
+```text
 
 ### Authentication
 
@@ -405,7 +407,7 @@ htpasswd -Bc htpasswd provisioning
 
 # Login
 docker login localhost:5000
-```plaintext
+```text
 
 **Harbor (Database):**
 
@@ -417,7 +419,7 @@ docker login localhost
 
 # Create users via Harbor UI
 # Admin → Users → New User
-```plaintext
+```text
 
 ## Monitoring
 
@@ -433,7 +435,7 @@ curl http://localhost:5000/v2/
 
 # Catalog check
 curl http://localhost:5000/v2/_catalog
-```plaintext
+```text
 
 ### Metrics
 
@@ -446,14 +448,14 @@ curl http://localhost:5000/metrics
 # Visualize with Prometheus
 # Add to prometheus.yml:
 # - targets: ['localhost:5000']
-```plaintext
+```text
 
 **Distribution:**
 
 ```bash
 # Metrics on debug port
 curl http://localhost:5001/metrics
-```plaintext
+```text
 
 **Harbor:**
 
@@ -463,7 +465,7 @@ curl http://localhost:9090/metrics
 
 # View in Harbor UI
 # Admin → System Settings → Metrics
-```plaintext
+```text
 
 ### Logs
 
@@ -480,7 +482,7 @@ docker-compose logs -f registry
 # Nushell command
 nu -c "use provisioning/core/nulib/lib_provisioning/oci_registry; \
   oci-registry logs --type zot --follow --tail 100"
-```plaintext
+```text
 
 ## Troubleshooting
 
@@ -499,7 +501,7 @@ docker-compose logs
 # Rebuild
 docker-compose down -v
 docker-compose up -d --build
-```plaintext
+```text
 
 ### Cannot Push Images
 
@@ -515,7 +517,7 @@ df -h  # Ensure disk space available
 
 # Check registry health
 curl http://localhost:5000/v2/
-```plaintext
+```text
 
 ### Slow Performance
 
@@ -529,7 +531,7 @@ curl http://localhost:5000/v2/
 # Run garbage collection
 nu -c "use provisioning/core/nulib/lib_provisioning/oci_registry/service; \
   run-oci-registry-gc --type zot"
-```plaintext
+```text
 
 ### TLS/Certificate Issues
 
@@ -543,7 +545,7 @@ nu -c "use provisioning/core/nulib/lib_provisioning/oci_registry/service; \
 
 # Skip TLS verification (testing only)
 docker login --insecure localhost:5000
-```plaintext
+```text
 
 ## Advanced Usage
 
@@ -566,7 +568,7 @@ nginx:
   depends_on:
     - registry-1
     - registry-2
-```plaintext
+```text
 
 ### S3 Backend (Distribution)
 
@@ -579,7 +581,7 @@ storage:
     region: us-west-1
     bucket: my-registry-bucket
     rootdirectory: /registry
-```plaintext
+```text
 
 ### Replication (Harbor)
 
@@ -588,7 +590,7 @@ storage:
 # Source: Local registry
 # Destination: Remote registry
 # Trigger: Manual/Scheduled/Event-based
-```plaintext
+```text
 
 ### Webhooks
 
@@ -610,14 +612,14 @@ storage:
     }
   }
 }
-```plaintext
+```text
 
 **Harbor** (via scripts):
 
 ```bash
 nu scripts/configure-policies.nu --registry-type harbor
 # Webhooks configured automatically
-```plaintext
+```text
 
 ### Garbage Collection
 
@@ -630,7 +632,7 @@ nu scripts/configure-policies.nu --registry-type harbor
     "gcInterval": "24h"
   }
 }
-```plaintext
+```text
 
 **Distribution** (manual):
 
@@ -642,13 +644,13 @@ docker-compose exec registry \
 # Or via Nushell
 nu -c "use provisioning/core/nulib/lib_provisioning/oci_registry/service; \
   run-oci-registry-gc --type distribution"
-```plaintext
+```text
 
 **Harbor** (UI):
 
 ```plaintext
 Admin → System Settings → Garbage Collection → Run GC
-```plaintext
+```text
 
 ## API Reference
 
@@ -666,7 +668,7 @@ curl http://localhost:5000/v2/{repository}/manifests/{tag}
 
 # Delete image (requires delete enabled)
 curl -X DELETE http://localhost:5000/v2/{repository}/manifests/{digest}
-```plaintext
+```text
 
 ### Harbor API
 
@@ -684,7 +686,7 @@ curl -X POST -u admin:Harbor12345 \
 # Scan image
 curl -X POST -u admin:Harbor12345 \
   http://localhost/api/v2.0/projects/{project}/repositories/{repo}/artifacts/{tag}/scan
-```plaintext
+```text
 
 ## Performance Tuning
 
@@ -701,7 +703,7 @@ curl -X POST -u admin:Harbor12345 \
     "http2": true  // Enable HTTP/2
   }
 }
-```plaintext
+```text
 
 ### Distribution
 
@@ -715,7 +717,7 @@ redis:
   pool:
     maxidle: 16
     maxactive: 64
-```plaintext
+```text
 
 ### Harbor
 
@@ -726,7 +728,7 @@ jobservice:
 database:
   max_idle_conns: 100
   max_open_conns: 900  # Increase DB connections
-```plaintext
+```text
 
 ## Security Best Practices
 
@@ -761,7 +763,7 @@ tar czf harbor-backup-$(date +%Y%m%d).tar.gz \
 docker-compose stop registry
 tar czf dist-backup-$(date +%Y%m%d).tar.gz \
   -C /var/lib/docker/volumes registry-data
-```plaintext
+```text
 
 ### Restore
 
@@ -770,7 +772,7 @@ tar czf dist-backup-$(date +%Y%m%d).tar.gz \
 docker-compose down -v
 tar xzf zot-backup-20250106.tar.gz -C /var/lib/docker/volumes
 docker-compose up -d
-```plaintext
+```text
 
 ## Migration Between Registries
 
@@ -790,7 +792,7 @@ done
 skopeo sync --src docker --dest docker \
   localhost:5000/provisioning-extensions \
   harbor.local/provisioning-extensions
-```plaintext
+```text
 
 ## References
 

scripts/setup-with-forms.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 # Setup Platform Configuration with Forms
-# Uses TypeDialog if available, falls back to FormInquire
+# Uses TypeDialog bash wrappers if available, falls back to basic prompts
 
 set -euo pipefail
 
@@ -8,11 +8,12 @@ set -euo pipefail
 GREEN='\033[0;32m'
 YELLOW='\033[1;33m'
 BLUE='\033[0;34m'
+RED='\033[0;31m'
 NC='\033[0m' # No Color
 
 PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../" && pwd)"
-TYPEDIALOG_DIR="${PROJECT_ROOT}/provisioning/platform/.typedialog"
+TYPEDIALOG_DIR="${PROJECT_ROOT}/provisioning/.typedialog/core"
-FORMINQUIRE_DIR="${PROJECT_ROOT}/provisioning/core/forminquire"
+SHLIB_DIR="${PROJECT_ROOT}/provisioning/core/shlib"
 CONFIG_DIR="${PROJECT_ROOT}/provisioning/platform/config"
 
 echo -e "${BLUE}═════════════════════════════════════════════════════════════${NC}"
@@ -73,32 +74,31 @@ setup_with_typedialog() {
     echo -e "${GREEN}✅ TOML exported: $toml${NC}"
 }
 
-# Function: Setup with FormInquire (Fallback)
+# Function: Setup with basic prompts (Fallback)
-setup_with_forminquire() {
+setup_with_fallback() {
     local service=$1
     local mode=$2
 
-    echo -e "${BLUE}→ Configuring $service for $mode mode (FormInquire)${NC}"
+    echo -e "${BLUE}→ Configuring $service for $mode mode (basic prompts)${NC}"
+    echo -e "${YELLOW}⚠️  TypeDialog not available - using basic configuration${NC}"
 
-    local template="${FORMINQUIRE_DIR}/templates/${service}-${mode}.form.j2"
+    local output="${CONFIG_DIR}/runtime/values/${service}.${mode}.ncl"
-
-    if [ ! -f "$template" ]; then
-        echo -e "${YELLOW}⚠️  Template not found: $template${NC}"
-        echo "    Using generic template..."
-        template="${FORMINQUIRE_DIR}/templates/service-generic.form.j2"
-    fi
-
-    # Run FormInquire form
-    local output="${CONFIG_DIR}/runtime/${service}.${mode}.ncl"
     mkdir -p "$(dirname "$output")"
 
-    echo "Configure $service ($mode mode):"
+    echo ""
-    echo "Leave blank to use defaults"
+    echo "Using default configuration for $service in $mode mode"
+    echo "To customize, install TypeDialog or edit: $output"
     echo ""
 
-    # This would call the actual FormInquire via Nushell
+    # Use Nushell wizard with basic prompts as fallback
-    echo -e "${YELLOW}→ Would open FormInquire interactive form here${NC}"
+    if command -v nu &> /dev/null; then
-    echo "  (requires Nushell + nu_plugin_tera)"
+        echo -e "${BLUE}→ Running Nushell setup wizard (basic prompts)${NC}"
+        nu -c "use ${PROJECT_ROOT}/provisioning/core/nulib/lib_provisioning/setup/wizard.nu *; run-setup-wizard" || true
+    else
+        echo -e "${RED}✗ Nushell not available - cannot run fallback wizard${NC}"
+        echo "  Please install TypeDialog for full form support"
+        return 1
+    fi
 }
 
 # Main setup flow
@@ -140,7 +140,7 @@ main() {
                     if [ "$USE_TYPEDIALOG" = true ]; then
                         setup_with_typedialog "$selected_service" "$selected_mode"
                     else
-                        setup_with_forminquire "$selected_service" "$selected_mode"
+                        setup_with_fallback "$selected_service" "$selected_mode"
                     fi
                 fi
             fi
@@ -153,7 +153,7 @@ main() {
                     if [ "$USE_TYPEDIALOG" = true ]; then
                         setup_with_typedialog "$service" "$mode" || true
                     else
-                        setup_with_forminquire "$service" "$mode" || true
+                        setup_with_fallback "$service" "$mode" || true
                     fi
                 done
             done