chore: add assets

Two amendments from Phase 4 implementation (2026-04-17):

1. New rationale: Nushell parses use statements inside function bodies
   at module-load time, not call time. Subprocess boundary is the only
   true lazy-load mechanism. Confirmed empirically.

2. Single-entry provisioning-cli.nu tested and rejected for hot paths
   (3.1s vs 0.08-0.15s thin handlers). All 15 dispatcher wrappers fire
   at module-load time regardless of which command runs.

3. Constraints amended: bash-wrapper-has-no-runner-reference updated to
   permit provisioning-cli.nu fallback; new universal-fallback-is-
   transitional constraint documents 22 unmapped commands as migration
   debt; every-registry-command-has-thin-handler made directional.

.cargo/audit.toml

@@ -0,0 +1,37 @@
+# Generated by dev-system/ci
+# cargo-audit configuration for security vulnerability scanning
+
+# Database configuration
+[advisories]
+# The database path
+db-path = "~/.cargo/advisory-db"
+
+# Advisory database URLs
+db-urls = ["https://github.com/rustsec/advisory-db"]
+
+# How to handle different kinds of advisories
+# "allow" - Pass the check despite the warning
+# "warn" - Pass the check but warn about the issue
+# "deny" - Fail the check
+deny = ["unmaintained", "unsound", "yanked"]
+
+# Specific vulnerability IDs to ignore (in case of false positives)
+# You can use: https://rustsec.org/
+ignore = [
+  # Example: { id = "RUSTSEC-2023-XXXX", reason = "Not applicable to our use case" }
+]
+
+# How to handle vulnerabilities based on severity
+[output]
+# Deny on high severity vulnerabilities
+deny = ["high", "critical"]
+# Warn on medium severity vulnerabilities
+warn = ["medium", "low"]
+# Advisory format: "terminal", "json"
+format = "terminal"
+
+# Target configuration
+[target]
+# Check only specific targets
+# Uncomment to restrict to specific target triples
+# triple = "x86_64-unknown-linux-gnu"

.cargo/config.toml

@@ -0,0 +1,84 @@
+# Generated by dev-system/ci
+# Cargo configuration for build and compilation settings
+
+[build]
+# Number of parallel jobs for compilation
+jobs = 4
+
+# Code generation backend
+# codegen-backend = "llvm"
+
+[profile.dev]
+# Development profile - fast compilation, debug info
+debug = true
+debug-assertions = true
+incremental = true
+lto = false
+opt-level = 0
+overflow-checks = true
+panic = "unwind"
+
+[profile.release]
+# Release profile - slow compilation, optimized binary
+codegen-units = 1
+debug = false
+debug-assertions = false
+incremental = false
+lto = "thin"
+opt-level = 3
+overflow-checks = false
+panic = "abort"
+strip = false
+
+[profile.test]
+# Test profile - inherits from dev but can be optimized
+debug = true
+debug-assertions = true
+incremental = true
+lto = false
+opt-level = 1
+overflow-checks = true
+
+[profile.bench]
+# Benchmark profile - same as release
+codegen-units = 1
+debug = false
+debug-assertions = false
+incremental = false
+lto = "thin"
+opt-level = 3
+overflow-checks = false
+
+[term]
+# Terminal colors
+color = "auto"
+progress.when = "auto"
+progress.width = 80
+verbose = false
+
+[net]
+# Network settings
+git-fetch-with-cli = true
+offline = false
+
+# Strict version requirements for dependencies
+# force-non-semver-pre = true
+
+[profile.ci-test]
+# Pre-commit: no debug info, no incremental — shared .rlib between test + docs hooks
+inherits = "test"
+debug = 0
+incremental = false
+
+[profile.ci]
+# CI pipeline: line-tables-only for actionable backtraces on remote failures
+inherits = "test"
+debug = "line-tables-only"
+incremental = false
+
+[alias]
+# Custom cargo commands
+build-all = "build --all-targets"
+check-all = "check --all-targets --all-features"
+doc-all = "doc --all-features --no-deps --open"
+test-all = "test --all-features --workspace"

.clippy.toml

@@ -0,0 +1,17 @@
+# Generated by dev-system/ci
+# Clippy configuration for Rust linting
+
+# Lint level thresholds
+cognitive-complexity-threshold = 25
+excessive-nesting-threshold = 5
+type-complexity-threshold = 500
+
+# Allowed patterns (prevent lints on specific code)
+# allow-expect-in-tests = true
+# allow-unwrap-in-tests = true
+
+# Single-character variable name threshold
+single-char-binding-names-threshold = 4
+
+# Note: Lint configurations belong in Cargo.toml under [lints.clippy] or [workspace.lints.clippy]
+# This file only contains clippy configuration parameters, not lint levels

.github/workflows/nickel-typecheck.yml

@@ -0,0 +1,116 @@
+# GitHub Actions Nickel Type Checking Workflow
+# Generated by dev-system/ci
+# Validates all Nickel schemas with nickel typecheck
+
+name: Nickel Type Check
+
+on:
+  push:
+    branches: [main, develop]
+    paths: ['**.ncl']
+  pull_request:
+    branches: [main]
+    paths: ['**.ncl']
+
+jobs:
+  typecheck:
+    name: Nickel Type Checking
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Nickel
+        run: |
+          #!/usr/bin/env bash
+          set -e
+
+          echo "📦 Installing Nickel..."
+
+          if command -v nickel &> /dev/null; then
+            echo "✓ Nickel already installed"
+            nickel --version
+          else
+            echo "Installing via homebrew..."
+            brew install nickel || {
+              echo "Homebrew installation failed, trying from source..."
+              curl --proto '=https' --tlsv1.2 -sSf https://install.nickel-lang.org | bash || exit 1
+            }
+          fi
+
+          nickel --version
+
+      - name: Setup environment
+        run: |
+          #!/usr/bin/env bash
+          # Set NICKEL_IMPORT_PATH for schema imports
+          export NICKEL_IMPORT_PATH="/Users/Akasha/Tools/dev-system/ci/schemas:/Users/Akasha/Tools/dev-system/ci/validators:/Users/Akasha/Tools/dev-system/ci/defaults"
+          echo "NICKEL_IMPORT_PATH=$NICKEL_IMPORT_PATH" >> $GITHUB_ENV
+
+      - name: Type check schemas
+        run: |
+          #!/usr/bin/env bash
+          set -e
+
+          echo "🔍 Type checking Nickel schemas..."
+
+          # Find all .ncl files
+          SCHEMAS=$(find . -name "*.ncl" -type f \
+            ! -path "./target/*" \
+            ! -path "./.git/*" \
+            ! -path "./node_modules/*" \
+            | sort)
+
+          if [ -z "$SCHEMAS" ]; then
+            echo "⚠️  No Nickel schemas found"
+            exit 0
+          fi
+
+          FAILED=0
+          PASSED=0
+
+          # Set import path
+          export NICKEL_IMPORT_PATH="/Users/Akasha/Tools/dev-system/ci/schemas:/Users/Akasha/Tools/dev-system/ci/validators:/Users/Akasha/Tools/dev-system/ci/defaults:."
+
+          for schema in $SCHEMAS; do
+            echo "Checking: $schema"
+            if nickel typecheck "$schema" > /dev/null 2>&1; then
+              echo "  ✓ Valid"
+              ((PASSED++))
+            else
+              echo "  ❌ Type error"
+              nickel typecheck "$schema" || true
+              ((FAILED++))
+            fi
+          done
+
+          echo ""
+          echo "Summary: $PASSED passed, $FAILED failed"
+
+          if [ $FAILED -gt 0 ]; then
+            exit 1
+          fi
+
+      - name: Export and validate
+        run: |
+          #!/usr/bin/env bash
+          set -e
+
+          echo "📊 Exporting Nickel configurations..."
+
+          export NICKEL_IMPORT_PATH="/Users/Akasha/Tools/dev-system/ci/schemas:/Users/Akasha/Tools/dev-system/ci/validators:/Users/Akasha/Tools/dev-system/ci/defaults:."
+
+          # Export main configs if they exist
+          if [ -f ".typedialog/ci/schemas/ci-local.ncl" ]; then
+            echo "Exporting CI config..."
+            nickel export .typedialog/ci/schemas/ci-local.ncl > /tmp/ci-export.json
+            if [ $? -eq 0 ]; then
+              echo "  ✓ Successfully exported"
+            else
+              echo "  ❌ Export failed"
+              exit 1
+            fi
+          fi
+
+          echo "✓ All exports successful"

.github/workflows/nushell-lint.yml

@@ -0,0 +1,28 @@
+jobs:
+  validate:
+    name: Nushell IDE Check
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+    - name: Install Nushell
+      uses: hustcer/setup-nu@v3
+      with:
+        version: latest
+    - name: Validate scripts
+      run: find . -name '*.nu' -type f -exec nu --ide-check 100 {} \; 2>/dev/null | grep -E '^(Error|error)' && exit 1 || true
+    - name: Check formatting
+      run: echo 'NuShell validation passed'
+name: Nushell Validation
+on:
+  pull_request:
+    branches:
+    - main
+    paths:
+    - '**.nu'
+  push:
+    branches:
+    - main
+    - develop
+    paths:
+    - '**.nu'

.github/workflows/rust-ci.yml

@@ -0,0 +1,47 @@
+jobs:
+  audit:
+    name: Security Audit
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+    - name: Install Rust
+      uses: dtolnay/rust-toolchain@stable
+    - name: Audit
+      run: cargo audit --deny warnings
+    - name: Deny Check
+      run: cargo deny check licenses advisories
+  check:
+    name: Check + Test + Lint
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+    - name: Install Rust
+      uses: dtolnay/rust-toolchain@master
+      with:
+        toolchain: ${{ matrix.rust-version }}
+    - name: Cache
+      uses: Swatinem/rust-cache@v2
+    - name: Check
+      run: cargo check --all-targets
+    - name: Format Check
+      run: cargo fmt --all -- --check
+    - name: Clippy
+      run: cargo clippy --all-targets -- -D warnings
+    - name: Tests
+      run: cargo test --workspace
+    strategy:
+      matrix:
+        rust-version:
+        - stable
+        - nightly
+name: Rust CI
+on:
+  pull_request:
+    branches:
+    - main
+  push:
+    branches:
+    - main
+    - develop

.gitignore

@@ -3,6 +3,14 @@
 # Purpose: Track core system & platform, exclude extensions & runtime data
 # ============================================================================
 
+# Not include KCL files
+kcl
+*.k
+old_config
+rollback_instructions*
+
+docs/book
+
 # === SEPARATE REPOSITORIES ===
 # These are tracked in their own repos or pulled from external sources
 extensions/
@@ -12,7 +20,7 @@ core/plugins/nushell-plugins/
 # User-specific data, should never be committed
 # NOTE: provisioning/workspace/ contains system templates and SHOULD be tracked
 # User workspace data is at project root, not in provisioning/ repo
-wrks/
+.wrks/
 ROOT/
 OLD/
 
@@ -57,7 +65,6 @@ Cargo.lock              # Uncomment to track if this is a binary package
 # Secret files
 secrets/
 private/
-security/
 *.encrypted
 *.enc
 
@@ -101,6 +108,10 @@ platform/*/config.local.*
 **/output/
 !**/output/.gitkeep
 
+# Generated Dockerfiles (source of truth = Nickel templates)
+platform/crates/*/Dockerfile
+docker-compose.build.yml
+
 # === TEMPORARY & BACKUP FILES ===
 *.bak
 *.backup
@@ -117,8 +128,11 @@ platform/*/config.local.*
 .zed/
 .coder/
 .claude/
+.opencode
+.openpackage
+.AGENTS.md
 .migration/
-.shellcheckrc
+#.shellcheckrc
 .DS_Store
 ._*
 Thumbs.db
@@ -138,7 +152,7 @@ platform/*/.next/
 platform/*/.nuxt/
 
 # === DOCUMENTATION BUILD OUTPUTS ===
-_book/
+book/
 book-output/
 site/
 
@@ -178,3 +192,4 @@ test-logs/
 # ============================================================================
 # End of .gitignore model
 # ============================================================================
+.aider*

.markdownlint-cli2.jsonc

@@ -0,0 +1,103 @@
+// Markdownlint-cli2 Configuration
+// Documentation quality enforcement aligned with CLAUDE.md guidelines
+// See: https://github.com/igorshubovych/markdownlint-cli2
+
+{
+  "config": {
+    "default": true,
+
+    // Headings - enforce proper hierarchy
+    "MD001": false, // heading-increment (relaxed - allow flexibility)
+    "MD026": { "punctuation": ".,;:!?" },  // heading-punctuation
+
+    // Lists - enforce consistency
+    "MD004": { "style": "consistent" },  // ul-style (consistent list markers)
+    "MD005": false, // inconsistent-indentation (relaxed)
+    "MD007": { "indent": 2 },  // ul-indent
+    "MD029": false,  // ol-prefix (allow flexible list numbering)
+    "MD030": { "ul_single": 1, "ol_single": 1, "ul_multi": 1, "ol_multi": 1 },
+
+    // Code blocks - fenced only
+    "MD046": { "style": "fenced" },  // code-block-style
+    // CRITICAL: MD040 only checks for missing language on opening fence.
+    // It does NOT catch malformed closing fences with language specifiers (e.g., ```plaintext).
+    // This is a CommonMark violation that must be caught by custom pre-commit hook.
+    // Pre-commit hook: check-malformed-fences (provisioning/core/.pre-commit-config.yaml)
+    // Script: provisioning/scripts/check-malformed-fences.nu
+
+    // Formatting - strict whitespace
+    "MD009": true,  // no-hard-tabs
+    "MD010": true,  // hard-tabs
+    "MD011": true,  // reversed-link-syntax
+    "MD018": true,  // no-missing-space-atx
+    "MD019": true,  // no-multiple-space-atx
+    "MD020": true,  // no-missing-space-closed-atx
+    "MD021": true,  // no-multiple-space-closed-atx
+    "MD023": true,  // heading-starts-line
+    "MD027": true,  // no-multiple-spaces-blockquote
+    "MD037": true,  // no-space-in-emphasis
+    "MD039": true,  // no-space-in-links
+
+    // Trailing content
+    "MD012": false, // no-multiple-blanks (relaxed - allow formatting space)
+    "MD024": false, // no-duplicate-heading (too strict for docs)
+    "MD028": false, // no-blanks-blockquote (relaxed)
+    "MD031": false, // blanks-around-fences (too strict for technical docs)
+    "MD047": true,  // single-trailing-newline
+
+    // Links and references
+    "MD034": true,  // no-bare-urls (links must be formatted)
+    "MD040": true,  // fenced-code-language (code blocks need language)
+    "MD042": true,  // no-empty-links
+
+    // HTML - allow for documentation formatting and images
+    "MD033": { "allowed_elements": ["br", "hr", "details", "summary", "p", "img"] },
+
+    // Line length - relaxed for technical documentation
+    "MD013": {
+      "line_length": 150,
+      "heading_line_length": 150,
+      "code_block_line_length": 150,
+      "code_blocks": true,
+      "tables": true,
+      "headers": true,
+      "headers_line_length": 150,
+      "strict": false,
+      "stern": false
+    },
+
+    // Images
+    "MD045": true,  // image-alt-text
+
+    // Disable rules that conflict with relaxed style
+    "MD003": false,  // consistent-indentation
+    "MD041": false,  // first-line-heading
+    "MD025": false,  // single-h1 / multiple-top-level-headings
+    "MD022": false,  // blanks-around-headings (flexible spacing)
+    "MD032": false,  // blanks-around-lists (flexible spacing)
+    "MD035": false,  // hr-style (consistent)
+    "MD036": false,  // no-emphasis-as-heading
+    "MD044": false,  // proper-names
+    "MD060": true    // table-column-style (enforce proper table formatting)
+  },
+
+  // Documentation patterns
+  "globs": [
+    "docs/**/*.md",
+    "!docs/node_modules/**",
+    "!docs/build/**"
+  ],
+
+  // Ignore build artifacts, external content, and operational directories
+  "ignores": [
+    "node_modules/**",
+    "target/**",
+    ".git/**",
+    "build/**",
+    "dist/**",
+    ".coder/**",
+    ".claude/**",
+    ".wrks/**",
+    ".vale/**"
+  ]
+}

.ontology/connections.ncl

@@ -0,0 +1,37 @@
+let s = import "reflection/schemas/connections.ncl" in
+
+{
+  upstream = [
+    {
+      project = "ontoref",
+      kind    = 'LibraryDependency,
+      node    = "protocol-as-standalone",
+      via     = "local",
+      note    = "Ontoref protocol: .ontology/ schemas, ADR lifecycle, reflection modes, daemon sync.",
+    },
+    {
+      project = "stratumiops",
+      kind    = 'LibraryDependency,
+      node    = "",
+      via     = "local",
+      note    = "stratum-graph, stratum-state, platform-nats, platform-db used by orchestrator and platform services.",
+    },
+    {
+      project = "secretumvault",
+      kind    = 'LibraryDependency,
+      node    = "",
+      via     = "local",
+      note    = "Embedded in platform/secretumvault — Vault service for secrets management. Local age key in solo mode, Shamir threshold in multi-user.",
+    },
+  ],
+  downstream = [
+    {
+      project = "ontoref",
+      kind    = 'CoDeveloped,
+      node    = "dag-visualization",
+      via     = "dag-ui",
+      note    = "Provisioning DAG graph exposed to ontoref-daemon as a DagGraphProvider plugin. Co-developed: provisioning emits structured DAG events on provisioning.dag.>; ontoref-daemon consumes and visualizes them.",
+    },
+  ],
+  peers      = [],
+} | s.Connections

.ontology/core.ncl

@@ -0,0 +1,633 @@
+let d = import "ontology/defaults/core.ncl" in
+
+{
+  nodes = [
+
+    # ── Axioms (invariant = true) ─────────────────────────────────────────────
+
+    d.make_node {
+      id          = "config-driven-always",
+      name        = "Config-Driven Always",
+      pole        = 'Yang,
+      level       = 'Axiom,
+      description = "Never hardcoded, always configuration. Runtime args > env > user config > infra config > defaults. TOML/YAML are output formats, never source of truth.",
+      invariant   = true,
+      artifact_paths = ["config/", "schemas/config/"],
+    },
+
+    d.make_node {
+      id          = "type-safety-nickel",
+      name        = "Type Safety via Nickel",
+      pole        = 'Yang,
+      level       = 'Axiom,
+      description = "Nickel schemas for all infrastructure configuration. TOML/YAML are generated output, never source of truth. Every config change is validated at the schema level before reaching runtime.",
+      invariant   = true,
+      artifact_paths = ["schemas/"],
+    },
+
+    d.make_node {
+      id          = "solid-boundaries",
+      name        = "SOLID Architecture Boundaries",
+      pole        = 'Yang,
+      level       = 'Axiom,
+      description = "6 hard boundaries with 6 layers of enforcement. Orchestrator ONLY does provider APIs + SSH. Auth decisions ONLY in Control Center. Secrets ONLY via Vault. Violations caught at compile-time, dev-time, pre-commit, CI, runtime, and audit.",
+      invariant   = true,
+      artifact_paths = ["platform/crates/orchestrator/", "platform/crates/control-center/", "platform/secretumvault/"],
+    },
+
+    d.make_node {
+      id          = "provider-abstraction",
+      name        = "Provider Abstraction",
+      pole        = 'Yang,
+      level       = 'Axiom,
+      description = "Providers as pluggable interface of 25 functions. New provider = implement interface, not change platform. Provider implementations are isolated in catalog/providers/.",
+      invariant   = true,
+      artifact_paths = ["catalog/providers/"],
+    },
+
+    # ── Tensions ──────────────────────────────────────────────────────────────
+
+    d.make_node {
+      id          = "nickel-complexity-vs-accessibility",
+      name        = "Nickel Complexity vs Accessibility",
+      pole        = 'Spiral,
+      level       = 'Tension,
+      description = "Richer Nickel schemas provide better validation and safety but increase the barrier of entry for contributors. The balance: compose pattern over merge operator, progressive schema layers.",
+    },
+
+    d.make_node {
+      id          = "monorepo-vs-split",
+      name        = "Monorepo vs Split Repos",
+      pole        = 'Spiral,
+      level       = 'Tension,
+      description = "Everything in one repo simplifies development and cross-cutting changes but complicates CI, ownership boundaries, and workspace isolation.",
+    },
+
+    d.make_node {
+      id          = "centralized-vs-scripted",
+      name        = "Centralized Orchestration vs Scripts",
+      pole        = 'Spiral,
+      level       = 'Tension,
+      description = "Orchestrator provides audit trail, rollback, and state machine but adds complexity vs direct provider scripts. Solo mode mitigates by keeping full architecture with relaxed auth.",
+    },
+
+    d.make_node {
+      id          = "extension-graph-vs-declarative-config",
+      name        = "Extension Ontology vs Pure Config",
+      pole        = 'Spiral,
+      level       = 'Tension,
+      description = "The planned extension to embed ontology nodes in metadata.ncl makes extensions graph-aware but blurs the line between configuration and code. Simple extensions should remain pure config; only extensions with non-trivial platform relationships should declare ontology nodes. The resolution: ontology fields in metadata.ncl are optional and additive — the base metadata contract stays simple.",
+    },
+
+    d.make_node {
+      id          = "nushell-vs-rust-boundary",
+      name        = "Nushell Library Boundary vs Rust Platform",
+      pole        = 'Spiral,
+      level       = 'Tension,
+      description = "The Nushell CLI library (core/nulib/) grows to cover operations that could be in Rust platform crates. Moving logic to Rust improves type safety and testability; keeping it in Nushell keeps it operator-scriptable and writable without recompilation. Partial resolution via smart-interface-unification (ADR-029): Rust owns the Registry and all Tool dispatch semantics; Nushell owns orchestration sequences, the three-tier fallback probe chain, and the required legacy closure per operation. The boundary is now structural — operations cross it via tool-call, not via direct Nushell reimplementation.",
+    },
+
+    # ── Practices ─────────────────────────────────────────────────────────────
+
+    d.make_node {
+      id          = "nushell-cli-library",
+      name        = "Nushell CLI Library",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "The primary user-facing command surface — 60+ Nushell modules in core/nulib/ covering all platform operations: server/cluster/taskserv/workspace lifecycle, batch ops, provider discovery, extension loading, orchestrator integration, AI tooling, secrets, observability. The CLI composes nulib modules; the library consumes platform APIs and extension metadata.",
+      artifact_paths = ["core/nulib/", "core/nulib/main_provisioning/", "core/nulib/lib_provisioning/"],
+    },
+
+    d.make_node {
+      id          = "extension-metadata-contract",
+      name        = "Extension Metadata Contract",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "Every extension (taskserv, provider, cluster) declares a metadata.ncl: name, version, category, description, typed dependencies, tags, and best_practices references. This contract is the machine-readable extension interface consumed by the CLI loader, schema validator, and orchestrator dependency resolver. Future: metadata.ncl will also declare ontology nodes, connecting extension capabilities to the platform DAG.",
+      artifact_paths = ["catalog/taskservs/*/metadata.ncl", "catalog/providers/*/", "catalog/clusters/"],
+    },
+
+    d.make_node {
+      id          = "taskserv-dependency-dag",
+      name        = "Taskserv Dependency DAG",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "Taskservs form a typed dependency DAG via their metadata.ncl `dependencies` field. Execution order: infrastructure → networking/storage → container_runtime → kubernetes/databases/development → applications. The orchestrator resolves this DAG before building the formula execution plan — no taskserv executes before its declared dependencies complete.",
+      artifact_paths = ["catalog/taskservs/", "platform/crates/orchestrator/src/formula.rs"],
+    },
+
+    d.make_node {
+      id          = "taskserv-pattern",
+      name        = "TaskServ Pattern",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "Extensions that serve infrastructure tasks — each taskserv declares dependencies, capabilities, and contracts. They consume workspace config and produce infrastructure operations. 10 built-in taskservs: infrastructure, networking, storage, container_runtime, kubernetes, databases, applications, development, cluster, misc.",
+      artifact_paths = ["catalog/taskservs/"],
+    },
+
+    d.make_node {
+      id          = "workspace-layer-resolution",
+      name        = "Workspace Layer Resolution",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "Three-tier priority system for workspace configuration composition: Core Layer (Priority 100, catalog/) → Workspace Templates (Priority 200, workspace/templates/) → Infrastructure-Specific (Priority 300, workspace/infra/{name}/). Higher priority overrides lower. Enables shared patterns to be extracted to templates while infrastructure-specific concerns stay local.",
+      artifact_paths = ["workspace/layers/", "workspace/templates/", "workspace/registry/"],
+    },
+
+    d.make_node {
+      id          = "workspace-as-implementation-plan",
+      name        = "Workspace as Implementation Plan",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "A workspace IS the implementation plan. It declares the complete typed composition: which providers, which taskservs with their dependencies, which formula DAG nodes, which clusters. The platform validates the composition against schemas and resolves the execution plan from it — no imperative scripting. Workspaces make infrastructure intent explicit and auditable.",
+      artifact_paths = ["workspace/templates/", "examples/workspaces/", "schemas/config/workspace_config/"],
+    },
+
+    d.make_node {
+      id          = "workspace-contract",
+      name        = "Workspace Contract",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "Workspaces are typed compositions of ingredients in DAGs. Each workspace declares what it needs via Nickel schemas; the platform validates and provisions accordingly.",
+      artifact_paths = ["schemas/config/workspace_config/"],
+    },
+
+    d.make_node {
+      id          = "platform-dispatch",
+      name        = "Platform Dispatch Model",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "Orchestrator dispatches tasks via NATS work queues, maintains state machine per task, and provides rollback capability. All provider API calls flow through this single dispatch point.",
+      artifact_paths = ["platform/crates/orchestrator/src/workflow.rs", "platform/crates/orchestrator/src/batch.rs"],
+    },
+
+    d.make_node {
+      id          = "config-hierarchy",
+      name        = "Configuration Hierarchy",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "5-level config precedence: Runtime args > env vars > user config > infra config > system defaults. Implemented via Nickel schema composition and Nushell config loading.",
+      artifact_paths = ["schemas/config/", "config/config.defaults.toml"],
+    },
+
+    d.make_node {
+      id          = "formula-dag-execution",
+      name        = "Formula DAG Execution",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "Workspace taskserv execution modeled as typed DAGs. Formulas replace positional arrays: each node declares depends_on, on_error, parallel, max_retries. Orchestrator converts via formula.rs into DependencyGraph for topological parallel execution.",
+      artifact_paths = ["schemas/lib/formula.ncl", "platform/crates/orchestrator/src/formula.rs"],
+    },
+
+    d.make_node {
+      id          = "solo-mode",
+      name        = "Solo Mode Architecture",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "Full platform architecture with relaxed auth — solo_auth_middleware replaces JWT+Cedar, injecting a fixed admin session gated behind --mode solo runtime flag. Same binaries, same NATS subjects, same SurrealDB schema. SurrealDB uses embedded RocksDB, NATS runs as child process. Enables single-operator deployments and CI integration tests without external infrastructure.",
+      artifact_paths = ["platform/crates/control-center/src/middleware/", "platform/crates/orchestrator/src/nats.rs"],
+    },
+
+    # ── Smart Interface Unification (ADR-029) ────────────────────────────────
+
+    d.make_node {
+      id          = "provisioning-registry",
+      name        = "Provisioning Core Registry",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "provisioning-core::Registry is the shared dispatch table for all 37 Tool implementations. Every surface (CLI binary, HTTP daemon, MCP server) must invoke operations through Registry::invoke — no surface may bypass it with direct tool instantiation. This structural constraint is the mechanism that makes semantic parity across surfaces a compile-time guarantee rather than a convention.",
+      artifact_paths = ["platform/crates/provisioning-core/src/", "platform/crates/provisioning-core/src/registry.rs"],
+    },
+
+    d.make_node {
+      id          = "smart-interface-unification",
+      name        = "Smart Interface Unification",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "Three-tier fallback chain in Nushell (platform/clients/fallback.nu::tool-call): tier 1 probes the HTTP daemon, tier 2 spawns provisioning-tool as a child process, tier 3 executes the caller-supplied Nushell legacy closure. The probe sequence runs at call time; no daemon state is managed by the operator. All three tiers dispatch through provisioning-core::Registry. Tier-3 closures are the offline-first guarantee and can only be retired per-operation after G3 passes for that operation.",
+      artifact_paths = [
+        "core/nulib/platform/clients/fallback.nu",
+        "core/nulib/platform/clients/daemon.nu",
+        "core/nulib/platform/clients/provisioning_tool.nu",
+        "platform/crates/provisioning-tool/",
+        "platform/crates/provisioning-daemon/",
+        "platform/scripts/start-provisioning-daemon.nu",
+        "justfiles/daemon.just",
+      ],
+    },
+
+    d.make_node {
+      id          = "g3-contract-invariant",
+      name        = "G3 Contract Invariant",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "The contract-tests crate asserts that CLI, HTTP daemon, and MCP server produce semantically equivalent payloads and identical error codes for every fixture tool. Five tests must pass: listing agreement, echo agreement, invalid-param error agreement, failing-tool error agreement, tools/list count agreement. normalise() defines what 'equivalent' means by stripping volatile fields. G3 is the CI mechanism that converts sync-irrenunciable into an architectural invariant.",
+      artifact_paths = ["platform/crates/contract-tests/"],
+    },
+
+    # ── Reflection modes ──────────────────────────────────────────────────────
+
+    d.make_node {
+      id          = "mode-provisioning-assess",
+      name        = "Mode: provisioning-assess",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "On+re reflection mode: assess system readiness across orchestrator, CLI, control center, schema coverage, and KCL migration dimensions.",
+      artifact_paths = ["reflection/modes/provisioning-assess.ncl"],
+    },
+
+    d.make_node {
+      id          = "mode-provisioning-audit",
+      name        = "Mode: provisioning-audit",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "On+re reflection mode: validate config, list and verify taskservs, check Nickel contracts, verify provider integrity, check axiom coherence.",
+      artifact_paths = ["reflection/modes/provisioning-audit.ncl"],
+    },
+
+    d.make_node {
+      id          = "mode-provisioning-coverage",
+      name        = "Mode: provisioning-coverage",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "On+re reflection mode: map extension ecosystem maturity — taskservs, providers, clusters — and identify coverage gaps.",
+      artifact_paths = ["reflection/modes/provisioning-coverage.ncl"],
+    },
+
+    d.make_node {
+      id          = "mode-provisioning-validate-formula",
+      name        = "Mode: provisioning-validate-formula",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "On+re reflection mode: cross-validate a workspace Formula DAG — typecheck, taskserv existence, metadata dep coverage, ConflictsWith detection, DAG acyclicity.",
+      artifact_paths = ["reflection/modes/provisioning-validate-formula.ncl"],
+    },
+
+    d.make_node {
+      id          = "typedialog-web-ui",
+      name        = "TypeDialog Schema-Driven Web UI",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "Nickel schemas are the single source of truth for web form generation. TypeDialog reads contracts from `.typedialog/provisioning/schemas/` and generates validated HTML forms with no manual form code. Supports multi-user collaborative workflows (draft → review → approve), embedded in the control center dashboard. TUI is a fallback for SSH-only environments. Primary value: schema drift between form and config is structurally impossible.",
+      artifact_paths = [".typedialog/provisioning/", ".typedialog/provisioning/schemas/", ".typedialog/provisioning/form.toml"],
+    },
+
+    d.make_node {
+      id          = "ai-rag-surface",
+      name        = "Schema-Aware AI and RAG Surface",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "AI config generation constrained by Nickel schemas — cannot produce invalid configs. RAG indexes Nickel schemas, docs, and past deployments as retrieval context. ai-service is the HTTP entry point (Cedar-gated); mcp-server exposes tool calling; rag crate manages vector store and embeddings. Cedar policy forbids AI from accessing secrets and requires human approval before any deployment.",
+      artifact_paths = ["platform/crates/ai-service/", "platform/crates/mcp-server/", "platform/crates/rag/"],
+    },
+
+    # ── DAG architecture (three-layer) ───────────────────────────────────────
+
+    d.make_node {
+      id          = "extension-capability-dag",
+      name        = "Extension Capability DAG",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "Extensions declare typed capability provides/requires/conflicts_with in metadata.ncl. Resolution maps required capabilities to concrete extensions before formula execution. Enables conflict detection and dependency ordering without hardcoded extension names.",
+      artifact_paths = ["catalog/taskservs/*/metadata.ncl", "schemas/lib/dag/contracts.ncl"],
+    },
+
+    d.make_node {
+      id          = "workspace-composition-dag",
+      name        = "Workspace Composition DAG",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "Workspaces declare inter-formula dependencies as a typed DAG via dag.ncl. Formula execution ordering and health gates between formula groups are schema-validated by the WorkspaceComposition Nickel contract and enforced at runtime by WorkspaceComposition::into_workflow in formula.rs.",
+      artifact_paths = ["schemas/lib/dag/contracts.ncl", "platform/crates/orchestrator/src/formula.rs"],
+    },
+
+    d.make_node {
+      id          = "capability-resolution",
+      name        = "Capability Resolution",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "ResolutionPolicy maps required capabilities (from extension requires fields) to concrete extensions (from extension provides fields). Strict mode: all Required capabilities must resolve before execution proceeds. Optional gaps allowed only when resolution.allow_optional_gaps = true.",
+      artifact_paths = ["schemas/lib/dag/contracts.ncl", "schemas/config/dag/main.ncl"],
+    },
+
+    d.make_node {
+      id          = "capability-granularity-vs-simplicity",
+      name        = "Capability Granularity vs Simplicity",
+      pole        = 'Spiral,
+      level       = 'Tension,
+      description = "Fine-grained capabilities enable precise conflict detection but increase taxonomy maintenance burden. Initial set of 9 coarse capabilities (server-lifecycle, networking, storage, container-runtime, orchestration, database, application-deployment, dev-tooling, hypervisor) chosen to defer premature optimization.",
+    },
+
+    d.make_node {
+      id          = "mode-provisioning-dag-integrity",
+      name        = "Mode: provisioning-dag-integrity",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "On+re reflection mode: audit all taskservs for provides/requires/conflicts_with completeness, validate capability graph has no unresolved Required deps, check that ConflictsWith pairs don't coexist in any formula. Runs after B3 migration.",
+      artifact_paths = ["reflection/modes/provisioning-dag-integrity.ncl"],
+    },
+
+    # ── CI pipelines ──────────────────────────────────────────────────────────
+
+    d.make_node {
+      id          = "ci-github-actions",
+      name        = "CI: GitHub Actions",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "GitHub Actions pipelines: nushell-lint, nickel-typecheck, rust-ci. Enforce code quality and schema validity on every PR.",
+      artifact_paths = [".github/workflows/nushell-lint.yml", ".github/workflows/nickel-typecheck.yml", ".github/workflows/rust-ci.yml"],
+    },
+
+    d.make_node {
+      id          = "ci-woodpecker",
+      name        = "CI: Woodpecker",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "Woodpecker CI pipelines: ci.yml and ci-advanced.yml. Self-hosted CI for provisioning workloads.",
+      artifact_paths = [".woodpecker/ci.yml", ".woodpecker/ci-advanced.yml"],
+    },
+
+    # ── Examples ──────────────────────────────────────────────────────────────
+
+    d.make_node {
+      id          = "scenario-workspaces",
+      name        = "Scenario: Workspaces",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "Example workspace configurations demonstrating the workspace contract pattern, server composition, and formula DAGs.",
+      artifact_paths = ["examples/workspaces"],
+    },
+
+    # ── Platform service nodes (previously only in artifact_paths) ────────────
+
+    d.make_node {
+      id          = "vault-service",
+      name        = "Vault Service — Multi-Backend Secrets",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "SOLID boundary for all secret storage and retrieval. Three backends: Age (development, filesystem key), Cosmian KMS (production, HSM-backed), RustyVault (self-hosted). Provider credentials are leased, never stored raw. Secrets never transit NATS — only lease_id references are published to the event bus. Cedar policies in the control-center prevent any other service from calling vault endpoints directly.",
+      artifact_paths = ["platform/crates/vault-service/", "platform/crates/vault-service/src/"],
+    },
+
+    d.make_node {
+      id          = "extension-registry-service",
+      name        = "Extension Registry — OCI Distribution Surface",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "OCI-compliant registry proxy that distributes provisioning extensions (taskservs, providers, cluster definitions) as OCI artifacts. Validates digests, caches manifests via LRU, emits extension lifecycle events to NATS. Enables versioned extension delivery without requiring a full OCI registry deployment — the proxy layer handles authentication and manifest caching transparently.",
+      artifact_paths = ["platform/crates/extension-registry/", "platform/crates/extension-registry/src/"],
+    },
+
+    d.make_node {
+      id          = "ncl-sync-daemon",
+      name        = "NCL Sync Daemon — Config Compilation Pipeline",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "Daemon that watches Nickel (NCL) source files, compiles them to JSON on change, and keeps the config cache fresh for Nushell processes that cannot afford `nickel export` startup cost on every invocation. File-watching via the `notify` crate; optional NATS publication for cross-process cache invalidation. Resolves the tension between type-safe NCL source of truth and low-latency config reads at CLI time.",
+      artifact_paths = ["platform/crates/ncl-sync/", "platform/crates/ncl-sync/src/"],
+    },
+
+    d.make_node {
+      id          = "prvng-cli-daemon",
+      name        = "prvng-cli — Zero-Cost CLI Query Daemon",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "Unix-socket daemon (`~/.local/share/provisioning/cli.sock`) that answers command registry lookups with sub-millisecond latency. Eliminates the Nushell startup + `nickel export` cost from the bash wrapper's `_validate_command` path. File-watches `commands-registry.json` via the `notify` crate; auto-shuts after 60s idle; restarted by the bash wrapper on next invocation. The wrapper falls through to grep+JSON cache if the socket is absent.",
+      artifact_paths = ["platform/crates/prvng-cli/", "platform/crates/prvng-cli/src/"],
+    },
+
+    d.make_node {
+      id          = "platform-shared-infra",
+      name        = "Platform Shared Infrastructure Crates",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "Three workspace libraries consumed by all platform services: `platform-config` (centralized config loading with Nickel merge layer), `platform-nats` (shared NATS JetStream bridge with retry loop, explicit ACK, and subject prefixing under `provisioning.>`), and `platform-db` (SurrealDB connection pool supporting embedded RocksDB for solo mode, SurrealKV for dev, and WebSocket for multi-user production). These three crates are the only infrastructure primitives that cross service boundaries in the Rust layer.",
+      artifact_paths = ["platform/crates/platform-config/", "platform/crates/platform-nats/", "platform/crates/platform-db/"],
+    },
+
+    d.make_node {
+      id          = "platform-crate-naming",
+      name        = "Platform Workspace Crate Naming Convention",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "Four-rule naming convention applied to all workspace crates (ADR-030): (1) shared library crates use `platform-<name>` package name; (2) smart interface layer uses `provisioning-<name>`; (3) service binary package names are short — `provisioning-` prefix lives only in `[[bin]] name`; (4) ecosystem crates with many existing `use` callers use `platform-<name>` package name + `[lib] name = 'old_name'` to preserve Rust crate names without modifying call sites. The convention disambiguates workspace dep declarations and eliminates crates.io name collision risk for generic names.",
+      artifact_paths = ["platform/Cargo.toml", "platform/crates/", "platform/prov-ecosystem/crates/"],
+    },
+
+    d.make_node {
+      id          = "ops-contract-dual-mode",
+      name        = "Ops Contract Dual-Mode — Pending Queue + Switchable Signer",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "NATS JetStream-based ops coordination with three subject namespaces (ops.pending, ops.cmd, ops.audit) and JWT-signed commands carrying scoped permissions, monotonic sequence, idempotency key, and expected_state_version. Signers (keeper-daemon for auto, keeper-cli for manual) are interchangeable subscribers to ops.pending — switching modes is operational (start/stop daemon), not architectural. ops-controller is the single per-workspace WorkQueue consumer of ops.cmd, persisting in-flight ops to SurrealDB before ack to survive restart. Multi-emitter coordination is delegated to JetStream stream order with optimistic concurrency on expected_state_version. ADR-037.",
+      artifact_paths = ["adrs/adr-037-ops-contract-dual-mode.ncl", "platform/crates/ops-keeper/", "platform/crates/ops-controller/", "schemas/lib/ops_contract.ncl"],
+    },
+
+    d.make_node {
+      id          = "decentralized-governance-radicle",
+      name        = "Decentralized Governance — Radicle Heartwood Substrate",
+      pole        = 'Yin,
+      level       = 'Practice,
+      description = "Radicle Heartwood as the substrate for governance, desired-state, and audit ledger across all workspaces. Three repos per workspace: policy-<workspace> (M-of-N delegation among operators), <workspace>-desired (M-of-N + CI keys), <workspace>-state (single delegate: ops-controller key). Keeper policy is declarative-only Nickel — parsed by Rust matcher, never evaluated as code. Audit mirror sidecar bridges NATS ops.audit subjects to <workspace>-state commits with jti idempotency. Operators may use any frontend (git, jj) over their local Radicle replica. Domain-level commands (governance delegations, governance signers) read local clones uniformly. ADR-038.",
+      artifact_paths = ["adrs/adr-038-radicle-decentralized-governance.ncl", "platform/crates/audit-mirror/", "schemas/lib/radicle.ncl", "schemas/lib/keeper_policy.ncl"],
+    },
+
+    d.make_node {
+      id          = "ephemeral-build-infrastructure",
+      name        = "Ephemeral Build Infrastructure — Golden Runners + S3-Backed zot",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "Build pipeline using orchestrator-spawned ephemeral VMs from periodically-rebuilt golden images (buildkit-runner-golden). Per-build sizing resolved from .build-spec.ncl declaration, p95 historical, or language defaults. zot relocated from libre-daoshi to libre-wuji with S3-compatible backend (versioning + cross-region replication for DR). Multi-tenant zot layout serves /images, /cache, /sccache, /crates with JWT-scoped auth. BuildKit registry-cache and sccache S3-backend both terminate at zot for warm-cache cold-spawn. buildkit-launcher (Woodpecker plugin) is a thin bridge to orchestrator's VM lease semantics. ADR-039.",
+      artifact_paths = ["adrs/adr-039-build-infrastructure-ephemeral.ncl", "catalog/components/buildkit_runner.ncl", "platform/crates/buildkit-launcher/", "schemas/lib/build_spec.ncl"],
+    },
+
+    d.make_node {
+      id          = "federated-integration-modes",
+      name        = "Federated Integration Modes — OCI Domain Artifacts",
+      pole        = 'Yang,
+      level       = 'Practice,
+      description = "Cross-project integration via typed OCI domain artifacts. Each project declares an IntegrationMode in its own reflection/modes/ with domains_used pointing to versioned artifacts at reg.librecloud.online/domains/<id>:<semver>. Provisioning is a peer participant — not a plugin host; no filesystem coupling exists between participants. Cabling files at infra/<ws>/integrations/<mode-id>.ncl resolve domain context fields to concrete sources (sops, component, literal, env). Domains are OCI artifacts with mediaType application/vnd.ontoref.domain.v1 containing a typed Nickel contract. Initial catalog: secret-delivery 0.1.0, event-emission 0.1.0, result-reporting 0.1.0. prvng integration domain publish/pull/describe/verify manage the OCI surface. ADR-042.",
+      artifact_paths = ["adrs/adr-042-ecosystem-integration-modes.ncl", "schemas/lib/integration/", "catalog/domains/", "core/nulib/platform/oci/domain_client.nu", "core/nulib/cli/integration.nu"],
+    },
+
+  ],
+
+  edges = [
+
+    # Axiom manifestations
+    { from = "config-driven-always",  to = "type-safety-nickel",                kind = 'ManifestsIn,  weight = 'High,
+      note = "Nickel is the manifestation of config-driven — typed schemas enforce the axiom" },
+    { from = "config-driven-always",  to = "config-hierarchy",                  kind = 'ManifestsIn,  weight = 'High,
+      note = "The 5-level hierarchy implements the config-driven axiom at runtime" },
+    { from = "workspace-contract",    to = "config-driven-always",              kind = 'ManifestsIn,  weight = 'High,
+      note = "Workspaces are the user-facing manifestation of config-driven infrastructure" },
+
+    # Tension relationships
+    { from = "type-safety-nickel",    to = "nickel-complexity-vs-accessibility", kind = 'Contradicts,  weight = 'Medium,
+      note = "The axiom generates the tension — stricter types vs contributor friction" },
+    { from = "platform-dispatch",     to = "centralized-vs-scripted",            kind = 'Resolves,     weight = 'High,
+      note = "The dispatch model is the resolution of centralized vs scripted" },
+
+    # Structural relationships
+    { from = "solid-boundaries",      to = "platform-dispatch",                 kind = 'ValidatedBy,  weight = 'High,
+      note = "SOLID boundaries are validated by the dispatch model — only orchestrator touches providers" },
+    { from = "solid-boundaries",      to = "provider-abstraction",              kind = 'Contains,     weight = 'High,
+      note = "Provider abstraction is a corollary of SOLID boundaries" },
+    { from = "solo-mode",             to = "solid-boundaries",                  kind = 'ValidatedBy,  weight = 'Medium,
+      note = "Solo mode preserves SOLID boundaries — auth bypass is the only runtime difference, not an architectural bypass" },
+    { from = "solo-mode",             to = "centralized-vs-scripted",           kind = 'Resolves,     weight = 'Medium,
+      note = "Solo mode proves single-operator usefulness without sacrificing the centralized architecture" },
+    { from = "provider-abstraction",  to = "taskserv-pattern",                  kind = 'Complements,  weight = 'Medium,
+      note = "Providers and taskservs are complementary extension points" },
+    { from = "taskserv-pattern",      to = "workspace-contract",                kind = 'FlowsTo,      weight = 'High,
+      note = "Taskservs consume what workspaces declare — the data flow direction" },
+
+    # TypeDialog and AI relationships
+    { from = "typedialog-web-ui",   to = "type-safety-nickel",              kind = 'ManifestsIn,  weight = 'High,
+      note = "TypeDialog is the user-facing manifestation of type-safety-nickel — schema contracts drive form generation" },
+    { from = "typedialog-web-ui",   to = "workspace-as-implementation-plan", kind = 'Complements,  weight = 'High,
+      note = "TypeDialog is the authoring UI for workspace implementation plans" },
+    { from = "ai-rag-surface",      to = "type-safety-nickel",              kind = 'ValidatedBy,  weight = 'High,
+      note = "Nickel schemas constrain AI generation — AI cannot produce configs that fail schema validation" },
+    { from = "ai-rag-surface",      to = "solid-boundaries",                kind = 'ValidatedBy,  weight = 'High,
+      note = "Cedar policies enforce AI cannot read secrets or deploy without human approval" },
+    { from = "ai-rag-surface",      to = "typedialog-web-ui",               kind = 'Complements,  weight = 'Medium,
+      note = "AI fills TypeDialog forms; TypeDialog provides the schema context AI is constrained by" },
+
+    # Extension ecosystem relationships
+    { from = "extension-metadata-contract", to = "taskserv-pattern",            kind = 'ValidatedBy,  weight = 'High,
+      note = "Metadata contracts formalize the taskserv interface — every taskserv must satisfy the metadata contract to be loaded" },
+    { from = "extension-metadata-contract", to = "provider-abstraction",        kind = 'ValidatedBy,  weight = 'Medium,
+      note = "Provider extensions also declare metadata — the contract applies across all extension categories" },
+    { from = "taskserv-dependency-dag",     to = "taskserv-pattern",            kind = 'ManifestsIn,  weight = 'High,
+      note = "The dependency DAG is the runtime expression of taskserv relationship declarations" },
+    { from = "taskserv-dependency-dag",     to = "formula-dag-execution",       kind = 'FlowsTo,      weight = 'High,
+      note = "Taskserv dependency graph feeds into the formula DAG execution plan — dependency resolution precedes formula construction" },
+    { from = "extension-metadata-contract", to = "extension-graph-vs-declarative-config", kind = 'Contradicts, weight = 'Medium,
+      note = "Adding ontology fields to metadata.ncl is the planned evolution that generates this tension" },
+
+    # DAG architecture relationships
+    { from = "extension-capability-dag",   to = "type-safety-nickel",          kind = 'ManifestsIn,  weight = 'High,
+      note = "Capability declarations are Nickel contracts — provides/requires/conflicts_with are schema-validated" },
+    { from = "extension-capability-dag",   to = "extension-metadata-contract",  kind = 'ManifestsIn,  weight = 'High,
+      note = "Capability fields extend the extension-metadata-contract; backwards-compatible via defaults" },
+    { from = "capability-resolution",      to = "formula-dag-execution",        kind = 'FlowsTo,      weight = 'High,
+      note = "Capability resolution produces the extension binding map consumed by formula execution" },
+    { from = "workspace-composition-dag",  to = "config-driven-always",         kind = 'ManifestsIn,  weight = 'High,
+      note = "dag.ncl is a typed Nickel declaration — no imperative composition scripts" },
+    { from = "workspace-composition-dag",  to = "formula-dag-execution",        kind = 'FlowsTo,      weight = 'High,
+      note = "Composition DAG drives the inter-formula execution order and health gate injection" },
+    { from = "extension-capability-dag",   to = "capability-granularity-vs-simplicity", kind = 'ManifestsIn, weight = 'Medium,
+      note = "The capability taxonomy is the direct expression of this tension" },
+    { from = "mode-provisioning-dag-integrity", to = "extension-capability-dag", kind = 'ValidatedBy, weight = 'High,
+      note = "Integrity mode is the verification pass for the capability DAG" },
+
+    # Workspace relationships
+    { from = "workspace-as-implementation-plan", to = "workspace-contract",     kind = 'ManifestsIn,  weight = 'High,
+      note = "Workspace-as-plan is the semantic interpretation; workspace contract is the schema mechanism that enforces it" },
+    { from = "workspace-layer-resolution",       to = "workspace-contract",     kind = 'ManifestsIn,  weight = 'High,
+      note = "Layer resolution is the composition mechanism that realizes the workspace contract from template fragments" },
+    { from = "workspace-as-implementation-plan", to = "formula-dag-execution",  kind = 'FlowsTo,      weight = 'High,
+      note = "The workspace composition is the input from which the formula DAG execution plan is derived" },
+    { from = "workspace-layer-resolution",       to = "config-driven-always",   kind = 'ManifestsIn,  weight = 'Medium,
+      note = "Layer resolution is config-driven-always applied to workspace composition — no imperative override paths" },
+
+    # Nushell CLI library relationships
+    { from = "nushell-cli-library",   to = "workspace-as-implementation-plan",  kind = 'ManifestsIn,  weight = 'High,
+      note = "CLI library is the primary authoring surface for workspace definitions — workspace commands drive the full lifecycle" },
+    { from = "nushell-cli-library",   to = "centralized-vs-scripted",           kind = 'Contradicts,  weight = 'Medium,
+      note = "The CLI library's size generates the nushell-vs-rust-boundary tension — it could absorb orchestrator logic" },
+    { from = "nushell-cli-library",   to = "nushell-vs-rust-boundary",          kind = 'ManifestsIn,  weight = 'High,
+      note = "The library's growth is the direct expression of this tension" },
+
+    # Smart Interface Unification relationships (ADR-029)
+    { from = "provisioning-registry",     to = "solid-boundaries",              kind = 'ManifestsIn,  weight = 'High,
+      note = "Registry::invoke is the single dispatch path — surfaces cannot bypass it; enforced by ADR-029 constraint registry-sole-dispatch-path" },
+    { from = "provisioning-registry",     to = "nushell-vs-rust-boundary",      kind = 'Resolves,     weight = 'High,
+      note = "Registry is the structural boundary: Rust owns dispatch semantics, Nushell owns orchestration sequences and the legacy closure" },
+    { from = "smart-interface-unification", to = "nushell-cli-library",         kind = 'ManifestsIn,  weight = 'High,
+      note = "tool-call / tool-list in nulib/platform/clients/fallback.nu is the Nushell expression of the three-tier architecture" },
+    { from = "smart-interface-unification", to = "provisioning-registry",       kind = 'FlowsTo,      weight = 'High,
+      note = "All three tiers ultimately converge on Registry::invoke — the fallback chain selects the transport, not the dispatch logic" },
+    { from = "smart-interface-unification", to = "ai-rag-surface",              kind = 'Complements,  weight = 'Medium,
+      note = "mcp-server is now Registry-backed — MCP tool calling and AI tool calling use the same dispatch path" },
+    { from = "g3-contract-invariant",     to = "provisioning-registry",         kind = 'ValidatedBy,  weight = 'High,
+      note = "G3 is the runtime evidence that Registry dispatch produces identical semantics across all three surfaces" },
+    { from = "g3-contract-invariant",     to = "smart-interface-unification",   kind = 'ValidatedBy,  weight = 'High,
+      note = "G3 is the CI gate that prevents surface drift — the invariant that makes sync-irrenunciable structural" },
+    { from = "smart-interface-unification", to = "config-driven-always",        kind = 'ManifestsIn,  weight = 'Medium,
+      note = "Tier selection is driven by environment probes at call time, not by hardcoded configuration — the fallback chain is config-driven" },
+
+    # Platform service node relationships
+    { from = "vault-service",              to = "solid-boundaries",             kind = 'ManifestsIn,  weight = 'High,
+      note = "Vault is the concrete implementation of the secrets SOLID boundary — Cedar policies enforce no other service touches vault endpoints" },
+    { from = "vault-service",              to = "config-driven-always",         kind = 'ManifestsIn,  weight = 'High,
+      note = "Backend selection (Age/Cosmian/RustyVault) is purely configuration — same binary, different backend at runtime" },
+
+    { from = "extension-registry-service", to = "provider-abstraction",         kind = 'Complements,  weight = 'Medium,
+      note = "Extension registry distributes the versioned artifacts that implement provider and taskserv extensions" },
+    { from = "extension-registry-service", to = "extension-metadata-contract",  kind = 'ValidatedBy,  weight = 'High,
+      note = "Registry validates OCI artifact digests; the metadata.ncl contract inside each artifact is validated by the CLI loader on install" },
+
+    { from = "ncl-sync-daemon",            to = "type-safety-nickel",           kind = 'ManifestsIn,  weight = 'High,
+      note = "NCL sync makes NCL the live source of truth — JSON cache is always derived from NCL, never edited directly" },
+    { from = "ncl-sync-daemon",            to = "config-hierarchy",             kind = 'ManifestsIn,  weight = 'High,
+      note = "The JSON cache NCL sync maintains is the artifact consumed by the 5-level config hierarchy at runtime" },
+
+    { from = "prvng-cli-daemon",           to = "nushell-cli-library",          kind = 'Complements,  weight = 'High,
+      note = "prvng-cli eliminates the startup cost that made fast bash-wrapper validation infeasible — the CLI library benefits from sub-ms command lookup" },
+    { from = "prvng-cli-daemon",           to = "nushell-vs-rust-boundary",     kind = 'Resolves,     weight = 'Medium,
+      note = "Unix-socket daemon shifts command validation entirely to Rust, removing the Nu + nickel export cost from the hot path" },
+
+    { from = "platform-shared-infra",      to = "solid-boundaries",             kind = 'ManifestsIn,  weight = 'High,
+      note = "platform-config/nats/db are the only infra primitives crossing service boundaries — they are the shared substrate SOLID boundaries operate over" },
+    { from = "platform-shared-infra",      to = "solo-mode",                    kind = 'ManifestsIn,  weight = 'High,
+      note = "Solo mode is implemented entirely in platform-db (embedded RocksDB) and platform-nats (child process) — no solo-specific code in the business services" },
+
+    { from = "platform-crate-naming",      to = "monorepo-vs-split",            kind = 'Resolves,     weight = 'Medium,
+      note = "The naming convention makes the monorepo workspace unambiguous — dep declarations carry project affiliation without splitting into separate repos" },
+    { from = "platform-crate-naming",      to = "config-driven-always",         kind = 'Complements,  weight = 'Low,
+      note = "Consistent naming is a prerequisite for config-driven extension loading — ambiguous package names would make programmatic workspace dep discovery fragile" },
+
+    # Ops contract dual-mode relationships (ADR-037)
+    { from = "ops-contract-dual-mode",      to = "solid-boundaries",            kind = 'ManifestsIn,  weight = 'High,
+      note = "ops-controller is a new SOLID boundary — consumes from ops.cmd, applies via orchestrator API, writes to ops.audit and SurrealDB; never calls provider APIs or auth services directly" },
+    { from = "ops-contract-dual-mode",      to = "config-driven-always",        kind = 'ManifestsIn,  weight = 'High,
+      note = "Mode switch (auto/manual/hybrid) is operational state, not configuration — keeper policy is declarative Nickel, ops contract is JWT scopes; no hardcoded mode constants" },
+    { from = "ops-contract-dual-mode",      to = "centralized-vs-scripted",     kind = 'Resolves,     weight = 'High,
+      note = "Pending queue + replaceable signer means automated CI and manual operator paths converge on the same contract — no fork between centralized and scripted" },
+    { from = "ops-contract-dual-mode",      to = "platform-shared-infra",       kind = 'FlowsTo,      weight = 'High,
+      note = "ops contract uses platform-nats for JetStream and platform-db for SurrealDB persistence — built on the same shared substrate as orchestrator" },
+
+    # Decentralized governance relationships (ADR-038)
+    { from = "decentralized-governance-radicle", to = "config-driven-always",   kind = 'ManifestsIn,  weight = 'High,
+      note = "Radicle repos (policy/desired/state) are versioned configuration with cryptographic provenance — config-driven extends to governance itself" },
+    { from = "decentralized-governance-radicle", to = "type-safety-nickel",     kind = 'ManifestsIn,  weight = 'High,
+      note = "keeper policy uses declarative-only Nickel schema — type-safe data, never executed as code" },
+    { from = "decentralized-governance-radicle", to = "monorepo-vs-split",      kind = 'Resolves,     weight = 'Medium,
+      note = "Three-repo split per workspace separates governance/desired/audit by authority profile without compromising the source-code monorepo" },
+    { from = "decentralized-governance-radicle", to = "ops-contract-dual-mode", kind = 'Complements,  weight = 'High,
+      note = "ops contract handles transit (NATS); Radicle handles permanent record (audit ledger via mirror sidecar) and governance (delegations)" },
+
+    # Ephemeral build infrastructure relationships (ADR-039)
+    { from = "ephemeral-build-infrastructure", to = "provider-abstraction",     kind = 'FlowsTo,      weight = 'High,
+      note = "buildkit_runner is a component spawned via orchestrator's VM lifecycle — same provider abstraction as taskservs" },
+    { from = "ephemeral-build-infrastructure", to = "config-driven-always",     kind = 'ManifestsIn,  weight = 'High,
+      note = "Per-build sizing resolved from .build-spec.ncl declaration, historical p95, or language defaults — no hardcoded sizing" },
+    { from = "ephemeral-build-infrastructure", to = "ops-contract-dual-mode",   kind = 'FlowsTo,      weight = 'Medium,
+      note = "Build artifacts (image push to zot) trigger downstream deploy ops via ops.pending — build pipeline emits ops, does not apply them" },
+    { from = "ephemeral-build-infrastructure", to = "extension-registry-service", kind = 'Complements,  weight = 'Medium,
+      note = "zot multi-tenant /crates and /images coexist with extension-registry's OCI distribution — both are OCI-spec consumers of the same backing storage" },
+
+    # Federated integration modes relationships (ADR-042)
+    { from = "federated-integration-modes", to = "type-safety-nickel",         kind = 'ManifestsIn,  weight = 'High,
+      note = "Cabling contracts and domain contracts are Nickel NCL — type safety extends to integration context assembly" },
+    { from = "federated-integration-modes", to = "solid-boundaries",           kind = 'ValidatedBy,  weight = 'High,
+      note = "No filesystem coupling between participants — each project is an autonomous peer consuming typed OCI artifacts" },
+    { from = "federated-integration-modes", to = "ephemeral-build-infrastructure", kind = 'Complements, weight = 'Medium,
+      note = "Domain artifacts are stored in the same zot registry as build artifacts — OCI storage is shared substrate" },
+    { from = "federated-integration-modes", to = "config-driven-always",       kind = 'ManifestsIn,  weight = 'High,
+      note = "Cabling files are declarative config — no imperative wiring; context assembly reads config, not code" },
+
+  ],
+}

.ontology/gate.ncl

@@ -0,0 +1,45 @@
+let d = import "ontology/defaults/gate.ncl" in
+
+{
+  membranes = [
+
+    d.make_membrane {
+      id                = "control-plane-readiness",
+      name              = "Control Plane Readiness",
+      description       = "Controls when the provisioning control plane is ready for production deployment and multi-user mode.",
+      permeability      = 'Low,
+      accepts           = ['EcosystemRelevance],
+      protects          = ["production deployment", "multi-user mode"],
+      opening_condition = {
+        max_tension_dimensions = 2,
+        pending_transitions    = 2,
+        core_stable            = true,
+        description            = "Orchestrator + Control Center operational, NATS streams configured and stable, SOLID boundaries passing all 6 enforcement layers, Cedar policies loaded and evaluated.",
+      },
+      closing_condition = "Any SOLID enforcement layer failing or NATS stream misconfiguration detected.",
+      max_duration      = 'Indefinite,
+      protocol          = 'Challenge,
+      active            = false,
+    },
+
+    d.make_membrane {
+      id                = "workspace-certification",
+      name              = "Workspace Certification",
+      description       = "Controls when a workspace is ready for production use — all taskservs validated, config schema-checked, provider capabilities matched.",
+      permeability      = 'Medium,
+      accepts           = ['EcosystemRelevance, 'OpportunityAlignment],
+      protects          = ["workspace production use"],
+      opening_condition = {
+        max_tension_dimensions = 3,
+        pending_transitions    = 3,
+        core_stable            = true,
+        description            = "All taskservs in workspace have dependencies.ncl, config validates via nickel typecheck, provider capabilities match requirements.",
+      },
+      closing_condition = "Workspace config fails schema validation or provider capabilities no longer match declared requirements.",
+      max_duration      = 'Indefinite,
+      protocol          = 'Observe,
+      active            = false,
+    },
+
+  ],
+}

.ontology/manifest.ncl

@@ -0,0 +1,340 @@
+let m = import "ontology/defaults/manifest.ncl" in
+
+m.make_manifest {
+  project   = "provisioning",
+  repo_kind = 'Mixed,
+
+  description = "Multi-crate Rust platform for cloud infrastructure provisioning: typed Nickel schemas validated at the NCL layer, formula DAG execution engine, SOLID-enforced service boundaries, pluggable providers and taskservs, NATS-brokered orchestration, Cedar authorization, and full-architecture solo mode for single-operator deployments.",
+
+  consumption_modes = [
+    m.make_consumption_mode {
+      consumer    = 'Developer,
+      needs       = ['OntologyExport],
+      audit_level = 'Standard,
+      description = "Uses provisioning CLI and workspace definitions to manage infrastructure. Extends via providers and taskservs.",
+    },
+    m.make_consumption_mode {
+      consumer    = 'Agent,
+      needs       = ['OntologyExport, 'JsonSchema],
+      audit_level = 'Quick,
+      description = "Reads .ontology/core.ncl to understand constraints and boundaries. Uses CLI and orchestrator APIs for infrastructure operations.",
+    },
+  ],
+
+  layers = [
+    m.make_layer {
+      id          = "schemas",
+      paths       = ["schemas/"],
+      committed   = true,
+      description = "Nickel type schemas for all infrastructure configuration: providers, workspaces, platform services, extensions.",
+    },
+    m.make_layer {
+      id          = "core",
+      paths       = ["core/"],
+      committed   = true,
+      description = "CLI, libraries, plugins, Nushell scripts — the user-facing surface of provisioning.",
+    },
+    m.make_layer {
+      id          = "platform",
+      paths       = ["platform/"],
+      committed   = true,
+      description = "Orchestrator, Control Center, Vault, Extension Registry — the control plane services.",
+    },
+    m.make_layer {
+      id          = "catalog",
+      paths       = ["catalog/"],
+      committed   = true,
+      description = "Providers, taskservs, clusters, components, domain artifacts — IaC building block catalog and federated integration domain contracts.",
+    },
+    m.make_layer {
+      id          = "config",
+      paths       = ["config/", "templates/"],
+      committed   = true,
+      description = "Default configuration files and infrastructure templates.",
+    },
+    m.make_layer {
+      id          = "self-description",
+      paths       = [".ontology/"],
+      committed   = true,
+      description = "Provisioning consuming on+re: axioms, tensions, practices, state, gates, ADRs.",
+    },
+  ],
+
+  operational_modes = [
+    m.make_op_mode {
+      id             = "dev",
+      visible_layers = ["schemas", "core", "platform", "catalog", "config", "self-description"],
+      description    = "Full development view — all layers visible.",
+    },
+    m.make_op_mode {
+      id             = "platform-focus",
+      visible_layers = ["schemas", "platform", "config"],
+      description    = "Platform engineering focus — schemas, platform services, and configuration.",
+    },
+    m.make_op_mode {
+      id             = "catalog-focus",
+      visible_layers = ["schemas", "catalog", "config"],
+      description    = "Catalog development focus — schemas, providers, taskservs, components, and configuration.",
+    },
+  ],
+
+  config_surface = m.make_config_surface {
+    config_root    = ".typedialog/provisioning/",
+    entry_point    = "config.ncl",
+    kind           = 'TypeDialog,
+    contracts_path = ".typedialog/provisioning/schemas",
+    overrides_dir  = ".typedialog/provisioning/generated",
+    sections = [
+      m.make_config_section {
+        id          = "provisioning",
+        file        = "config.ncl",
+        contract    = "schemas/provisioning-config.ncl",
+        description = "Root workspace configuration generated by TypeDialog — project metadata, services, database, deployment target, network, storage, monitoring, security.",
+        rationale   = "Consumer projects declare what infrastructure they need via an interactive TypeDialog form. The NCL output is the single source of truth fed to the orchestrator. TypeDialog fragments (database-postgres, deployment-k8s, etc.) ensure only valid combinations are generated.",
+        mutable     = true,
+        consumers   = [
+          m.make_config_consumer { id = "orchestrator",   kind = 'RustStruct, ref = "provisioning_orchestrator::config::OrchestratorConfig", fields = ["services", "deployment", "database"] },
+          m.make_config_consumer { id = "configure-nu",   kind = 'NuScript,   ref = ".typedialog/provisioning/configure.nu" },
+          m.make_config_consumer { id = "ci-woodpecker",  kind = 'CiPipeline, ref = ".woodpecker/ci.yml" },
+        ],
+      },
+      m.make_config_section {
+        id          = "database",
+        file        = "schemas/database.ncl",
+        contract    = "schemas/database.ncl",
+        description = "Database type and connection parameters — supports sqlite, postgres, surrealdb, mysql. Generated into the root config via TypeDialog database-* fragments.",
+        rationale   = "Database configuration is the most provider-specific section. TypeDialog fragments enforce valid parameter combinations per engine (e.g. journal_mode only valid for SQLite).",
+        mutable     = false,
+        consumers   = [
+          m.make_config_consumer { id = "orchestrator", kind = 'RustStruct, ref = "provisioning_orchestrator::config::OrchestratorConfig", fields = ["database"] },
+        ],
+      },
+      m.make_config_section {
+        id          = "deployment",
+        file        = "schemas/deployment.ncl",
+        contract    = "schemas/deployment.ncl",
+        description = "Deployment target — docker-compose or kubernetes. Drives which taskservs are activated and which providers are called.",
+        rationale   = "Deployment target selection is the primary branching decision in workspace execution. TypeDialog deployment-docker and deployment-k8s fragments capture the full parameter space for each target.",
+        mutable     = false,
+        consumers   = [
+          m.make_config_consumer { id = "orchestrator", kind = 'RustStruct, ref = "provisioning_orchestrator::config::OrchestratorConfig", fields = ["deployment"] },
+        ],
+      },
+      m.make_config_section {
+        id          = "monitoring",
+        file        = "schemas/monitoring.ncl",
+        contract    = "schemas/monitoring.ncl",
+        description = "Observability configuration — metrics, logging, alerting. Optional; defaults from .typedialog/provisioning/defaults/monitoring-defaults.ncl.",
+        mutable     = false,
+        consumers   = [
+          m.make_config_consumer { id = "orchestrator", kind = 'RustStruct, ref = "provisioning_orchestrator::config::OrchestratorConfig", fields = ["monitoring"] },
+        ],
+      },
+    ],
+  },
+
+  capabilities = [
+    m.make_capability {
+      id        = "formula-dag-execution",
+      name      = "Formula DAG Execution Engine",
+      summary   = "Typed DAG-based workflow execution with topological parallelism, retry, and rollback.",
+      rationale = "Positional task arrays collapse on dependency ambiguity and lack parallelism signals. Formula nodes declare depends_on, on_error, parallel, max_retries — enabling the orchestrator to derive a topological execution plan without imperative scripting.",
+      how       = "Workspace TOML declares Formula nodes; orchestrator's formula.rs converts to DependencyGraph via topological sort; BatchExecutor executes ready nodes in parallel via NATS work queues.",
+      artifacts = ["schemas/lib/formula.ncl", "platform/crates/orchestrator/src/formula.rs", "platform/crates/orchestrator/src/batch.rs"],
+      adrs      = ["adr-016-workspace-formula-dag"],
+      nodes     = ["formula-dag-execution"],
+    },
+    m.make_capability {
+      id        = "workspace-contract",
+      name      = "Typed Workspace Contracts",
+      summary   = "Nickel-validated workspace definitions that compose providers, taskservs, and ingredients into infrastructure DAGs.",
+      rationale = "Raw TOML workspace files have no type safety — invalid configs surface as runtime errors. Nickel schemas catch structural errors at write time, before any provider API is called.",
+      how       = "CLI validates workspace TOML against schemas/config/workspace_config/ contracts via nickel export before submitting to orchestrator. Orchestrator re-validates on receipt.",
+      artifacts = ["schemas/config/workspace_config/", "core/crates/", "examples/workspaces/"],
+      nodes     = ["workspace-contract"],
+    },
+    m.make_capability {
+      id        = "provider-plugin-system",
+      name      = "Provider Plugin System",
+      summary   = "25-function pluggable interface for infrastructure providers — add a provider without changing the platform.",
+      rationale = "Hardcoded provider logic makes multi-cloud support a fork, not an extension. The provider interface isolates provider specifics behind a stable contract.",
+      how       = "Each provider implements the ProviderInterface trait (25 functions). Orchestrator dispatches operations via the interface; provider implementations are loaded from catalog/providers/.",
+      artifacts = ["catalog/providers/", "platform/crates/orchestrator/src/"],
+      nodes     = ["provider-abstraction", "taskserv-pattern"],
+    },
+    m.make_capability {
+      id        = "solo-mode-deployment",
+      name      = "Solo Mode — Full-Architecture Single-Operator Deployment",
+      summary   = "Run the full platform on a laptop: embedded SurrealDB (RocksDB), child NATS server, solo_auth_middleware replacing JWT+Cedar.",
+      rationale = "Simplified mono-binary for solo creates two divergent code paths. Solo mode keeps the same binaries and NATS subjects — scripts written for solo work in multi-user unchanged.",
+      how       = "--mode solo flag activates solo_auth_middleware (auto-injects admin session), SurrealDB switches to kv-surrealkv (RocksDB), NATS starts as child process. service-manager.nu orchestrates startup.",
+      artifacts = ["platform/crates/control-center/src/middleware/", "platform/crates/orchestrator/src/nats.rs"],
+      adrs      = ["adr-015-solo-mode-architecture"],
+      nodes     = ["solo-mode"],
+    },
+    m.make_capability {
+      id        = "nats-brokered-orchestration",
+      name      = "NATS JetStream Orchestration",
+      summary   = "All inter-service task dispatch via NATS JetStream work queues with at-least-once delivery and state machine tracking.",
+      rationale = "HTTP synchronous task dispatch couples orchestrator latency to provider API latency. NATS decouples dispatch from execution, enables fan-out to taskserv workers, and provides durable state even if a worker crashes mid-task.",
+      how       = "Orchestrator publishes tasks to JetStream streams per provider type. Taskserv workers consume via pull consumers with ack/nack. Task state machine tracks pending → running → completed/failed in SurrealDB.",
+      artifacts = ["platform/crates/orchestrator/src/workflow.rs", "platform/crates/platform-nats/"],
+      adrs      = ["adr-012-nats-event-broker"],
+      nodes     = ["platform-dispatch"],
+    },
+    m.make_capability {
+      id        = "nickel-config-hierarchy",
+      name      = "Nickel-Validated Configuration Hierarchy",
+      summary   = "5-level config precedence with NCL contracts: runtime args > env vars > user config > infra config > system defaults.",
+      rationale = "Ad-hoc env var overrides without schema validation cause silent misconfiguration. The Nickel merge layer validates every override level against the same contracts before deserialization.",
+      how       = "platform-config's ConfigLoader trait runs collect_env_overrides() → nickel export → serde::Deserialize. Override files are written to config/*.overrides.ncl and merged via & at the entry point.",
+      artifacts = ["platform/crates/platform-config/src/format.rs", "schemas/config/"],
+      adrs      = ["adr-013-surrealdb-global-store"],
+      nodes     = ["config-hierarchy", "type-safety-nickel"],
+    },
+    m.make_capability {
+      id        = "solid-enforcement",
+      name      = "SOLID Boundary Enforcement",
+      summary   = "6 compile-time and runtime SOLID boundaries: orchestrator-only provider calls, control-center-only auth, vault-only secrets.",
+      rationale = "Without enforced boundaries, authorization and secrets logic diffuses across services. ADR-014 documents 6 hard boundaries with 6 enforcement layers (compile-time, dev-time, pre-commit, CI, runtime, audit).",
+      how       = "Clippy rules, grep CI checks, Cedar policies, and runtime middleware enforce the boundaries. solo_auth_middleware is the only documented auth bypass and requires --mode solo.",
+      artifacts = ["platform/crates/orchestrator/", "platform/crates/control-center/", "platform/secretumvault/"],
+      adrs      = ["adr-014-solid-enforcement"],
+      nodes     = ["solid-boundaries"],
+    },
+  ],
+
+  requirements = [
+    m.make_requirement {
+      id       = "rust",
+      name     = "Rust toolchain",
+      kind     = 'Tool,
+      env      = 'Development,
+      version  = "1.75+",
+      impact   = "Platform services and CLI cannot compile.",
+      provision = "rustup toolchain install stable",
+    },
+    m.make_requirement {
+      id       = "nushell",
+      name     = "Nushell",
+      kind     = 'Tool,
+      env      = 'Both,
+      version  = "0.110+",
+      impact   = "Reflection modes, service-manager.nu, and CLI scripts cannot execute.",
+      provision = "cargo install nu",
+    },
+    m.make_requirement {
+      id       = "nickel",
+      name     = "Nickel",
+      kind     = 'Tool,
+      env      = 'Both,
+      version  = "1.15+",
+      impact   = "Schema validation and config export cannot run. platform-config's ConfigLoader cannot operate.",
+      provision = "cargo install nickel-lang-cli",
+    },
+    m.make_requirement {
+      id       = "surrealdb",
+      name     = "SurrealDB",
+      kind     = 'Service,
+      env      = 'Production,
+      version  = "2.3+",
+      required = false,
+      impact   = "Multi-user deployments cannot persist task state, Cedar policies, or audit logs. Solo mode uses embedded RocksDB.",
+      provision = "Deploy surrealdb container or binary; solo mode uses kv-surrealkv.",
+    },
+    m.make_requirement {
+      id       = "nats-server",
+      name     = "NATS Server (JetStream)",
+      kind     = 'Service,
+      env      = 'Both,
+      impact   = "Orchestrator cannot dispatch tasks; taskserv workers cannot receive work items. Solo mode manages nats-server as a child process.",
+      provision = "Install nats-server in PATH for solo mode; deploy NATS cluster for multi-user.",
+    },
+    m.make_requirement {
+      id       = "cedar-policy",
+      name     = "Cedar policy engine",
+      kind     = 'Infrastructure,
+      env      = 'Production,
+      required = false,
+      impact   = "Cedar-based authorization unavailable in multi-user mode. Solo mode uses solo_auth_middleware which bypasses Cedar entirely.",
+      provision = "Policies stored in SurrealDB; loaded by control-center at startup.",
+    },
+  ],
+
+  critical_deps = [
+    m.make_critical_dep {
+      id             = "surrealdb-crate",
+      name           = "SurrealDB client crate",
+      ref            = "surrealdb@3",
+      used_for       = "Task state machine persistence, Cedar policy storage, audit log, workspace history.",
+      failure_impact = "All stateful operations (task tracking, policy evaluation, audit) stop. Solo mode continues via kv-surrealkv but loses SurrealDB WS protocol.",
+      mitigation     = "Feature-gated: --no-default-features disables SurrealDB for dev builds. Solo mode uses embedded kv-surrealkv (RocksDB).",
+    },
+    m.make_critical_dep {
+      id             = "async-nats",
+      name           = "async-nats",
+      ref            = "async-nats@0.46",
+      used_for       = "All inter-service task dispatch, NATS JetStream work queues, taskserv worker consumers.",
+      failure_impact = "Orchestrator cannot dispatch workflows; taskserv workers go idle. Solo mode manages nats-server as child — child crash is fatal.",
+      mitigation     = "Feature-gated via platform-nats crate. Solo mode restarts nats-server on SIGTERM.",
+    },
+    m.make_critical_dep {
+      id             = "cedar-policy-crate",
+      name           = "cedar-policy",
+      ref            = "cedar-policy@4.8",
+      used_for       = "Authorization decisions in control-center: policy evaluation, RBAC, resource-level access control.",
+      failure_impact = "All authorization decisions in multi-user mode fail closed. Solo mode unaffected (solo_auth_middleware bypasses Cedar).",
+      mitigation     = "Compile-time link; no runtime loading. cedar-policy is the Cedar Reference Implementation — stable API surface.",
+    },
+    m.make_critical_dep {
+      id             = "secretumvault",
+      name           = "secretumvault",
+      ref            = "secretumvault (local path ../../../Development/secretumvault)",
+      used_for       = "Secrets management: age key management, Shamir threshold unsealing, secret storage for provider credentials.",
+      failure_impact = "Vault service cannot start; provider credential injection fails. All infrastructure operations that require provider API keys stop.",
+      mitigation     = "Local path dependency — pinned to checkout. Solo mode uses filesystem backend (age key).",
+    },
+    m.make_critical_dep {
+      id             = "axum",
+      name           = "axum",
+      ref            = "axum@0.8",
+      used_for       = "HTTP API layer for orchestrator, control-center, extension-registry, ai-service, mcp-server.",
+      failure_impact = "All HTTP API surfaces become unavailable. CLI falls back to NATS direct where supported.",
+      mitigation     = "axum@0.8 is maintained by the Tokio project; API stability is high.",
+    },
+  ],
+
+  domain_provides = {
+    id             = "provisioning-platform",
+    name           = "Provisioning Platform",
+    schema_path    = "reflection/schemas/",
+    impl_repo_kind = "DevWorkspace",
+    kind           = 'Implicit,
+    description    = "Workspace infrastructure contracts: cluster topology, state dimensions, gate membranes, and operational modes for DevWorkspace projects.",
+  },
+
+  registry_provides = m.make_registry_provides {
+    participant = "provisioning",
+    registries  = m.make_registries_config {
+      default    = "primary",
+      registries = [
+        m.make_registry_entry {
+          id         = "primary",
+          endpoint   = "reg.librecloud.online",
+          role       = 'primary,
+          tls        = true,
+          namespaces = {
+            own      = ["domains/provisioning/", "modes/provisioning/"],
+            prefixes = ["domains/provisioning/", "modes/provisioning/"],
+          },
+        },
+      ],
+    },
+  },
+
+  level = {
+    index  = 'Domain,
+    name   = "provisioning-domain",
+    parent = "ontoref-base",
+  },
+}

.ontology/state.ncl

@@ -0,0 +1,249 @@
+let d = import "ontology/defaults/state.ncl" in
+
+{
+  dimensions = [
+
+    d.make_dimension {
+      id            = "orchestrator-maturity",
+      name          = "Orchestrator Maturity",
+      description   = "Orchestrator service readiness — from functional prototype to production-grade task execution engine.",
+      current_state = "functional",
+      desired_state = "production",
+      horizon       = 'Months,
+      states        = [],
+      transitions   = [
+        d.make_transition {
+          from      = "functional",
+          to        = "production",
+          condition = "All 6 SOLID enforcement layers passing, NATS streams stable, task state machine handles all error paths with rollback, formula DAG execution covers all taskserv dependency combinations.",
+          catalyst  = "Control Center JWT auth and Cedar policy evaluation wired end-to-end; solo mode auth bypass verified against ADR-015 constraints.",
+          blocker   = "Cedar policy definitions stored in SurrealDB not finalized; WebSocket task status streaming not connected to NATS push consumers.",
+          horizon   = 'Months,
+        },
+      ],
+    },
+
+    d.make_dimension {
+      id            = "cli-maturity",
+      name          = "CLI and Nushell Library Maturity",
+      description   = "CLI v3 and core/nulib/ stability — the primary user interface and Nushell command library for all platform operations.",
+      current_state = "stable-v3",
+      desired_state = "stable-v3",
+      horizon       = 'Continuous,
+      states        = [],
+      transitions   = [],
+    },
+
+    d.make_dimension {
+      id            = "control-center-maturity",
+      name          = "Control Center Maturity",
+      description   = "Control Center service readiness — from bootstrapped to operational with live auth, Cedar policies, and WebSocket streaming.",
+      current_state = "bootstrapped",
+      desired_state = "operational",
+      horizon       = 'Months,
+      states        = [],
+      transitions   = [
+        d.make_transition {
+          from      = "bootstrapped",
+          to        = "operational",
+          condition = "JWT auth middleware active in non-solo mode, Cedar policies loaded from SurrealDB and evaluated on all protected routes, WebSocket task status streaming connected to NATS push consumers.",
+          catalyst  = "Solo mode (ADR-015) fully tested end-to-end as staging environment for multi-user auth path.",
+          blocker   = "Cedar policy definitions not finalized; WebSocket streaming not connected to NATS; IaC detection and rules handlers partially commented out in router.",
+          horizon   = 'Months,
+        },
+      ],
+    },
+
+    d.make_dimension {
+      id            = "schema-coverage",
+      name          = "Schema Coverage",
+      description   = "Nickel schema coverage across all configuration surfaces — from partial to comprehensive.",
+      current_state = "partial",
+      desired_state = "comprehensive",
+      horizon       = 'Months,
+      states        = [],
+      transitions   = [
+        d.make_transition {
+          from      = "partial",
+          to        = "comprehensive",
+          condition = "All provider configs, workspace configs, platform service configs, extension metadata (taskserv dependency declarations), and TypeDialog forms covered by typed Nickel schemas. Extension metadata.ncl files cover all 10 built-in taskservs.",
+          catalyst  = "Extension ontology evolution (ADR-019 AI surface) requiring schema for RAG indexing.",
+          blocker   = "Some extensions still use raw TOML or KCL remnants for metadata. TypeDialog schemas cover workspace config but not all platform service configs.",
+          horizon   = 'Months,
+        },
+      ],
+    },
+
+    d.make_dimension {
+      id            = "kcl-migration",
+      name          = "KCL Migration",
+      description   = "Migration from KCL to Nickel — completed, continuous maintenance only.",
+      current_state = "completed",
+      desired_state = "completed",
+      horizon       = 'Continuous,
+      states        = [],
+      transitions   = [],
+    },
+
+    d.make_dimension {
+      id            = "smart-interface-migration",
+      name          = "Smart Interface Migration",
+      description   = "Migration of all 37 Nushell operations from direct legacy dispatch to the three-tier fallback chain (HTTP daemon → provisioning-tool → Nushell closure). Infrastructure complete; operation wiring is the remaining work.",
+      current_state = "bootstrapped",
+      desired_state = "migrated",
+      horizon       = 'Months,
+      states        = [],
+      transitions   = [
+        d.make_transition {
+          from      = "bootstrapped",
+          to        = "migrated",
+          condition = "All 37 operations call tool-call / tool-list with a real Nushell legacy closure; G3 contract test passes for each migrated operation; no handler calls the orchestrator or provider APIs directly from nulib without going through the Registry.",
+          catalyst  = "G3 contract test gates each migration — an operation can only retire its tier-3 closure after G3 passes for it. Daemon install via `just daemon install` makes tier-1 available on developer machines.",
+          blocker   = "36 operations still dispatch via Nushell legacy directly; only workspace_list is wired to the fallback chain. Migration is per-operation and non-breaking.",
+          horizon   = 'Months,
+        },
+      ],
+    },
+
+    d.make_dimension {
+      id            = "extension-ecosystem-maturity",
+      name          = "Internal Extension Mechanism Maturity",
+      description   = "Maturity of the internal extension mechanism (taskservs and providers) — from basic metadata contracts to capability-aware DAG resolution to ontology-aware impact analysis. Distinct from federated integration modes (ADR-042) which governs cross-project integration via OCI domain artifacts.",
+      current_state = "capability-aware",
+      desired_state = "ontology-aware",
+      horizon       = 'Months,
+      states        = [],
+      transitions   = [
+        d.make_transition {
+          from      = "metadata-contracts",
+          to        = "capability-aware",
+          condition = "All 10 built-in taskserv metadata.ncl files migrated with provides/requires/conflicts_with fields. provisioning-dag-integrity reflection mode runs clean. CLI `provisioning extensions capabilities` outputs correct capability table.",
+          catalyst  = "Three-layer DAG architecture (ADR-016) requiring typed capability declarations for formula dependency resolution.",
+          blocker   = "Completed — B2 (schema extension) and B3 (metadata migration) done in DAG architecture session.",
+          horizon   = 'Continuous,
+        },
+        d.make_transition {
+          from      = "capability-aware",
+          to        = "ontology-aware",
+          condition = "Extension metadata.ncl can optionally declare ontology node IDs; orchestrator resolves extension DAG against platform ontology for impact analysis; CLI reports which ontology nodes are affected by a given workspace execution.",
+          catalyst  = "AI RAG surface (ADR-019) requiring extension ontology data for schema-aware config generation.",
+          blocker   = "Ontology node schema not yet added to metadata.ncl contract; no tooling to validate ontology references in extension metadata.",
+          horizon   = 'Months,
+        },
+      ],
+    },
+
+    d.make_dimension {
+      id            = "ops-contract-evolution",
+      name          = "Ops Contract Evolution (ADR-037)",
+      description   = "Evolution of the dual-mode ops contract — from architectural decision to implemented crates to production deployment with multi-emitter coordination proven under load.",
+      current_state = "designed",
+      desired_state = "production",
+      horizon       = 'Months,
+      states        = [],
+      transitions   = [
+        d.make_transition {
+          from      = "designed",
+          to        = "implemented",
+          condition = "ops-keeper crate (keeper-daemon + keeper-cli binaries) compiles and passes unit tests; ops-controller crate subscribes to OPS_CMD JetStream stream and applies ops idempotently with SurrealDB persistence of in-flight state; schemas/lib/ops_contract.ncl + keeper_policy.ncl validated; NATS JetStream streams OPS_PENDING/OPS_CMD/OPS_AUDIT created with correct retention.",
+          catalyst  = "ADR-037 accepted; design discussion produced 23 implementation tasks with explicit per-layer (domain/project/workspace) impact mapping.",
+          blocker   = "Implementation not yet started — designed but no crates exist. Ordered prerequisite: schemas first, then ops-keeper crate, then ops-controller crate, then NATS config.",
+          horizon   = 'Months,
+        },
+        d.make_transition {
+          from      = "implemented",
+          to        = "production",
+          condition = "VM-ops workspace deployed with keeper-daemon running; libre-wuji ops-controller deployed with single-replica WorkQueue consumer; daoshi-CI Woodpecker pipelines emit ops via buildkit-launcher publish step; multi-emitter conflict scenario verified in staging (two emitters, second receives 409); operator-only mode tested via switch_to_operator_only playbook; pending queue depth and oldest-message-age observable in Prometheus.",
+          catalyst  = "ops contract is gating for ADR-039 build infrastructure (build pipeline emits deploy ops via ops.pending) — production readiness blocks the deploy-from-CI path.",
+          blocker   = "Implementation phase not complete; observability stack not deployed in libre-wuji; VM-ops workspace not yet provisioned.",
+          horizon   = 'Months,
+        },
+      ],
+    },
+
+    d.make_dimension {
+      id            = "integration-modes-maturity",
+      name          = "Federated Integration Modes Maturity (ADR-042)",
+      description   = "Maturity of the federated integration modes protocol — from schema definitions and OCI domain artifacts to assembled context delivery to fully-wired invoke pipeline.",
+      current_state = "schema-defined",
+      desired_state = "assembled",
+      horizon       = 'Months,
+      states        = [],
+      transitions   = [
+        d.make_transition {
+          from      = "schema-defined",
+          to        = "assembled",
+          condition = "context-assembler crate reads cabling.ncl + SOPS secrets + component outputs and produces a typed SecretDeliveryContext JSON envelope; `prvng integration invoke <mode-id>` pipes the assembled context to the mode binary stdin; lian-build provisioning mode receives the envelope and emits a valid ResultEnvelope; `prvng integration subscribe <mode-id>` scaffolds a cabling file skeleton in infra/<ws>/integrations/.",
+          catalyst  = "context-assembler Nushell module complete (platform/integrations/context_assembler.nu); `prvng integration invoke/subscribe/validate` all wired; 7 domain artifacts in zot (secret-delivery, event-emission, result-reporting, compute-provisioning, registry-access, cache-management, backup-policy-binding 0.1.0); all signed with cosign; lian-build + cloudatasave modes declared with domain locks + libre-wuji cablings.",
+          blocker   = "lian-build binary does not yet read stdin context — end-to-end live invoke not yet proven.",
+          horizon   = 'Months,
+        },
+        d.make_transition {
+          from      = "assembled",
+          to        = "production",
+          condition = "cloudatasave integration mode declared with its own lock + cabling; cosign signing applied to all domain artifacts in zot; zot trust policy rejects unsigned domain artifacts; NATS event-emission domain wired to production JetStream subjects in each workspace cabling.",
+          catalyst  = "cosign signing complete for all 9 artifacts (7 domains + 2 modes) ✓; zot imagetrust extension enabled in configmap ✓; cloudatasave mode + lock + cabling declared ✓; client-side cosign verify in domain-verify + subscribe ✓; key rotation documented in docs/guides/cosign-key-rotation.md ✓; ZOT_ADMIN_PASS in zot.sops.yaml + adminPolicy for regadm + server-side cosign trust key uploaded (HTTP 200) ✓.",
+          blocker   = "NATS event-emission wiring not yet live; lian-build binary stdin implementation external dependency.",
+          horizon   = 'Months,
+        },
+      ],
+    },
+
+    d.make_dimension {
+      id            = "governance-model-state",
+      name          = "Decentralized Governance Model State (ADR-038)",
+      description   = "Adoption state of Radicle Heartwood as governance and audit substrate across all workspaces.",
+      current_state = "designed",
+      desired_state = "active",
+      horizon       = 'Months,
+      states        = [],
+      transitions   = [
+        d.make_transition {
+          from      = "designed",
+          to        = "bootstrapped",
+          condition = "Radicle Heartwood seed nodes installed on every operator laptop, on libre-daoshi designated node, on libre-wuji designated node, and on ops-vm; per-operator Radicle identities created; for each workspace, three repos (policy/desired/state) initialized with correct delegation profiles (M-of-N for policy/desired, single ops-controller for state); audit-mirror sidecar deployed in libre-wuji subscribing to ops.audit subjects with jti idempotency check.",
+          catalyst  = "ADR-038 accepted; ops contract (ADR-037) requires the audit ledger to land somewhere durable and decentralized — Radicle is that target.",
+          blocker   = "Implementation not started; Radicle CLI familiarity required across operators; bootstrap playbook not yet written; ops-controller signing keys not yet generated for state repo delegation.",
+          horizon   = 'Months,
+        },
+        d.make_transition {
+          from      = "bootstrapped",
+          to        = "active",
+          condition = "policy-<workspace> patches signed by quorum and deployed in production; keeper-daemon polls policy repo for latest commit and applies declarative matcher; <workspace>-state ledger receiving live audit events from wuji; operator on/off-boarding playbooks tested with delegation patches; cross-replica gossip lag measured and within acceptable bounds (seconds-to-minutes for policy/desired updates).",
+          catalyst  = "First production op signed via the new contract validates the end-to-end path: emitter → pending → keeper signs per policy → ops-controller applies → audit lands in Radicle state repo.",
+          blocker   = "Bootstrap phase incomplete; production deployment requires both ADR-037 (ops) and ADR-038 (governance) implemented and validated together.",
+          horizon   = 'Months,
+        },
+      ],
+    },
+
+    d.make_dimension {
+      id            = "build-infrastructure-state",
+      name          = "Build Infrastructure State (ADR-039)",
+      description   = "Maturity of ephemeral-runner + S3-backed zot build pattern — from architectural decision to operational golden image v1 to dynamic-sizing production.",
+      current_state = "designed",
+      desired_state = "production",
+      horizon       = 'Months,
+      states        = [],
+      transitions   = [
+        d.make_transition {
+          from      = "designed",
+          to        = "golden-image-v1",
+          condition = "Initial buildkit-runner-golden image built off-platform (laptop or external CI) and pushed to bootstrap zot; weekly rebuild Woodpecker pipeline defined; orchestrator vm_pool extended with buildkit lifecycle (spawn from golden + cleanup hook); buildkit-launcher crate compiles; .build-spec.ncl schema validated against schemas/lib/build_spec.ncl.",
+          catalyst  = "Vapora and other Rust workloads need a build path; current absence of build infrastructure means manual local builds — gating for production deploys.",
+          blocker   = "Implementation not started; bootstrap golden image must be produced manually first time; zot relocation from libre-daoshi to libre-wuji not yet executed.",
+          horizon   = 'Months,
+        },
+        d.make_transition {
+          from      = "golden-image-v1",
+          to        = "production",
+          condition = "zot deployed in libre-wuji with S3 backend (versioning + cross-region replication); multi-tenant auth configured (daoshi-CI write to /images /cache /sccache /crates; wuji-pods read /images; operators write /crates); BuildKit registry-cache and sccache S3 backend pointing at zot.wuji.local proven on Vapora-class build with measured cold-spawn-to-completion time; OOM auto-retry verified once and bounded; weekly golden image rebuild running on schedule with no manual intervention; cross-provider replication tested via failover drill.",
+          catalyst  = "Production deploys via ops contract (ADR-037) require image artifacts in zot — build infrastructure is on the critical path for the deploy-from-CI flow.",
+          blocker   = "Golden image v1 phase incomplete; zot still in libre-daoshi; observability for build metrics (Prometheus on builder VMs) not deployed.",
+          horizon   = 'Months,
+        },
+      ],
+    },
+
+  ],
+}

.ontology/workflow.ncl

@@ -0,0 +1,56 @@
+let W = import "reflection/schemas/workflow.ncl" in
+let D = import "reflection/defaults/workflow.ncl" in
+
+# Workflow declaration for provisioning.
+# Each layer is independent — layers form a set, not a chain.
+# Regenerate artifacts after editing: ore workflow generate
+# Preview changes:                    ore workflow diff
+
+{
+  layers = [
+
+    # ── Commit-fast: pre-commit local checks ─────────────────────────────────
+    # Generates entries for .pre-commit-config.yaml (printed for manual merge).
+    {
+      id          = "commit-fast",
+      trigger     = 'OnCommit,
+      validations = [
+        "rust-fmt",
+        "rust-clippy",
+        "nextest-ci-test",
+        "deny-subset",
+        "docs-drift",
+        "manifest-coverage",
+      ],
+      builds        = [],
+      distributions = [],
+      providers     = [W.pre_commit "pre-commit"],
+    },
+
+    # ── CI-standard: push/PR pipeline ────────────────────────────────────────
+    # Generates .woodpecker/ci.yml and justfiles/workflow.just.
+    {
+      id          = "ci-standard",
+      trigger     = 'OnPR,
+      validations = [
+        "rust-clippy-all",
+        "nextest-ci",
+        "deny-subset",
+        "docs-check",
+        "nickel-typecheck",
+        "nushell-check",
+      ],
+      builds        = ["release-native"],
+      distributions = [],
+      providers     = [
+        W.woodpecker ".woodpecker/ci.yml",
+        W.justfile   "ci-standard",
+      ],
+    },
+
+  ],
+
+  validations   = D.validations,
+  builds        = D.builds,
+  distributions = {},
+}

.pre-commit-config.yaml

@@ -0,0 +1,174 @@
+# Pre-commit Framework Configuration
+# Generated by dev-system/ci
+# Configures git pre-commit hooks for Rust projects
+
+repos:
+  # ============================================================================
+  # Rust Hooks
+  # ============================================================================
+  - repo: local
+    hooks:
+      - id: rust-fmt
+        name: Rust formatting (cargo +nightly fmt)
+        entry: bash -c 'if [ -f platform/Cargo.toml ]; then cd platform && cargo +nightly fmt --all -- --check; fi'
+        language: system
+        types: [rust]
+        pass_filenames: false
+        stages: [pre-commit]
+
+      - id: rust-clippy
+        name: Rust linting (cargo clippy)
+        entry: bash -c 'if [ -f platform/Cargo.toml ]; then cd platform && cargo clippy --all-targets -- -D warnings; fi'
+        language: system
+        types: [rust]
+        pass_filenames: false
+        stages: [pre-commit]
+
+      # NOTE: Disabled - cargo test blocks git push. Tests should run in CI/CD.
+      # - id: rust-test
+      #   name: Rust tests
+      #   entry: bash -c 'if [ -f platform/Cargo.toml ]; then cd platform && cargo test --workspace; fi'
+      #   language: system
+      #   types: [rust]
+      #   pass_filenames: false
+      #   stages: [pre-push]
+
+      # NOTE: cargo-deny config needs migration to latest version
+      # See: https://github.com/EmbarkStudios/cargo-deny/pull/611
+      # Disabled until deny.toml is updated to current format
+      # - id: cargo-deny
+      #   name: Cargo deny (licenses & advisories)
+      #   entry: bash -c 'if [ -f Cargo.toml ]; then cargo deny check; elif [ -f platform/Cargo.toml ]; then cd platform && cargo deny check; fi'
+      #   language: system
+      #   pass_filenames: false
+      #   stages: [pre-push]
+
+  # ============================================================================
+  # Ontoref Hooks (ACTIVE)
+  # ============================================================================
+  - repo: local
+    hooks:
+      - id: manifest-coverage
+        name: Manifest capability completeness
+        entry: bash -c 'ONTOREF_PROJECT_ROOT="$(pwd)" ontoref sync manifest-check'
+        language: system
+        files: (\.ontology/|reflection/modes/|reflection/forms/).*\.ncl$
+        pass_filenames: false
+        stages: [pre-commit]
+
+      - id: docs-links
+        name: Rustdoc broken intra-doc links
+        entry: bash -c 'RUSTDOCFLAGS="-D rustdoc::broken-intra-doc-links -D rustdoc::private-intra-doc-links" cargo doc --manifest-path platform/Cargo.toml --no-deps --workspace -q'
+        language: system
+        types: [rust]
+        pass_filenames: false
+        stages: [pre-commit]
+
+      - id: docs-drift
+        name: Crate //! doc drift check
+        entry: bash -c 'ONTOREF_PROJECT_ROOT="$(pwd)" ontoref sync diff --docs --fail-on-drift'
+        language: system
+        types: [rust]
+        pass_filenames: false
+        stages: [pre-commit]
+
+  # ============================================================================
+  # Nushell Hooks (ACTIVE)
+  # ============================================================================
+  - repo: local
+    hooks:
+      - id: nushell-check
+        name: Nushell validation (nu --ide-check)
+        entry: >-
+          bash -c 'for f in $(git diff --cached --name-only --diff-filter=ACM | grep "\.nu$"); do
+          echo "Checking: $f"; nu --ide-check 100 "$f" || exit 1; done'
+        language: system
+        types: [file]
+        files: \.nu$
+        pass_filenames: false
+        stages: [pre-commit]
+
+  # ============================================================================
+  # Nickel Hooks (ACTIVE)
+  # ============================================================================
+  - repo: local
+    hooks:
+      - id: nickel-typecheck
+        name: Nickel type checking
+        entry: >-
+          bash -c 'export NICKEL_IMPORT_PATH="../:."; for f in $(git diff --cached --name-only --diff-filter=ACM | grep "\.ncl$"); do
+          echo "Checking: $f"; nickel typecheck "$f" || exit 1; done'
+        language: system
+        types: [file]
+        files: \.ncl$
+        pass_filenames: false
+        stages: [pre-commit]
+
+  # ============================================================================
+  # Bash Hooks (optional - enable if using Bash)
+  # ============================================================================
+  # - repo: local
+  #   hooks:
+  #     - id: shellcheck
+  #       name: Shellcheck (bash linting)
+  #       entry: shellcheck
+  #       language: system
+  #       types: [shell]
+  #       stages: [commit]
+  #
+  #     - id: shfmt
+  #       name: Shell script formatting
+  #       entry: bash -c 'shfmt -i 2 -d'
+  #       language: system
+  #       types: [shell]
+  #       stages: [commit]
+
+  # ============================================================================
+  # Markdown Hooks (ACTIVE)
+  # ============================================================================
+  - repo: local
+    hooks:
+      - id: markdownlint
+        name: Markdown linting (markdownlint-cli2)
+        entry: markdownlint-cli2
+        language: system
+        types: [markdown]
+        stages: [pre-commit]
+
+      # CRITICAL: markdownlint-cli2 MD040 only checks opening fences for language.
+      # It does NOT catch malformed closing fences (e.g., ```plaintext) - CommonMark violation.
+      # This hook is ESSENTIAL to prevent malformed closing fences from entering the repo.
+      # See: .markdownlint-cli2.jsonc line 22-24 for details.
+      - id: check-malformed-fences
+        name: Check malformed closing fences (CommonMark)
+        entry: bash -c 'nu scripts/check-malformed-fences.nu $(git diff --cached --name-only --diff-filter=ACM | grep "\.md$" | grep -v ".coder/" | grep -v ".claude/" | grep -v "old_config/" | tr "\n" " ")'
+        language: system
+        types: [markdown]
+        pass_filenames: false
+        stages: [pre-commit]
+        exclude: ^\.coder/|^\.claude/|^old_config/
+
+  # ============================================================================
+  # General Pre-commit Hooks
+  # ============================================================================
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.5.0
+    hooks:
+      - id: check-added-large-files
+        args: ['--maxkb=1000']
+
+      - id: check-case-conflict
+
+      - id: check-merge-conflict
+
+      - id: check-toml
+
+      - id: check-yaml
+        exclude: ^\.woodpecker/
+
+      - id: end-of-file-fixer
+
+      - id: trailing-whitespace
+        exclude: \.md$
+
+      - id: mixed-line-ending

.rustfmt.toml

@@ -0,0 +1,53 @@
+# Generated by dev-system/ci
+# Rustfmt configuration for consistent Rust code formatting
+# Configured for cargo +nightly fmt with advanced features enabled
+
+# Basic formatting options
+edition = "2021"
+hard_tabs = false
+max_width = 100
+newline_style = "Unix"
+tab_spaces = 4
+
+# Code structure
+use_small_heuristics = "Default"
+
+# Imports
+group_imports = "StdExternalCrate"
+remove_nested_parens = true
+reorder_imports = true
+reorder_modules = true
+
+# Match expressions
+match_block_trailing_comma = false
+
+# Chains
+chain_width = 60
+
+# Comment formatting (nightly)
+comment_width = 80
+normalize_comments = true
+normalize_doc_attributes = true
+wrap_comments = true
+
+# Spaces and indentation (nightly)
+fn_params_layout = "Tall"
+fn_single_line = false
+where_single_line = false
+
+# Formatting (nightly)
+format_code_in_doc_comments = false
+format_strings = true
+
+# Spaces (nightly)
+space_after_colon = true
+space_before_colon = false
+spaces_around_ranges = false
+
+# Line breaks (nightly)
+blank_lines_lower_bound = 0
+blank_lines_upper_bound = 1
+match_arm_blocks = true
+
+# Enable nightly features
+unstable_features = true

.shellcheckrc

@@ -0,0 +1,51 @@
+# ShellCheck Configuration for Infrastructure Provisioning Project
+# Focuses on functional issues, disables non-critical style warnings
+# This configuration prioritizes bug detection over style enforcement
+
+# Enable all optional checks initially
+enable=all
+
+# Disable non-functional and unfixable warnings
+# Style issues that don't affect functionality:
+# Info-level warnings that are numerous and hard to fix automatically:
+# Monorepo source following issues that may not be resolvable:
+disable=SC1020,SC1072,SC1073,SC1090,SC1091,SC2004,SC2016,SC2024,SC2034,SC2035,SC2038,SC2046,SC2064,SC2076,SC2086,SC2129,SC2153,SC2154,SC2155,SC2196,SC2231,SC2238,SC2248,SC2249,SC2250,SC2292,SC2310,SC2312,SC2315,SC2316,SC2317,SC2318,SC2319,SC2329
+
+# SC1090/SC1091 - Can't follow source files (common in monorepos with dynamic includes)
+# SC2024 - Invalid operators (14 instances, requires investigation)
+# SC2046 - Quote to avoid word splitting (9 instances, requires refactoring)
+# SC2086 - Double quote to prevent globbing (info-level, 289 instances, risky to auto-fix)
+# SC2129 - Non-numeric array index (4 instances, style issue)
+# SC2155 - Declare and assign separately (51 instances, requires manual refactoring)
+# SC2231 - Quote expansions in globs (info-level, 2 instances, similar to SC2086)
+# SC2238 - Redirects in loops (4 instances, edge case)
+# SC2250 - Prefer putting braces around variable references (style only)
+# SC2292 - Prefer to avoid negated test conditions (style preference)
+# SC2310 - Functions in if conditions (info-level, 54 instances, requires refactoring)
+# SC2312 - Comment appears to reference variable (false positives in comments)
+# SC2248 - Prefer double quoting (style, handled by SC2086)
+# SC2034 - Unused variables (development markers)
+# SC2317 - Unreachable code (may be intentional)
+# SC2249 - Prefer [[ ]] over [ ] (style preference in POSIX scripts)
+# SC2315-2319 - Reserved names and other style issues
+
+# Keep enabled - these are critical functional issues that matter:
+# SC2154 - Variable referenced but not assigned (115 instances)
+# SC2155 - Declare and assign separately to avoid masking return values
+# SC2046 - Quote to avoid word splitting
+# SC2162 - read without -r may cause backslashes to be lost (FIXED - 9 instances)
+# SC2164 - cd should have || exit (FIXED - 12 instances)
+# SC2231 - Quote expansions to avoid globbing
+# SC2024 - Operator used without proper escaping
+
+# Source path for sourced files
+source-path=SCRIPTDIR
+
+# Severity levels: error, warning, info, style
+severity=warning
+
+# Format: gcc, json, json1, quiet
+format=gcc
+
+# Shell dialect (bash, sh, ksh, etc)
+shell=bash

.taplo.toml

@@ -0,0 +1,49 @@
+# Taplo configuration for TOML formatting and linting
+# https://taplo.tamasfe.dev/configuration/
+
+[formatting]
+# Indent tables with 2 spaces
+indent_string = "  "
+indent_tables = true
+
+# Reorder keys alphabetically within tables
+reorder_keys = true
+
+# Reorder arrays to be more readable
+reorder_arrays = false
+
+# Align entries vertically in inline tables
+align_entries = false
+
+# Allow compact inline tables
+allowed_blank_lines = 1
+
+# Trailing newline
+trailing_newline = true
+
+# Column width for wrapping
+column_width = 100
+
+# Compact arrays
+compact_arrays = true
+
+# Compact inline tables
+compact_inline_tables = false
+
+# === INCLUDE/EXCLUDE PATTERNS ===
+
+include = ["Cargo.toml", "*/Cargo.toml", "config/**/*.toml", "**/*.toml"]
+
+exclude = ["target/**", "node_modules/**", ".git/**"]
+
+# === SCHEMA VALIDATION ===
+
+# Cargo.toml schema validation
+[[rule]]
+include = ["**/Cargo.toml"]
+# Taplo includes built-in Cargo.toml schema
+
+# TypeDialog form definition TOML files
+[[rule]]
+include = ["**/.typedialog/**/*.toml", "config/**/forms/*.toml", "tests/fixtures/**/*.toml"]
+keys = ["name", "description", "fields", "items", "elements"]

.typedialog/README.md

@@ -0,0 +1,182 @@
+# TypeDialog Configuration Structure
+
+This directory contains TypeDialog forms, templates, and configuration data organized by subsystem.
+
+## Directory Organization
+
+```toml
+.typedialog/
+├── core/           # Core subsystem forms (setup, auth, infrastructure)
+├── provisioning/   # Main provisioning configuration fragments
+└── platform/       # Platform services forms (future)
+```
+
+### Why Multiple Subdirectories
+
+Different subsystems have different form requirements:
+
+1. **`core/`** - Core infrastructure operations
+   - System setup wizard
+   - Authentication (login, MFA)
+   - Infrastructure confirmations (delete, deploy)
+   - **Users**: Developers, operators
+
+2. **`provisioning/`** - Project provisioning configuration
+   - Deployment target selection (docker, k8s, ssh)
+   - Database configuration (postgres, mysql, sqlite)
+   - Monitoring setup
+   - **Users**: Project setup, CI/CD
+
+3. **`platform/`** (future) - Platform services
+   - Orchestrator configuration
+   - Control center setup
+   - Service-specific forms
+   - **Users**: Platform administrators
+
+## Structure Within Each Subdirectory
+
+Each subdirectory follows this pattern:
+
+```json
+{subsystem}/
+├── forms/          # TOML form definitions
+├── templates/      # Nickel/Jinja2 templates
+├── defaults/       # Default configurations
+├── constraints/    # Validation rules
+└── generated/      # Generated configs (gitignored)
+```
+
+## Core Subsystem (`core/`)
+
+**Purpose**: Core infrastructure operations (setup, auth, confirmations)
+
+**Forms**:
+- `forms/setup-wizard.toml` - Initial system setup
+- `forms/auth-login.toml` - User authentication
+- `forms/mfa-enroll.toml` - MFA enrollment
+- `forms/infrastructure/*.toml` - Delete confirmations (server, cluster, taskserv)
+
+**Bash Wrappers** (TTY-safe):
+- `../../core/shlib/setup-wizard-tty.sh`
+- `../../core/shlib/auth-login-tty.sh`
+- `../../core/shlib/mfa-enroll-tty.sh`
+
+**Usage**:
+```toml
+# Run setup wizard
+./provisioning/core/shlib/setup-wizard-tty.sh
+
+# Nushell reads result
+let config = (open provisioning/.typedialog/core/generated/setup-wizard-result.json | from json)
+```
+
+## Provisioning Subsystem (`provisioning/`)
+
+**Purpose**: Main provisioning configuration (deployments, databases, monitoring)
+
+**Structure**:
+- `form.toml` - Main provisioning form
+- `fragments/` - Modular form fragments
+  - `deployment-*.toml` - Docker, K8s, SSH deployments
+  - `database-*.toml` - Database configurations
+  - `monitoring.toml` - Monitoring setup
+  - `auth-*.toml` - Authentication methods
+- `constraints.toml` - Validation constraints
+- `defaults/` - Default values
+- `schemas/` - Nickel schemas
+
+**Usage**:
+```nickel
+# Configure provisioning
+nu provisioning/.typedialog/provisioning/configure.nu --backend web
+```
+
+## Platform Subsystem (`platform/` - Future)
+
+**Purpose**: Platform services configuration
+
+**Planned forms**:
+- Orchestrator configuration
+- Control center setup
+- MCP server configuration
+- Vault service setup
+
+**Status**: Structure planned, not yet implemented
+
+## Integration with Code
+
+### Bash Wrappers (TTY-safe)
+
+Located in: `provisioning/core/shlib/*-tty.sh`
+
+These wrappers solve Nushell's TTY input limitations by:
+1. Handling interactive input in bash
+2. Calling TypeDialog with proper TTY forwarding
+3. Generating JSON output for Nushell consumption
+
+**Pattern**:
+```nushell
+Bash wrapper → TypeDialog (TTY input) → Nickel config → JSON → Nushell
+```
+
+### Nushell Integration
+
+Located in: `provisioning/core/nulib/lib_provisioning/`
+
+Functions that call the bash wrappers:
+- `setup/wizard.nu::run-setup-wizard-interactive`
+- `plugins/auth.nu::login-interactive`
+- `plugins/auth.nu::mfa-enroll-interactive`
+
+## Generated Files
+
+**Location**: `{subsystem}/generated/`
+
+**Files**:
+- `*.ncl` - Nickel configuration files
+- `*.json` - JSON exports for Nushell
+- `*-defaults.ncl` - Default configurations
+
+**Note**: All generated files are gitignored
+
+## Form Naming Conventions
+
+1. **Top-level forms**: `{purpose}.toml`
+   - Example: `setup-wizard.toml`, `auth-login.toml`
+
+2. **Fragment forms**: `fragments/{category}-{variant}.toml`
+   - Example: `deployment-docker.toml`, `database-postgres.toml`
+
+3. **Infrastructure forms**: `forms/infrastructure/{operation}_{resource}_confirm.toml`
+   - Example: `server_delete_confirm.toml`
+
+## Adding New Forms
+
+### For Core Operations
+
+1. Create form: `.typedialog/core/forms/{operation}.toml`
+2. Create wrapper: `core/shlib/{operation}-tty.sh`
+3. Integrate in Nushell: `core/nulib/lib_provisioning/`
+
+### For Provisioning Config
+
+1. Create fragment: `.typedialog/provisioning/fragments/{category}-{variant}.toml`
+2. Update main form: `.typedialog/provisioning/form.toml`
+3. Add defaults: `.typedialog/provisioning/defaults/`
+
+### For Platform Services (Future)
+
+1. Create subsystem: `.typedialog/platform/`
+2. Follow same structure as `core/` or `provisioning/`
+3. Document in this README
+
+## Related Documentation
+
+- **Bash wrappers**: `provisioning/core/shlib/README.md`
+- **TypeDialog integration**: `provisioning/platform/.typedialog/README.md`
+- **Nushell setup**: `provisioning/core/nulib/lib_provisioning/setup/wizard.nu`
+
+---
+
+**Last Updated**: 2025-01-09
+**Structure Version**: 2.0 (Multi-subsystem organization)

.typedialog/ci/2026_01_03_01_form.toml

@@ -0,0 +1,231 @@
+description = "Interactive configuration for continuous integration and code quality tools"
+display_mode = "complete"
+locales_path = "../../../locales"
+name = "CI Configuration Form"
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "project_header"
+title = "📦 Project Information"
+type = "section_header"
+
+[[elements]]
+help = "Name of the project"
+name = "project_name"
+nickel_path = ["ci", "project", "name"]
+placeholder = "my-project"
+prompt = "Project name"
+required = true
+type = "text"
+
+[[elements]]
+help = "Optional description"
+name = "project_description"
+nickel_path = ["ci", "project", "description"]
+placeholder = "Brief description of what this project does"
+prompt = "Project description"
+required = false
+type = "text"
+
+[[elements]]
+default = ""
+help = "Project website or documentation site URL"
+name = "project_site_url"
+nickel_path = ["ci", "project", "site_url"]
+placeholder = "https://example.com"
+prompt = "Project Site URL"
+required = false
+type = "text"
+
+[[elements]]
+default = ""
+help = "Project repository URL (GitHub, GitLab, etc.)"
+name = "project_repo_url"
+nickel_path = ["ci", "project", "repo_url"]
+placeholder = "https://github.com/user/repo"
+prompt = "Project Repo URL"
+required = false
+type = "text"
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "languages_header"
+title = "🔍 Detected Languages"
+type = "section_header"
+
+[[elements]]
+default = "rust"
+display_mode = "grid"
+help = "Select all languages detected or used in the project"
+min_selected = 1
+name = "detected_languages"
+nickel_path = ["ci", "project", "detected_languages"]
+prompt = "Which languages are used in this project?"
+required = true
+searchable = true
+type = "multiselect"
+
+  [[elements.options]]
+  label = "🦀 Rust"
+  value = "rust"
+
+  [[elements.options]]
+  label = "🐚 NuShell"
+  value = "nushell"
+
+  [[elements.options]]
+  label = "⚙️  Nickel"
+  value = "nickel"
+
+  [[elements.options]]
+  label = "🔧 Bash/Shell"
+  value = "bash"
+
+  [[elements.options]]
+  label = "📝 Markdown/Documentation"
+  value = "markdown"
+
+  [[elements.options]]
+  label = "🐍 Python"
+  value = "python"
+
+  [[elements.options]]
+  label = "📜 JavaScript/TypeScript"
+  value = "javascript"
+
+[[elements]]
+default = "rust"
+help = "Main language used for defaults (e.g., in GitHub Actions workflows)"
+name = "primary_language"
+nickel_path = ["ci", "project", "primary_language"]
+options_from = "detected_languages"
+prompt = "Primary language"
+required = true
+type = "select"
+
+  [[elements.options]]
+  label = "🦀 Rust"
+  value = "rust"
+
+  [[elements.options]]
+  label = "🐚 NuShell"
+  value = "nushell"
+
+  [[elements.options]]
+  label = "⚙️  Nickel"
+  value = "nickel"
+
+  [[elements.options]]
+  label = "🔧 Bash"
+  value = "bash"
+
+  [[elements.options]]
+  label = "📝 Markdown"
+  value = "markdown"
+
+  [[elements.options]]
+  label = "🐍 Python"
+  value = "python"
+
+  [[elements.options]]
+  label = "📜 JavaScript"
+  value = "javascript"
+
+[[elements]]
+includes = ["fragments/rust-tools.toml"]
+name = "rust_tools_group"
+type = "group"
+when = "rust in detected_languages"
+
+[[elements]]
+includes = ["fragments/nushell-tools.toml"]
+name = "nushell_tools_group"
+type = "group"
+when = "nushell in detected_languages"
+
+[[elements]]
+includes = ["fragments/nickel-tools.toml"]
+name = "nickel_tools_group"
+type = "group"
+when = "nickel in detected_languages"
+
+[[elements]]
+includes = ["fragments/bash-tools.toml"]
+name = "bash_tools_group"
+type = "group"
+when = "bash in detected_languages"
+
+[[elements]]
+includes = ["fragments/markdown-tools.toml"]
+name = "markdown_tools_group"
+type = "group"
+when = "markdown in detected_languages"
+
+[[elements]]
+includes = ["fragments/python-tools.toml"]
+name = "python_tools_group"
+type = "group"
+when = "python in detected_languages"
+
+[[elements]]
+includes = ["fragments/javascript-tools.toml"]
+name = "javascript_tools_group"
+type = "group"
+when = "javascript in detected_languages"
+
+[[elements]]
+includes = ["fragments/general-tools.toml"]
+name = "general_tools_group"
+type = "group"
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "ci_cd_header"
+title = "🔄 CI/CD Configuration"
+type = "section_header"
+
+[[elements]]
+default = "true"
+help = "Set up continuous integration and deployment pipelines"
+name = "enable_ci_cd"
+nickel_path = ["ci", "features", "enable_ci_cd"]
+prompt = "Enable CI/CD integration?"
+type = "confirm"
+
+[[elements]]
+includes = ["fragments/ci-providers.toml"]
+name = "ci_providers_group"
+type = "group"
+when = "enable_ci_cd == true"
+
+[[elements]]
+includes = ["fragments/ci-settings.toml"]
+name = "ci_settings_group"
+type = "group"
+when = "enable_ci_cd == true"
+
+[[elements]]
+includes = ["fragments/build-deployment.toml"]
+name = "build_deployment_group"
+type = "group"
+when = "enable_ci_cd == true"
+
+[[elements]]
+includes = ["fragments/documentation.toml"]
+name = "documentation_group"
+type = "group"
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "confirmation_header"
+title = "✅ Ready to Install"
+type = "section_header"
+
+[[elements]]
+content = "Review your configuration above. After confirming, the CI system will be installed with your chosen settings."
+name = "confirmation_footer"
+type = "footer"

.typedialog/ci/README.md

@@ -0,0 +1,328 @@
+# CI System - Configuration Guide
+
+**Installed**: 2026-01-01
+**Detected Languages**: rust, nushell, nickel, bash, markdown, python, javascript
+
+---
+
+## Quick Start
+
+### Option 1: Using configure.sh (Recommended)
+
+A convenience script is installed in `.typedialog/ci/`:
+
+```toml
+# Use web backend (default) - Opens in browser
+.typedialog/ci/configure.sh
+
+# Use TUI backend - Terminal interface
+.typedialog/ci/configure.sh tui
+
+# Use CLI backend - Command-line prompts
+.typedialog/ci/configure.sh cli
+```
+
+**This script automatically:**
+
+- Sources `.typedialog/ci/envrc` for environment setup
+- Loads defaults from `config.ncl` (Nickel format)
+- Uses cascading search for fragments (local → Tools)
+- Creates backup before overwriting existing config
+- Saves output in Nickel format using nickel-roundtrip with documented template
+- Generates `config.ncl` compatible with `nickel doc` command
+
+### Option 2: Direct TypeDialog Commands
+
+Use TypeDialog nickel-roundtrip directly with manual paths:
+
+#### Web Backend (Recommended - Easy Viewing)
+
+```toml
+cd .typedialog/ci  # Change to CI directory
+source envrc  # Load environment
+typedialog-web nickel-roundtrip config.ncl form.toml 
+  --output config.ncl 
+  --ncl-template $TOOLS_PATH/dev-system/ci/templates/config.ncl.j2
+```
+
+#### TUI Backend
+
+```toml
+cd .typedialog/ci
+source envrc
+typedialog-tui nickel-roundtrip config.ncl form.toml 
+  --output config.ncl 
+  --ncl-template $TOOLS_PATH/dev-system/ci/templates/config.ncl.j2
+```
+
+#### CLI Backend
+
+```toml
+cd .typedialog/ci
+source envrc
+typedialog nickel-roundtrip config.ncl form.toml 
+  --output config.ncl 
+  --ncl-template $TOOLS_PATH/dev-system/ci/templates/config.ncl.j2
+```
+
+**Note:** The `--ncl-template` flag uses a Tera template that adds:
+
+- Descriptive comments for each section
+- Documentation compatible with `nickel doc config.ncl`
+- Consistent formatting and structure
+
+**All backends will:**
+
+- Show only options relevant to your detected languages
+- Guide you through all configuration choices
+- Validate your inputs
+- Generate config.ncl in Nickel format
+
+### Option 3: Manual Configuration
+
+Edit `config.ncl` directly:
+
+```nickel
+vim .typedialog/ci/config.ncl
+```
+
+---
+
+## Configuration Format: Nickel
+
+**This project uses Nickel format by default** for all configuration files.
+
+### Why Nickel
+
+- ✅ **Typed configuration** - Static type checking with `nickel typecheck`
+- ✅ **Documentation** - Generate docs with `nickel doc config.ncl`
+- ✅ **Validation** - Built-in schema validation
+- ✅ **Comments** - Rich inline documentation support
+- ✅ **Modular** - Import/export system for reusable configs
+
+### Nickel Template
+
+The output structure is controlled by a **Tera template** at:
+
+- **Tools default**: `$TOOLS_PATH/dev-system/ci/templates/config.ncl.j2`
+- **Local override**: `.typedialog/ci/config.ncl.j2` (optional)
+
+**To customize the template:**
+
+```toml
+# Copy the default template
+cp $TOOLS_PATH/dev-system/ci/templates/config.ncl.j2 
+   .typedialog/ci/config.ncl.j2
+
+# Edit to add custom comments, documentation, or structure
+vim .typedialog/ci/config.ncl.j2
+
+# Your template will now be used automatically
+```
+
+**Template features:**
+
+- Customizable comments per section
+- Control field ordering
+- Add project-specific documentation
+- Configure output for `nickel doc` command
+
+### TypeDialog Environment Variables
+
+You can customize TypeDialog behavior with environment variables:
+
+```toml
+# Web server configuration
+export TYPEDIALOG_PORT=9000           # Port for web backend (default: 9000)
+export TYPEDIALOG_HOST=localhost      # Host binding (default: localhost)
+
+# Localization
+export TYPEDIALOG_LANG=en_US.UTF-8    # Form language (default: system locale)
+
+# Run with custom settings
+TYPEDIALOG_PORT=8080 .typedialog/ci/configure.sh web
+```
+
+**Common use cases:**
+
+```toml
+# Access from other machines in network
+TYPEDIALOG_HOST=0.0.0.0 TYPEDIALOG_PORT=8080 .typedialog/ci/configure.sh web
+
+# Use different port if 9000 is busy
+TYPEDIALOG_PORT=3000 .typedialog/ci/configure.sh web
+
+# Spanish interface
+TYPEDIALOG_LANG=es_ES.UTF-8 .typedialog/ci/configure.sh web
+```
+
+## Configuration Structure
+
+Your config.ncl is organized in the `ci` namespace (Nickel format):
+
+```json
+{
+  ci = {
+    project = {
+      name = "rust",
+      detected_languages = ["rust, nushell, nickel, bash, markdown, python, javascript"],
+      primary_language = "rust",
+    },
+    tools = {
+      # Tools are added based on detected languages
+    },
+    features = {
+      # CI features (pre-commit, GitHub Actions, etc.)
+    },
+    ci_providers = {
+      # CI provider configurations
+    },
+  },
+}
+```
+
+## Available Fragments
+
+Tool configurations are modular. Check `.typedialog/ci/fragments/` for:
+
+- rust-tools.toml - Tools for rust
+- nushell-tools.toml - Tools for nushell
+- nickel-tools.toml - Tools for nickel
+- bash-tools.toml - Tools for bash
+- markdown-tools.toml - Tools for markdown
+- python-tools.toml - Tools for python
+- javascript-tools.toml - Tools for javascript
+- general-tools.toml - Cross-language tools
+- ci-providers.toml - GitHub Actions, Woodpecker, etc.
+
+## Cascading Override System
+
+This project uses a **local → Tools cascading search** for all resources:
+
+### How It Works
+
+Resources are searched in priority order:
+
+1. **Local files** (`.typedialog/ci/`) - **FIRST** (highest priority)
+2. **Tools files** (`$TOOLS_PATH/dev-system/ci/`) - **FALLBACK** (default)
+
+### Affected Resources
+
+| Resource | Local Path | Tools Path |
+| ---------- | ------------ | ------------ |
+| Fragments | `.typedialog/ci/fragments/` | `$TOOLS_PATH/dev-system/ci/forms/fragments/` |
+| Schemas | `.typedialog/ci/schemas/` | `$TOOLS_PATH/dev-system/ci/schemas/` |
+| Validators | `.typedialog/ci/validators/` | `$TOOLS_PATH/dev-system/ci/validators/` |
+| Defaults | `.typedialog/ci/defaults/` | `$TOOLS_PATH/dev-system/ci/defaults/` |
+| Nickel Template | `.typedialog/ci/config.ncl.j2` | `$TOOLS_PATH/dev-system/ci/templates/config.ncl.j2` |
+
+### Environment Setup (.envrc)
+
+The `.typedialog/ci/.envrc` file configures search paths:
+
+```toml
+# Source this file to load environment
+source .typedialog/ci/.envrc
+
+# Or use direnv for automatic loading
+echo 'source .typedialog/ci/.envrc' >> .envrc
+```
+
+**What's in .envrc:**
+
+```javascript
+export NICKEL_IMPORT_PATH="schemas:$TOOLS_PATH/dev-system/ci/schemas:validators:..."
+export TYPEDIALOG_FRAGMENT_PATH=".:$TOOLS_PATH/dev-system/ci/forms"
+export NCL_TEMPLATE="<local or Tools path to config.ncl.j2>"
+export TYPEDIALOG_PORT=9000           # Web server port
+export TYPEDIALOG_HOST=localhost      # Web server host
+export TYPEDIALOG_LANG="${LANG}"       # Form localization
+```
+
+### Creating Overrides
+
+**By default:** All resources come from Tools (no duplication).
+
+**To customize:** Create file in local directory with same name:
+
+```toml
+# Override a fragment
+cp $TOOLS_PATH/dev-system/ci/fragments/rust-tools.toml 
+   .typedialog/ci/fragments/rust-tools.toml
+
+# Edit your local version
+vim .typedialog/ci/fragments/rust-tools.toml
+
+# Override Nickel template (customize comments, structure, nickel doc output)
+cp $TOOLS_PATH/dev-system/ci/templates/config.ncl.j2 
+   .typedialog/ci/config.ncl.j2
+
+# Edit to customize documentation and structure
+vim .typedialog/ci/config.ncl.j2
+
+# Now your version will be used instead of Tools version
+```
+
+**Benefits:**
+
+- ✅ Override only what you need
+- ✅ Everything else stays synchronized with Tools
+- ✅ No duplication by default
+- ✅ Automatic updates when Tools is updated
+
+**See:** `$TOOLS_PATH/dev-system/ci/docs/cascade-override.md` for complete documentation.
+
+## Testing Your Configuration
+
+### Validate Configuration
+
+```toml
+nu $env.TOOLS_PATH/dev-system/ci/scripts/validator.nu 
+  --config .typedialog/ci/config.ncl 
+  --project . 
+  --namespace ci
+```
+
+### Regenerate CI Files
+
+```toml
+nu $env.TOOLS_PATH/dev-system/ci/scripts/generate-configs.nu 
+  --config .typedialog/ci/config.ncl 
+  --templates $env.TOOLS_PATH/dev-system/ci/templates 
+  --output . 
+  --namespace ci
+```
+
+## Common Tasks
+
+### Add a New Tool
+
+Edit `config.ncl` and add under `ci.tools`:
+
+```json
+{
+  ci = {
+    tools = {
+      newtool = {
+        enabled = true,
+        install_method = "cargo",
+        version = "latest",
+      },
+    },
+  },
+}
+```
+
+### Disable a Feature
+
+```toml
+[ci.features]
+enable_pre_commit = false
+```
+
+## Need Help
+
+For detailed documentation, see:
+
+- $env.TOOLS_PATH/dev-system/ci/docs/configuration-guide.md
+- $env.TOOLS_PATH/dev-system/ci/docs/installation-guide.md

.typedialog/ci/config.ncl

@@ -0,0 +1,175 @@
+# CI Configuration - Nickel Format
+# Auto-generated by dev-system CI installer
+#
+# This file is managed by TypeDialog using nickel-roundtrip.
+# Edit via: .typedialog/ci/configure.sh
+# Or manually edit and validate with: nickel typecheck config.ncl
+#
+# Documentation: nickel doc config.ncl
+
+{
+  # CI namespace - all configuration lives under 'ci'
+  ci = {
+    # Project Information
+    # Detected languages and primary language for this project
+    project = {
+      # Project name
+      name = "provisioning",
+      # Project description
+      description = "Provisioning",
+      # Project website or documentation site URL
+      site_url = "https://provisioning.systems",
+      # Project repository URL (GitHub, GitLab, etc.)
+      repo_url = "https://repo.jesusperez.pro/jesus/provisioning",
+      # Languages detected in codebase (auto-detected by installer)
+      detected_languages = [
+        "rust",
+        "nushell",
+        "nickel",
+        "bash",
+        "markdown"
+      ],
+      # Primary language (determines default tooling)
+      primary_language = "nushell",
+    },
+
+    # CI Tools Configuration
+    # Each tool can be enabled/disabled and configured here
+    tools = {
+      # Taplo - TOML formatter and linter
+      taplo = {
+        enabled = true,
+        install_method = "cargo",
+      },
+      # YAMLlint - YAML formatter and linter
+      yamllint = {
+        enabled = true,
+        install_method = "brew",
+      },
+      # Clippy - Rust linting tool
+      clippy = {
+        enabled = true,
+        install_method = "cargo",
+        deny_warnings = true,
+      },
+      # Cargo Audit - Security vulnerability scanner
+      audit = {
+        enabled = true,
+        install_method = "cargo",
+      },
+      # Cargo Deny - Dependency checker
+      deny = {
+        enabled = true,
+        install_method = "cargo",
+      },
+      # Cargo SBOM - Software Bill of Materials
+      sbom = {
+        enabled = true,
+        install_method = "cargo",
+      },
+      # LLVM Coverage - Code coverage tool
+      llvm-cov = {
+        enabled = true,
+        install_method = "cargo",
+      },
+      # Shellcheck - Bash/shell script linter
+      shellcheck = {
+        enabled = true,
+        install_method = "brew",
+      },
+      # Shfmt - Shell script formatter
+      shfmt = {
+        enabled = true,
+        install_method = "brew",
+      },
+      # Markdownlint - Markdown linter
+      markdownlint = {
+        enabled = true,
+        install_method = "npm",
+      },
+      # Vale - Prose linter
+      vale = {
+        enabled = true,
+        install_method = "brew",
+      },
+      # Nickel - Configuration language type checker
+      nickel = {
+        enabled = true,
+        install_method = "brew",
+        check_all = true,
+      },
+      # NuShell - Shell script validator
+      nushell = {
+        enabled = true,
+        install_method = "builtin",
+        check_all = true,
+      },
+      # Ruff - Fast Python linter
+      ruff = {
+        enabled = true,
+        install_method = "pip",
+      },
+      # Black - Python code formatter
+      black = {
+        enabled = true,
+        install_method = "pip",
+      },
+      # Pytest - Python testing framework
+      pytest = {
+        enabled = true,
+        install_method = "pip",
+      },
+      # ESLint - JavaScript linter
+      eslint = {
+        enabled = true,
+        install_method = "npm",
+      },
+      # Prettier - Code formatter
+      prettier = {
+        enabled = true,
+        install_method = "npm",
+      },
+      # Jest - JavaScript testing framework
+      jest = {
+        enabled = true,
+        install_method = "npm",
+      },
+    },
+
+    # CI Features
+    # High-level feature flags for CI behavior
+    features = {
+      enable_ci_cd = true,
+      enable_pre_commit = true,
+      generate_taplo_config = true,
+      generate_contributing = true,
+      generate_security = true,
+      generate_code_of_conduct = true,
+      generate_dockerfiles = true,
+      enable_cross_compilation = true,
+    },
+
+    # CI Provider Configurations
+    # Settings for GitHub Actions, Woodpecker, GitLab CI, etc.
+    ci_providers = {
+      # GitHub Actions
+      github_actions = {
+        enabled = true,
+        branches_push = "main,develop",
+        branches_pr = "main",
+      },
+      # Woodpecker CI
+      woodpecker = {
+        enabled = true,
+      },
+    },
+
+    # CI Settings
+    settings = {
+      parallel_jobs = 1,
+      job_timeout_minutes = 1,
+      require_status_checks = true,
+      run_on_draft_prs = true,
+    },
+  },
+}

.typedialog/ci/configure.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# CI Configuration Script
+# Auto-generated by dev-system/ci installer
+#
+# Interactive configuration for CI tools using TypeDialog.
+# Uses Nickel format for configuration files.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TYPEDIALOG_CI="${SCRIPT_DIR}"
+
+# Source envrc to load fragment paths and other environment variables
+if [[ -f "${TYPEDIALOG_CI}/envrc" ]]; then
+    # shellcheck source=/dev/null
+    source "${TYPEDIALOG_CI}/envrc"
+fi
+
+# Configuration files
+FORM_FILE="${TYPEDIALOG_CI}/form.toml"
+CONFIG_FILE="${TYPEDIALOG_CI}/config.ncl"
+
+# NCL_TEMPLATE is set by envrc (cascading: local → Tools)
+# If not set, use default from Tools
+NCL_TEMPLATE="${NCL_TEMPLATE:-${TOOLS_PATH}/dev-system/ci/templates/config.ncl.j2}"
+
+# TypeDialog environment variables (can be overridden)
+# Port for web backend (default: 9000)
+export TYPEDIALOG_PORT="${TYPEDIALOG_PORT:-9000}"
+
+# Host for web backend (default: localhost)
+export TYPEDIALOG_HOST="${TYPEDIALOG_HOST:-localhost}"
+
+# Locale for form localization (default: system locale)
+export TYPEDIALOG_LANG="${TYPEDIALOG_LANG:-${LANG:-en_US.UTF-8}}"
+
+# Detect which TypeDialog backend to use (default: web)
+BACKEND="${1:-web}"
+
+# Validate backend
+case "$BACKEND" in
+    cli|tui|web)
+        ;;
+    *)
+        echo "Usage: $0 [cli|tui|web]"
+        echo ""
+        echo "Launches TypeDialog for interactive CI configuration."
+        echo "Backend options:"
+        echo "  cli - Command-line interface (simple prompts)"
+        echo "  tui - Terminal UI (interactive panels)"
+        echo "  web - Web server (browser-based) [default]"
+        exit 1
+        ;;
+esac
+
+# Check if form exists
+if [[ ! -f "$FORM_FILE" ]]; then
+    echo "Error: Form file not found: $FORM_FILE"
+    exit 1
+fi
+
+# Create backup if config exists
+if [[ -f "$CONFIG_FILE" ]]; then
+    BACKUP="${CONFIG_FILE}.$(date +%Y%m%d_%H%M%S).bak"
+    cp "$CONFIG_FILE" "$BACKUP"
+    echo "ℹ️  Backed up existing config to: $(basename "$BACKUP")"
+fi
+
+# Launch TypeDialog with Nickel roundtrip (preserves Nickel format)
+echo "🔧 Launching TypeDialog ($BACKEND backend)..."
+echo ""
+
+# Show web server info if using web backend
+if [[ "$BACKEND" == "web" ]]; then
+    echo "🌐 Web server will start on: http://${TYPEDIALOG_HOST}:${TYPEDIALOG_PORT}"
+    echo "   (Override with: TYPEDIALOG_PORT=8080 TYPEDIALOG_HOST=0.0.0.0 $0)"
+    echo ""
+fi
+
+# Build nickel-roundtrip command with optional template
+NCL_TEMPLATE_ARG=""
+if [[ -f "$NCL_TEMPLATE" ]]; then
+    NCL_TEMPLATE_ARG="--ncl-template $NCL_TEMPLATE"
+    echo "ℹ️  Using Nickel template: $NCL_TEMPLATE"
+fi
+
+case "$BACKEND" in
+    cli)
+        typedialog nickel-roundtrip "$CONFIG_FILE" "$FORM_FILE" --output "$CONFIG_FILE" $NCL_TEMPLATE_ARG
+        ;;
+    tui)
+        typedialog-tui nickel-roundtrip "$CONFIG_FILE" "$FORM_FILE" --output "$CONFIG_FILE" $NCL_TEMPLATE_ARG
+        ;;
+    web)
+        typedialog-web nickel-roundtrip "$CONFIG_FILE" "$FORM_FILE" --output "$CONFIG_FILE" $NCL_TEMPLATE_ARG
+        ;;
+esac
+
+EXIT_CODE=$?
+
+if [[ $EXIT_CODE -eq 0 ]]; then
+    echo ""
+    echo "✅ Configuration saved to: $CONFIG_FILE"
+    echo ""
+    echo "Next steps:"
+    echo "  - Review the configuration: cat $CONFIG_FILE"
+    echo "  - Apply CI tools: (run your CI setup command)"
+    echo "  - Re-run this script anytime to update: $0"
+else
+    echo ""
+    echo "❌ Configuration cancelled or failed (exit code: $EXIT_CODE)"
+    if [[ -f "${CONFIG_FILE}.bak" ]]; then
+        echo "   Previous config restored from backup"
+    fi
+    exit $EXIT_CODE
+fi

.typedialog/ci/envrc

@@ -0,0 +1,27 @@
+# Auto-generated by dev-system/ci
+#
+# Cascading Path Strategy:
+#   1. Local files in .typedialog/ci/ take precedence (overrides)
+#   2. Central files in $TOOLS_PATH/dev-system/ci/ as fallback (defaults)
+#
+# To customize: Create file in .typedialog/ci/{schemas,validators,defaults,fragments}/
+# Your local version will be used instead of the Tools version.
+
+# Nickel import paths (cascading: local → Tools)
+export NICKEL_IMPORT_PATH="schemas:$TOOLS_PATH/dev-system/ci/schemas:validators:$TOOLS_PATH/dev-system/ci/validators:defaults:$TOOLS_PATH/dev-system/ci/defaults"
+
+# TypeDialog fragment search paths (cascading: local → Tools)
+export TYPEDIALOG_FRAGMENT_PATH=".typedialog/ci:$TOOLS_PATH/dev-system/ci/forms"
+
+# Nickel template for config.ncl generation (with cascading)
+# Local template takes precedence if exists
+if [[ -f ".typedialog/ci/config.ncl.j2" ]]; then
+  export NCL_TEMPLATE=".typedialog/ci/config.ncl.j2"
+else
+  export NCL_TEMPLATE="$TOOLS_PATH/dev-system/ci/templates/config.ncl.j2"
+fi
+
+# TypeDialog web backend configuration (override if needed)
+export TYPEDIALOG_PORT=${TYPEDIALOG_PORT:-9000}
+export TYPEDIALOG_HOST=${TYPEDIALOG_HOST:-localhost}
+export TYPEDIALOG_LANG=${TYPEDIALOG_LANG:-${LANG:-en_US.UTF-8}}

.typedialog/ci/form.toml

@@ -0,0 +1,231 @@
+description = "Interactive configuration for continuous integration and code quality tools"
+display_mode = "complete"
+locales_path = "../../../locales"
+name = "CI Configuration Form"
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "project_header"
+title = "📦 Project Information"
+type = "section_header"
+
+[[elements]]
+help = "Name of the project"
+name = "project_name"
+nickel_path = ["ci", "project", "name"]
+placeholder = "my-project"
+prompt = "Project name"
+required = true
+type = "text"
+
+[[elements]]
+help = "Optional description"
+name = "project_description"
+nickel_path = ["ci", "project", "description"]
+placeholder = "Brief description of what this project does"
+prompt = "Project description"
+required = false
+type = "text"
+
+[[elements]]
+default = ""
+help = "Project website or documentation site URL"
+name = "project_site_url"
+nickel_path = ["ci", "project", "site_url"]
+placeholder = "https://example.com"
+prompt = "Project Site URL"
+required = false
+type = "text"
+
+[[elements]]
+default = ""
+help = "Project repository URL (GitHub, GitLab, etc.)"
+name = "project_repo_url"
+nickel_path = ["ci", "project", "repo_url"]
+placeholder = "https://github.com/user/repo"
+prompt = "Project Repo URL"
+required = false
+type = "text"
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "languages_header"
+title = "🔍 Detected Languages"
+type = "section_header"
+
+[[elements]]
+default = "rust"
+display_mode = "grid"
+help = "Select all languages detected or used in the project"
+min_selected = 1
+name = "detected_languages"
+nickel_path = ["ci", "project", "detected_languages"]
+prompt = "Which languages are used in this project?"
+required = true
+searchable = true
+type = "multiselect"
+
+  [[elements.options]]
+  label = "🦀 Rust"
+  value = "rust"
+
+  [[elements.options]]
+  label = "🐚 NuShell"
+  value = "nushell"
+
+  [[elements.options]]
+  label = "⚙️  Nickel"
+  value = "nickel"
+
+  [[elements.options]]
+  label = "🔧 Bash/Shell"
+  value = "bash"
+
+  [[elements.options]]
+  label = "📝 Markdown/Documentation"
+  value = "markdown"
+
+  [[elements.options]]
+  label = "🐍 Python"
+  value = "python"
+
+  [[elements.options]]
+  label = "📜 JavaScript/TypeScript"
+  value = "javascript"
+
+[[elements]]
+default = "rust"
+help = "Main language used for defaults (e.g., in GitHub Actions workflows)"
+name = "primary_language"
+nickel_path = ["ci", "project", "primary_language"]
+options_from = "detected_languages"
+prompt = "Primary language"
+required = true
+type = "select"
+
+  [[elements.options]]
+  label = "🦀 Rust"
+  value = "rust"
+
+  [[elements.options]]
+  label = "🐚 NuShell"
+  value = "nushell"
+
+  [[elements.options]]
+  label = "⚙️  Nickel"
+  value = "nickel"
+
+  [[elements.options]]
+  label = "🔧 Bash"
+  value = "bash"
+
+  [[elements.options]]
+  label = "📝 Markdown"
+  value = "markdown"
+
+  [[elements.options]]
+  label = "🐍 Python"
+  value = "python"
+
+  [[elements.options]]
+  label = "📜 JavaScript"
+  value = "javascript"
+
+[[elements]]
+includes = ["fragments/rust-tools.toml"]
+name = "rust_tools_group"
+type = "group"
+when = "rust in detected_languages"
+
+[[elements]]
+includes = ["fragments/nushell-tools.toml"]
+name = "nushell_tools_group"
+type = "group"
+when = "nushell in detected_languages"
+
+[[elements]]
+includes = ["fragments/nickel-tools.toml"]
+name = "nickel_tools_group"
+type = "group"
+when = "nickel in detected_languages"
+
+[[elements]]
+includes = ["fragments/bash-tools.toml"]
+name = "bash_tools_group"
+type = "group"
+when = "bash in detected_languages"
+
+[[elements]]
+includes = ["fragments/markdown-tools.toml"]
+name = "markdown_tools_group"
+type = "group"
+when = "markdown in detected_languages"
+
+[[elements]]
+includes = ["fragments/python-tools.toml"]
+name = "python_tools_group"
+type = "group"
+when = "python in detected_languages"
+
+[[elements]]
+includes = ["fragments/javascript-tools.toml"]
+name = "javascript_tools_group"
+type = "group"
+when = "javascript in detected_languages"
+
+[[elements]]
+includes = ["fragments/general-tools.toml"]
+name = "general_tools_group"
+type = "group"
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "ci_cd_header"
+title = "🔄 CI/CD Configuration"
+type = "section_header"
+
+[[elements]]
+default = "true"
+help = "Set up continuous integration and deployment pipelines"
+name = "enable_ci_cd"
+nickel_path = ["ci", "features", "enable_ci_cd"]
+prompt = "Enable CI/CD integration?"
+type = "confirm"
+
+[[elements]]
+includes = ["fragments/ci-providers.toml"]
+name = "ci_providers_group"
+type = "group"
+when = "enable_ci_cd == true"
+
+[[elements]]
+includes = ["fragments/ci-settings.toml"]
+name = "ci_settings_group"
+type = "group"
+when = "enable_ci_cd == true"
+
+[[elements]]
+includes = ["fragments/build-deployment.toml"]
+name = "build_deployment_group"
+type = "group"
+when = "enable_ci_cd == true"
+
+[[elements]]
+includes = ["fragments/documentation.toml"]
+name = "documentation_group"
+type = "group"
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "confirmation_header"
+title = "✅ Ready to Install"
+type = "section_header"
+
+[[elements]]
+content = "Review your configuration above. After confirming, the CI system will be installed with your chosen settings."
+name = "confirmation_footer"
+type = "footer"

.typedialog/core/forms/auth-login.toml

@@ -0,0 +1,89 @@
+# Authentication Login Form
+# Interactive login for provisioning system
+# Location: .typedialog/provisioning/auth-login.toml
+
+description = "Interactive authentication login"
+display_mode = "complete"
+locales_path = "../../../../../locales"
+name = "Authentication Login"
+
+# ============================================================================
+# LOGIN CREDENTIALS
+# ============================================================================
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "login_header"
+title = "🔐 Authentication Login"
+type = "section_header"
+
+[[elements]]
+help = "Enter your username"
+name = "username"
+nickel_path = ["auth", "username"]
+placeholder = "username"
+prompt = "Username"
+required = true
+type = "text"
+validation_pattern = "^[a-zA-Z0-9_-]+$"
+
+[[elements]]
+help = "Enter your password"
+name = "password"
+nickel_path = ["auth", "password"]
+placeholder = "password"
+prompt = "Password"
+required = true
+type = "password"
+
+# ============================================================================
+# MULTI-FACTOR AUTHENTICATION
+# ============================================================================
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "mfa_header"
+title = "🔒 Multi-Factor Authentication"
+type = "section_header"
+
+[[elements]]
+default = false
+help = "Do you have MFA enabled for this account?"
+name = "has_mfa"
+nickel_path = ["auth", "has_mfa"]
+prompt = "MFA enabled?"
+required = false
+type = "confirm"
+
+[[elements]]
+help = "Enter your MFA code (6 digits)"
+name = "mfa_code"
+nickel_path = ["auth", "mfa_code"]
+placeholder = "123456"
+prompt = "MFA Code"
+required = false
+type = "text"
+validation_pattern = "^[0-9]{6}$"
+when = "has_mfa == true"
+
+# ============================================================================
+# CONFIRMATION
+# ============================================================================
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "confirm_header"
+title = "✅ Confirmation"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Confirm login with the provided credentials"
+name = "confirm_login"
+nickel_path = ["auth", "confirm_login"]
+prompt = "Proceed with login?"
+required = false
+type = "confirm"

.typedialog/core/forms/infrastructure/cluster_delete_confirm.toml

@@ -0,0 +1,116 @@
+# Cluster Deletion Confirmation Form
+# Generated: {{ now_iso }}
+# Purpose: Confirm destructive cluster deletion operation
+
+[meta]
+allow_cancel = true
+description = "This action will permanently delete the entire cluster and all associated resources"
+title = "Cluster Deletion Confirmation"
+
+# ============================================================================
+# CRITICAL WARNING SECTION
+# ============================================================================
+
+[items.critical_warning]
+display_only = true
+prompt = "🔴 CRITICAL: Cluster Deletion is Irreversible"
+type = "text"
+
+[items.warning_details]
+display_only = true
+help = """
+• Permanently delete all nodes in the cluster
+• Destroy all persistent volumes and data
+• Terminate all running applications and services
+• Remove all persistent configurations
+• Make cluster inaccessible - cannot be recovered"""
+prompt = "Cluster Deletion will:"
+type = "text"
+
+# ============================================================================
+# CLUSTER INFORMATION
+# ============================================================================
+
+[items.cluster_info_header]
+display_only = true
+prompt = "Cluster to Delete"
+type = "text"
+
+[items.cluster_name]
+default = "{{ cluster_name | default('unknown') }}"
+display_only = true
+prompt = "Cluster Name"
+type = "text"
+
+[items.cluster_type]
+default = "{{ cluster_type | default('unknown') }}"
+display_only = true
+prompt = "Cluster Type"
+type = "text"
+
+[items.node_count]
+default = "{{ node_count | default('unknown') }}"
+display_only = true
+prompt = "Number of Nodes"
+type = "text"
+
+[items.total_resources]
+default = "{{ total_resources | default('unknown') }}"
+display_only = true
+help = "Approximate total CPU and memory that will be freed"
+prompt = "Total Resources"
+type = "text"
+
+# ============================================================================
+# DEPENDENT RESOURCES
+# ============================================================================
+
+[items.dependents_header]
+display_only = true
+prompt = "Resources That Will Be Deleted"
+type = "text"
+
+[items.deployments_count]
+default = "{{ deployments_count | default('0') }}"
+display_only = true
+prompt = "Deployments"
+type = "text"
+
+[items.services_count]
+default = "{{ services_count | default('0') }}"
+display_only = true
+prompt = "Services"
+type = "text"
+
+[items.volumes_count]
+default = "{{ volumes_count | default('0') }}"
+display_only = true
+prompt = "Persistent Volumes"
+type = "text"
+
+# ============================================================================
+# CONFIRMATION
+# ============================================================================
+
+[items.confirm_header]
+display_only = true
+prompt = "Final Confirmation Required"
+type = "text"
+
+[items.confirmation_text]
+help = "You must type the exact phrase: DELETE CLUSTER"
+prompt = "Type 'DELETE CLUSTER' to Confirm"
+required = true
+type = "text"
+
+[items.understand_final]
+help = "Check this box to acknowledge that you understand the consequences"
+prompt = "I understand this operation is permanent and all data will be lost"
+required = true
+type = "confirm"
+
+[items.proceed_final]
+help = "This is the final confirmation. There is no undo."
+prompt = "Delete cluster '{{ cluster_name | default('cluster') }}' with {{ node_count | default('all') }} nodes?"
+required = true
+type = "confirm"

.typedialog/core/forms/infrastructure/generic_delete_confirm.toml

@@ -0,0 +1,83 @@
+# Generic Resource Deletion Confirmation Form
+# Generated: {{ now_iso }}
+# Purpose: Generic confirmation for any resource deletion
+
+[meta]
+allow_cancel = true
+description = "Confirm permanent deletion of resource"
+title = "Resource Deletion Confirmation"
+
+# ============================================================================
+# WARNING SECTION
+# ============================================================================
+
+[items.warning_header]
+display_only = true
+prompt = "⚠️ Warning: Permanent Deletion"
+type = "text"
+
+[items.resource_type]
+default = "{{ resource_type | default('Resource') }}"
+display_only = true
+prompt = "Resource Type"
+type = "text"
+
+[items.resource_name]
+default = "{{ resource_name | default('unknown') }}"
+display_only = true
+prompt = "Resource Name"
+type = "text"
+
+[items.resource_id]
+default = "{{ resource_id | default('') }}"
+display_only = true
+help = "Unique identifier of the resource"
+prompt = "Resource ID"
+type = "text"
+
+[items.resource_status]
+default = "{{ resource_status | default('unknown') }}"
+display_only = true
+prompt = "Current Status"
+type = "text"
+
+# ============================================================================
+# IMPACT INFORMATION
+# ============================================================================
+
+[items.impact_header]
+display_only = true
+prompt = "Deletion Impact"
+type = "text"
+
+[items.irreversible_warning]
+display_only = true
+help = "There is no way to undo this operation"
+prompt = "This action is irreversible"
+type = "text"
+
+[items.data_loss_warning]
+display_only = true
+help = "This includes configurations, logs, and cached data"
+prompt = "All associated data will be permanently lost"
+type = "text"
+
+# ============================================================================
+# CONFIRMATION
+# ============================================================================
+
+[items.confirm_text]
+help = "This prevents accidental deletion"
+prompt = "Type 'DELETE' to Confirm"
+required = true
+type = "text"
+
+[items.final_confirm]
+prompt = "I understand this is permanent and all data will be lost"
+required = true
+type = "confirm"
+
+[items.proceed]
+prompt = "Delete {{ resource_type | default('resource') }} '{{ resource_name | default('unknown') }}'?"
+required = true
+type = "confirm"

.typedialog/core/forms/infrastructure/server_delete_confirm.toml

@@ -0,0 +1,84 @@
+# Server Deletion Confirmation Form
+# Generated: {{ now_iso }}
+# Purpose: Confirm destructive server deletion operation
+
+[meta]
+allow_cancel = true
+description = "This action will permanently delete the server and all associated data"
+title = "Server Deletion Confirmation"
+
+# ============================================================================
+# WARNING SECTION
+# ============================================================================
+
+[items.warning_header]
+display_only = true
+prompt = "⚠️ WARNING: This Action Cannot Be Undone"
+type = "text"
+
+[items.warning_text]
+display_only = true
+help = """
+• Permanently remove the server from all providers
+• Delete all associated data and configurations
+• Terminate all running services
+• Release allocated IP addresses and storage"""
+prompt = "Server Deletion will:"
+type = "text"
+
+# ============================================================================
+# SERVER INFORMATION
+# ============================================================================
+
+[items.server_info_header]
+display_only = true
+prompt = "Server to Delete"
+type = "text"
+
+[items.server_name]
+default = "{{ server_name | default('unknown') }}"
+display_only = true
+help = "Name of the server being deleted"
+prompt = "Server Name"
+type = "text"
+
+[items.server_ip]
+default = "{{ server_ip | default('not assigned') }}"
+display_only = true
+help = "Current IP address of the server"
+prompt = "IP Address"
+type = "text"
+
+[items.server_status]
+default = "{{ server_status | default('unknown') }}"
+display_only = true
+help = "Current operational status"
+prompt = "Current Status"
+type = "text"
+
+# ============================================================================
+# CONFIRMATION
+# ============================================================================
+
+[items.confirm_header]
+display_only = true
+prompt = "Confirm Deletion"
+type = "text"
+
+[items.confirmation_text]
+help = "This prevents accidental deletion. You must type the exact word DELETE"
+prompt = "Type 'DELETE' to Confirm"
+required = true
+type = "text"
+
+[items.final_confirm]
+help = "Check this box to confirm you understand the consequences"
+prompt = "I understand this is permanent and cannot be undone"
+required = true
+type = "confirm"
+
+[items.proceed]
+help = "Final confirmation to proceed with deletion"
+prompt = "Delete server {{ server_name | default('server') }}?"
+required = true
+type = "confirm"

.typedialog/core/forms/infrastructure/taskserv_delete_confirm.toml

@@ -0,0 +1,108 @@
+# Task Service Deletion Confirmation Form
+# Generated: {{ now_iso }}
+# Purpose: Confirm destructive taskserv deletion operation
+
+[meta]
+allow_cancel = true
+description = "This action will permanently delete the task service and all associated data"
+title = "Task Service Deletion Confirmation"
+
+# ============================================================================
+# WARNING SECTION
+# ============================================================================
+
+[items.warning_header]
+display_only = true
+prompt = "⚠️ WARNING: This Action Cannot Be Undone"
+type = "text"
+
+[items.warning_text]
+display_only = true
+help = """
+• Permanently remove the service definition
+• Delete all containers and images
+• Remove all associated volumes and data
+• Terminate all running tasks
+• Invalidate all service references"""
+prompt = "Task Service Deletion will:"
+type = "text"
+
+# ============================================================================
+# TASKSERV INFORMATION
+# ============================================================================
+
+[items.taskserv_info_header]
+display_only = true
+prompt = "Task Service to Delete"
+type = "text"
+
+[items.taskserv_name]
+default = "{{ taskserv_name | default('unknown') }}"
+display_only = true
+help = "Name of the task service being deleted"
+prompt = "Service Name"
+type = "text"
+
+[items.taskserv_type]
+default = "{{ taskserv_type | default('unknown') }}"
+display_only = true
+help = "Type of service (e.g., kubernetes, postgres, redis)"
+prompt = "Service Type"
+type = "text"
+
+[items.taskserv_server]
+default = "{{ taskserv_server | default('unknown') }}"
+display_only = true
+help = "Server hosting this task service"
+prompt = "Deployed On Server"
+type = "text"
+
+[items.taskserv_status]
+default = "{{ taskserv_status | default('unknown') }}"
+display_only = true
+help = "Operational status of the service"
+prompt = "Current Status"
+type = "text"
+
+# ============================================================================
+# IMPACT ANALYSIS
+# ============================================================================
+
+[items.impact_header]
+display_only = true
+prompt = "Services That Depend on This"
+type = "text"
+
+[items.dependent_services]
+default = "{{ dependent_services | default('none') }}"
+display_only = true
+help = "These services will be affected by deletion"
+prompt = "Dependent Services"
+type = "text"
+
+# ============================================================================
+# CONFIRMATION
+# ============================================================================
+
+[items.confirm_header]
+display_only = true
+prompt = "Confirm Deletion"
+type = "text"
+
+[items.confirmation_text]
+help = "This prevents accidental deletion. You must type the exact word DELETE"
+prompt = "Type 'DELETE' to Confirm"
+required = true
+type = "text"
+
+[items.final_confirm]
+help = "Check this box to confirm you understand the consequences"
+prompt = "I understand this is permanent and will affect dependent services"
+required = true
+type = "confirm"
+
+[items.proceed]
+help = "Final confirmation to proceed with deletion"
+prompt = "Delete {{ taskserv_type | default('task service') }} '{{ taskserv_name | default('unknown') }}'?"
+required = true
+type = "confirm"

.typedialog/core/forms/mfa-enroll.toml

@@ -0,0 +1,172 @@
+# MFA Enrollment Form
+# Interactive Multi-Factor Authentication enrollment
+# Location: .typedialog/provisioning/mfa-enroll.toml
+
+description = "Interactive Multi-Factor Authentication enrollment"
+display_mode = "complete"
+locales_path = "../../../../../locales"
+name = "MFA Enrollment"
+
+# ============================================================================
+# MFA CONFIGURATION
+# ============================================================================
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "mfa_header"
+title = "🔐 Multi-Factor Authentication Setup"
+type = "section_header"
+
+[[elements]]
+default = "totp"
+help = "Choose the MFA method"
+name = "mfa_type"
+nickel_path = ["mfa", "type"]
+options = ["totp", "webauthn", "sms"]
+prompt = "MFA Type"
+required = true
+type = "select"
+
+# ============================================================================
+# TOTP CONFIGURATION (Time-based One-Time Password)
+# ============================================================================
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "totp_header"
+title = "📱 TOTP Configuration"
+type = "section_header"
+when = "mfa_type == 'totp'"
+
+[[elements]]
+default = "Authenticator App"
+help = "Name for this MFA device (e.g., 'iPhone', 'Authenticator App')"
+name = "totp_device_name"
+nickel_path = ["mfa", "totp", "device_name"]
+placeholder = "My Phone"
+prompt = "Device name"
+required = false
+type = "text"
+when = "mfa_type == 'totp'"
+
+[[elements]]
+help = "Verify your setup by entering the code from your authenticator app"
+name = "totp_verification_code"
+nickel_path = ["mfa", "totp", "verification_code"]
+placeholder = "123456"
+prompt = "Verification code (6 digits)"
+required = false
+type = "text"
+validation_pattern = "^[0-9]{6}$"
+when = "mfa_type == 'totp'"
+
+# ============================================================================
+# WEBAUTHN CONFIGURATION (Hardware Keys / Biometrics)
+# ============================================================================
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "webauthn_header"
+title = "🔑 WebAuthn Configuration"
+type = "section_header"
+when = "mfa_type == 'webauthn'"
+
+[[elements]]
+default = "Security Key"
+help = "Name for this security key (e.g., 'YubiKey', 'Fingerprint')"
+name = "webauthn_device_name"
+nickel_path = ["mfa", "webauthn", "device_name"]
+placeholder = "Security Key"
+prompt = "Device name"
+required = false
+type = "text"
+when = "mfa_type == 'webauthn'"
+
+# ============================================================================
+# SMS CONFIGURATION
+# ============================================================================
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "sms_header"
+title = "📲 SMS Configuration"
+type = "section_header"
+when = "mfa_type == 'sms'"
+
+[[elements]]
+help = "Phone number for SMS verification (international format: +1234567890)"
+name = "sms_phone_number"
+nickel_path = ["mfa", "sms", "phone_number"]
+placeholder = "+1234567890"
+prompt = "Phone number"
+required = false
+type = "text"
+validation_pattern = "^\\+[0-9]{10,15}$"
+when = "mfa_type == 'sms'"
+
+[[elements]]
+help = "Verify your phone number by entering the SMS code"
+name = "sms_verification_code"
+nickel_path = ["mfa", "sms", "verification_code"]
+placeholder = "123456"
+prompt = "SMS verification code (6 digits)"
+required = false
+type = "text"
+validation_pattern = "^[0-9]{6}$"
+when = "mfa_type == 'sms'"
+
+# ============================================================================
+# BACKUP CODES
+# ============================================================================
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "backup_header"
+title = "💾 Backup Codes"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Generate backup codes for account recovery"
+name = "generate_backup_codes"
+nickel_path = ["mfa", "generate_backup_codes"]
+prompt = "Generate backup codes?"
+required = false
+type = "confirm"
+
+[[elements]]
+default = 10
+help = "Number of backup codes to generate"
+max = 20
+min = 5
+name = "backup_codes_count"
+nickel_path = ["mfa", "backup_codes_count"]
+prompt = "Number of backup codes"
+required = false
+type = "number"
+when = "generate_backup_codes == true"
+
+# ============================================================================
+# CONFIRMATION
+# ============================================================================
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "confirm_header"
+title = "✅ Confirmation"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Confirm MFA enrollment with the provided configuration"
+name = "confirm_enroll"
+nickel_path = ["mfa", "confirm_enroll"]
+prompt = "Complete MFA enrollment?"
+required = false
+type = "confirm"

.typedialog/core/forms/setup-wizard.toml

@@ -0,0 +1,222 @@
+# Setup Wizard Form for Provisioning System
+# Interactive configuration for initial system setup
+# Location: .typedialog/provisioning/setup-wizard.toml
+
+description = "Interactive setup wizard for provisioning system initialization"
+display_mode = "complete"
+locales_path = "../../../../../locales"
+name = "Provisioning System Setup Wizard"
+
+# ============================================================================
+# SYSTEM CONFIGURATION
+# ============================================================================
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "system_header"
+title = "⚙️  System Configuration"
+type = "section_header"
+
+[[elements]]
+help = "Base path for storing configuration files"
+name = "config_path"
+nickel_path = ["system_config", "config_path"]
+placeholder = "/Users/username/.config/provisioning"
+prompt = "Configuration base path"
+required = true
+type = "text"
+
+[[elements]]
+default = true
+help = "Use recommended paths for your operating system"
+name = "use_defaults"
+nickel_path = ["system_config", "use_defaults"]
+prompt = "Use recommended paths for your OS?"
+required = false
+type = "confirm"
+
+# ============================================================================
+# DEPLOYMENT MODE SELECTION
+# ============================================================================
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "deployment_header"
+title = "🚀 Deployment Mode"
+type = "section_header"
+
+[[elements]]
+default = "docker-compose"
+help = "Choose how platform services will be deployed"
+name = "deployment_mode"
+nickel_path = ["deployment_mode"]
+options = ["docker-compose", "kubernetes", "remote-ssh", "systemd"]
+prompt = "Deployment mode"
+required = true
+type = "select"
+
+# ============================================================================
+# PROVIDER SELECTION
+# ============================================================================
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "providers_header"
+title = "☁️  Infrastructure Providers"
+type = "section_header"
+
+[[elements]]
+help = "Select which infrastructure providers to enable"
+name = "providers_info"
+title = "Select at least one provider"
+type = "section_header"
+
+[[elements]]
+default = false
+help = "Enable UpCloud provider"
+name = "provider_upcloud"
+nickel_path = ["providers", "upcloud"]
+prompt = "Use UpCloud?"
+required = false
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Enable AWS provider"
+name = "provider_aws"
+nickel_path = ["providers", "aws"]
+prompt = "Use AWS?"
+required = false
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Enable Hetzner provider"
+name = "provider_hetzner"
+nickel_path = ["providers", "hetzner"]
+prompt = "Use Hetzner?"
+required = false
+type = "confirm"
+
+[[elements]]
+default = true
+help = "Enable local provider (required for local deployments)"
+name = "provider_local"
+nickel_path = ["providers", "local"]
+prompt = "Use local provider?"
+required = false
+type = "confirm"
+
+# ============================================================================
+# RESOURCE ALLOCATION
+# ============================================================================
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "resources_header"
+title = "💻 Resource Allocation"
+type = "section_header"
+
+[[elements]]
+default = 4
+help = "Number of CPU cores to allocate"
+max = 128
+min = 1
+name = "cpu_count"
+nickel_path = ["resources", "cpu_count"]
+prompt = "Number of CPUs to allocate"
+required = true
+type = "number"
+
+[[elements]]
+default = 8
+help = "Amount of memory to allocate (in GB)"
+max = 1024
+min = 1
+name = "memory_gb"
+nickel_path = ["resources", "memory_gb"]
+prompt = "Memory in GB to allocate"
+required = true
+type = "number"
+
+# ============================================================================
+# SECURITY CONFIGURATION
+# ============================================================================
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "security_header"
+title = "🔒 Security Configuration"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Enable Multi-Factor Authentication for enhanced security"
+name = "enable_mfa"
+nickel_path = ["security", "enable_mfa"]
+prompt = "Enable Multi-Factor Authentication (MFA)?"
+required = false
+type = "confirm"
+
+[[elements]]
+default = true
+help = "Enable audit logging for all operations"
+name = "enable_audit"
+nickel_path = ["security", "enable_audit"]
+prompt = "Enable audit logging for all operations?"
+required = false
+type = "confirm"
+
+[[elements]]
+default = true
+help = "Require approval for destructive operations"
+name = "require_approval"
+nickel_path = ["security", "require_approval_for_destructive"]
+prompt = "Require approval for destructive operations?"
+required = false
+type = "confirm"
+
+# ============================================================================
+# WORKSPACE CONFIGURATION
+# ============================================================================
+
+[[elements]]
+border_bottom = true
+border_top = true
+name = "workspace_header"
+title = "📁 Initial Workspace"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Create an initial workspace for your infrastructure"
+name = "create_workspace"
+nickel_path = ["workspace", "create_workspace"]
+prompt = "Create workspace now?"
+required = false
+type = "confirm"
+
+[[elements]]
+default = "default"
+help = "Name for the initial workspace"
+name = "workspace_name"
+nickel_path = ["workspace", "name"]
+prompt = "Workspace name"
+required = false
+type = "text"
+when = "create_workspace == true"
+
+[[elements]]
+default = "Default workspace"
+help = "Optional description for the workspace"
+name = "workspace_description"
+nickel_path = ["workspace", "description"]
+prompt = "Workspace description (optional)"
+required = false
+type = "text"
+when = "create_workspace == true"

.typedialog/platform/forms/README.md

@@ -0,0 +1,390 @@
+# Forms
+
+TypeDialog form definitions for interactive configuration of platform services.
+
+## Purpose
+
+Forms provide:
+- **Interactive configuration** - Web/TUI/CLI interfaces for user input
+- **Constraint validation** - Dynamic min/max from constraints.toml
+- **Nickel mapping** - Form fields map to Nickel structure via `nickel_path`
+- **Jinja2 template integration** - Generate Nickel configs from form values
+- **nickel-roundtrip workflow** - Load existing Nickel → edit → generate updated Nickel
+
+## File Organization
+
+```toml
+forms/
+├── README.md                           # This file
+├── orchestrator-form.toml              # Orchestrator configuration form
+├── control-center-form.toml            # Control Center configuration form
+├── mcp-server-form.toml                # MCP Server configuration form
+├── installer-form.toml                 # Installer configuration form
+└── fragments/                          # FLAT fragment directory (all fragments here)
+    ├── workspace-section.toml          # Workspace configuration
+    ├── server-section.toml             # HTTP server settings
+    ├── database-rocksdb-section.toml   # RocksDB configuration
+    ├── database-surrealdb-section.toml # SurrealDB configuration
+    ├── database-postgres-section.toml  # PostgreSQL configuration
+    ├── security-section.toml           # Auth, RBAC, encryption
+    ├── monitoring-section.toml         # Metrics, health checks
+    ├── logging-section.toml            # Log configuration
+    ├── orchestrator-queue-section.toml # Orchestrator queue config
+    ├── orchestrator-workflow-section.toml
+    ├── control-center-jwt-section.toml
+    ├── control-center-rbac-section.toml
+    ├── mcp-capabilities-section.toml
+    ├── deployment-mode-section.toml    # Mode selection
+    └── README.md                       # Fragment documentation
+```
+
+## Critical: Fragment Organization
+
+**Fragments are FLAT** - all stored in `forms/fragments/` at the same level, referenced by paths in form includes:
+
+```toml
+# Main form (orchestrator-form.toml)
+[[items]]
+name = "workspace_group"
+type = "group"
+includes = ["fragments/workspace-section.toml"]  # Path reference to flat fragment
+
+[[items]]
+name = "queue_group"
+type = "group"
+includes = ["fragments/orchestrator-queue-section.toml"]  # Same level, different name
+```
+
+**NOT nested directories** like `fragments/orchestrator/queue-section.toml` - all in `fragments/`
+
+## TypeDialog nickel-roundtrip Workflow
+
+CRITICAL: Forms integrate with Nickel config generation via:
+
+```nickel
+typedialog-web nickel-roundtrip "$CONFIG_FILE" "$FORM_FILE" --output "$CONFIG_FILE" --template "$NCL_TEMPLATE"
+```
+
+This workflow:
+1. **Loads existing Nickel config** as default values in form
+2. **Shows form** with validated constraints
+3. **User edits** configuration values
+4. **Generates updated Nickel** using Jinja2 template
+
+## Required Fields: nickel_path
+
+**CRITICAL**: Every form element MUST have `nickel_path` to map to Nickel structure:
+
+```toml
+[[elements]]
+name = "workspace_name"
+type = "text"
+prompt = "Workspace Name"
+nickel_path = ["orchestrator", "workspace", "name"]  # ← REQUIRED
+```
+
+The `nickel_path` array specifies the path in the Nickel config structure:
+- `["orchestrator", "workspace", "name"]` → `orchestrator.workspace.name`
+- `["orchestrator", "queue", "max_concurrent_tasks"]` → `orchestrator.queue.max_concurrent_tasks`
+
+## Constraint Interpolation
+
+Form fields reference constraints dynamically:
+
+```toml
+[[elements]]
+name = "max_concurrent_tasks"
+type = "number"
+prompt = "Maximum Concurrent Tasks"
+min = "${constraint.orchestrator.queue.concurrent_tasks.min}"  # Dynamic
+max = "${constraint.orchestrator.queue.concurrent_tasks.max}"  # Dynamic
+help = "Range: ${constraint.orchestrator.queue.concurrent_tasks.min}-${constraint.orchestrator.queue.concurrent_tasks.max}"
+nickel_path = ["orchestrator", "queue", "max_concurrent_tasks"]
+```
+
+TypeDialog resolves `${constraint.path}` from `constraints/constraints.toml`.
+
+## Main Form Structure
+
+All main forms follow this pattern:
+
+```toml
+name = "service_configuration"
+description = "Interactive configuration for {Service}"
+display_mode = "complete"
+
+# Section 1: Deployment mode selection
+[[items]]
+name = "deployment_mode_group"
+type = "group"
+includes = ["fragments/deployment-mode-section.toml"]
+
+# Section 2: Workspace configuration
+[[items]]
+name = "workspace_group"
+type = "group"
+includes = ["fragments/workspace-section.toml"]
+
+# Section 3: Server configuration
+[[items]]
+name = "server_group"
+type = "group"
+includes = ["fragments/server-section.toml"]
+
+# Section N: Service-specific configuration
+[[items]]
+name = "service_group"
+type = "group"
+includes = ["fragments/{service}-specific-section.toml"]
+
+# Optional: Conditional sections
+[[items]]
+name = "monitoring_group"
+type = "group"
+when = "enable_monitoring == true"
+includes = ["fragments/monitoring-section.toml"]
+```
+
+## Fragment Example: workspace-section.toml
+
+```toml
+# Workspace configuration fragment
+[[elements]]
+border_top = true
+border_bottom = true
+name = "workspace_header"
+title = "🗂️ Workspace Configuration"
+type = "section_header"
+
+[[elements]]
+name = "workspace_name"
+type = "text"
+prompt = "Workspace Name"
+default = "default"
+placeholder = "e.g., librecloud, production"
+required = true
+help = "Name of the workspace"
+nickel_path = ["orchestrator", "workspace", "name"]
+
+[[elements]]
+name = "workspace_path"
+type = "text"
+prompt = "Workspace Path"
+default = "/var/lib/provisioning/orchestrator"
+required = true
+help = "Absolute path to workspace directory"
+nickel_path = ["orchestrator", "workspace", "path"]
+
+[[elements]]
+name = "workspace_enabled"
+type = "confirm"
+prompt = "Enable Workspace?"
+default = true
+nickel_path = ["orchestrator", "workspace", "enabled"]
+
+[[elements]]
+name = "multi_workspace"
+type = "confirm"
+prompt = "Multi-Workspace Mode?"
+default = false
+help = "Allow serving multiple workspaces"
+nickel_path = ["orchestrator", "workspace", "multi_workspace"]
+```
+
+## Fragment Example: orchestrator-queue-section.toml
+
+```toml
+# Orchestrator queue configuration
+[[elements]]
+border_top = true
+name = "queue_header"
+title = "⚙️ Queue Configuration"
+type = "section_header"
+
+[[elements]]
+name = "max_concurrent_tasks"
+type = "number"
+prompt = "Maximum Concurrent Tasks"
+default = 5
+min = "${constraint.orchestrator.queue.concurrent_tasks.min}"
+max = "${constraint.orchestrator.queue.concurrent_tasks.max}"
+required = true
+help = "Max tasks running simultaneously. Range: ${constraint.orchestrator.queue.concurrent_tasks.min}-${constraint.orchestrator.queue.concurrent_tasks.max}"
+nickel_path = ["orchestrator", "queue", "max_concurrent_tasks"]
+
+[[elements]]
+name = "retry_attempts"
+type = "number"
+prompt = "Retry Attempts"
+default = 3
+min = 0
+max = 10
+help = "Number of retry attempts for failed tasks"
+nickel_path = ["orchestrator", "queue", "retry_attempts"]
+
+[[elements]]
+name = "retry_delay"
+type = "number"
+prompt = "Retry Delay (ms)"
+default = 5000
+min = 1000
+max = 60000
+help = "Delay between retries in milliseconds"
+nickel_path = ["orchestrator", "queue", "retry_delay"]
+
+[[elements]]
+name = "task_timeout"
+type = "number"
+prompt = "Task Timeout (ms)"
+default = 3600000
+min = 60000
+max = 86400000
+help = "Default timeout for task execution (min 1 min, max 24 hrs)"
+nickel_path = ["orchestrator", "queue", "task_timeout"]
+```
+
+## Jinja2 Template Integration
+
+Jinja2 templates (`templates/{service}-config.ncl.j2`) convert form values to Nickel:
+
+```nickel
+# templates/orchestrator-config.ncl.j2
+{
+  orchestrator = {
+    workspace = {
+      {%- if workspace_name %}
+      name = "{{ workspace_name }}",
+      {%- endif %}
+      {%- if workspace_path %}
+      path = "{{ workspace_path }}",
+      {%- endif %}
+      {%- if workspace_enabled is defined %}
+      enabled = {{ workspace_enabled | lower }},
+      {%- endif %}
+    },
+    queue = {
+      {%- if max_concurrent_tasks %}
+      max_concurrent_tasks = {{ max_concurrent_tasks }},
+      {%- endif %}
+      {%- if retry_attempts %}
+      retry_attempts = {{ retry_attempts }},
+      {%- endif %}
+      {%- if retry_delay %}
+      retry_delay = {{ retry_delay }},
+      {%- endif %}
+      {%- if task_timeout %}
+      task_timeout = {{ task_timeout }},
+      {%- endif %}
+    },
+  },
+}
+```
+
+## Conditional Sections
+
+Forms can show/hide sections based on user selections:
+
+```toml
+# Always shown
+[[items]]
+name = "deployment_mode_group"
+type = "group"
+includes = ["fragments/deployment-mode-section.toml"]
+
+# Only shown if enable_monitoring is true
+[[items]]
+name = "monitoring_group"
+type = "group"
+when = "enable_monitoring == true"
+includes = ["fragments/monitoring-section.toml"]
+
+# Only shown if deployment_mode is "enterprise"
+[[items]]
+name = "enterprise_options"
+type = "group"
+when = "deployment_mode == 'enterprise'"
+includes = ["fragments/enterprise-options-section.toml"]
+```
+
+## Element Types
+
+```toml
+type = "text"           # Single-line text input
+type = "number"         # Numeric input
+type = "confirm"        # Boolean checkbox
+type = "select"         # Dropdown (single choice)
+type = "multiselect"    # Checkboxes (multiple choices)
+type = "password"       # Hidden text input
+type = "textarea"       # Multi-line text
+type = "section_header" # Visual section separator
+type = "footer"         # Confirmation text
+type = "group"          # Container for fragments
+```
+
+## Usage Workflow
+
+### 1. Run Configuration Wizard
+
+```toml
+nu provisioning/.typedialog/provisioning/platform/scripts/configure.nu orchestrator solo
+```
+
+### 2. TypeDialog Loads Form
+
+- Shows `forms/orchestrator-form.toml`
+- Includes fragments from `forms/fragments/*.toml`
+- Applies constraint interpolation
+- Loads existing config as defaults (if exists)
+
+### 3. User Edits
+
+- Fills form fields
+- Validates against constraints
+- Shows validation errors
+
+### 4. Generate Nickel
+
+- Uses `templates/orchestrator-config.ncl.j2`
+- Converts form values to Nickel
+- Saves to `values/orchestrator.solo.ncl`
+
+## Best Practices
+
+1. **Use fragments** - Don't duplicate form sections
+2. **Always add nickel_path** - Required for Nickel mapping
+3. **Use constraint interpolation** - Dynamic limits from constraints.toml
+4. **Provide defaults** - Sensible defaults speed up configuration
+5. **Use clear prompts** - Explain what each field does in `help` text
+6. **Group related fields** - Use fragments to organize logically
+7. **Test constraint interpolation** - Verify ${constraint.*} resolves
+8. **Document fragments** - Use headers and help text
+
+## Testing Forms
+
+```toml
+# Validate form TOML syntax (if supported by TypeDialog)
+# typedialog validate forms/orchestrator-form.toml
+
+# Launch interactive form (web backend)
+nu provisioning/.typedialog/provisioning/platform/scripts/configure.nu orchestrator solo --backend web
+
+# View generated Nickel
+cat provisioning/.typedialog/provisioning/platform/values/orchestrator.solo.ncl
+```
+
+## Adding New Fields
+
+To add a new configuration field:
+
+1. **Add to schema** (schemas/{service}.ncl)
+2. **Add to defaults** (defaults/{service}-defaults.ncl)
+3. **Add to fragment** (forms/fragments/{appropriate}-section.toml)
+   - Include `nickel_path` mapping
+   - Add constraint if numeric
+4. **Update Jinja2 template** (templates/{service}-config.ncl.j2)
+5. **Test**: `nu scripts/configure.nu {service} {mode}`
+
+---
+
+**Version**: 1.0.0
+**Last Updated**: 2025-01-05

.typedialog/platform/forms/ai-service-form.toml

@@ -0,0 +1,13 @@
+# AI Service Configuration Form
+# Sections for AI Service deployment with RAG/MCP integration
+
+description = "Configure AI Service with RAG and MCP integration"
+title = "AI Service Configuration"
+
+sections = [
+  { name = "server", label = "Server Settings", description = "HTTP server and worker configuration" },
+  { name = "rag_integration", label = "RAG Integration", description = "Retrieval-Augmented Generation service integration" },
+  { name = "mcp_integration", label = "MCP Integration", description = "Model Context Protocol service integration" },
+  { name = "dag", label = "DAG Execution", description = "Directed Acyclic Graph task execution settings" },
+  { name = "monitoring", label = "Monitoring", description = "Health checks and observability" },
+]

.typedialog/platform/forms/control-center-form.toml

@@ -0,0 +1,121 @@
+description = "Interactive configuration for Control Center service (policy and RBAC management)"
+display_mode = "complete"
+fallback_locale = "en-US"
+name = "control_center_configuration"
+
+# ============================================================================
+# CONTROL CENTER SERVICE FORM - COMPOSED FROM FRAGMENTS
+# ============================================================================
+# This form uses fragment composition pattern for modular configuration
+# All fragments are located in ./fragments/ subdirectory
+# ============================================================================
+
+# DEPLOYMENT MODE SELECTION
+# Determines service resources and feature set (solo/multiuser/cicd/enterprise)
+[[items]]
+description = "Select deployment mode and database backend"
+includes = [
+  "fragments/deployment/mode-selection.toml",
+  "fragments/deployment/database-backend-selection.toml",
+]
+name = "deployment_mode_group"
+title = "Deployment Configuration"
+type = "group"
+
+# WORKSPACE CONFIGURATION
+# Workspace name, path, and context
+[[items]]
+description = "Configure workspace context for this Control Center instance"
+includes = ["fragments/workspace-section.toml"]
+name = "workspace_group"
+title = "Workspace Settings"
+type = "group"
+
+# SERVER CONFIGURATION
+# HTTP server settings (host, port, workers, connections)
+[[items]]
+description = "Configure HTTP server for Control Center"
+includes = ["fragments/server-section.toml"]
+name = "server_group"
+title = "Server Settings"
+type = "group"
+
+# DATABASE BACKEND CONFIGURATION
+# Conditional sections based on selected backend
+[[items]]
+condition = "database_backend_selection == 'rocksdb'"
+description = "Configure RocksDB backend for policy storage"
+includes = ["fragments/database-rocksdb-section.toml"]
+name = "database_rocksdb_group"
+title = "RocksDB Configuration"
+type = "group"
+
+[[items]]
+condition = "database_backend_selection == 'surrealdb_embedded' || database_backend_selection == 'surrealdb_server'"
+description = "Configure SurrealDB backend for policy storage"
+includes = ["fragments/database-surrealdb-section.toml"]
+name = "database_surrealdb_group"
+title = "SurrealDB Configuration"
+type = "group"
+
+[[items]]
+condition = "database_backend_selection == 'postgresql'"
+description = "Configure PostgreSQL backend for policy storage"
+includes = ["fragments/database-postgres-section.toml"]
+name = "database_postgres_group"
+title = "PostgreSQL Configuration"
+type = "group"
+
+# CONTROL CENTER-SPECIFIC: SECURITY CONFIGURATION
+# JWT, RBAC, MFA, rate limiting, TLS, sessions
+[[items]]
+description = "Configure authentication, authorization, and security settings"
+includes = ["fragments/control-center/security-section.toml"]
+name = "security_group"
+title = "Security Configuration"
+type = "group"
+
+# CONTROL CENTER-SPECIFIC: POLICY CONFIGURATION
+# Policy caching, versioning, management
+[[items]]
+description = "Configure policy engine and policy management"
+includes = ["fragments/control-center/policy-section.toml"]
+name = "policy_group"
+title = "Policy Configuration"
+type = "group"
+
+# CONTROL CENTER-SPECIFIC: USER MANAGEMENT CONFIGURATION
+# User registration, sessions, audit logging
+[[items]]
+description = "Configure user registration, sessions, and audit"
+includes = ["fragments/control-center/users-section.toml"]
+name = "users_group"
+title = "User Management Configuration"
+type = "group"
+
+# CONTROL CENTER-SPECIFIC: COMPLIANCE & AUDIT CONFIGURATION
+# Audit logging, compliance frameworks, data retention, encryption
+[[items]]
+description = "Configure audit logging, compliance, and data retention"
+includes = ["fragments/control-center/compliance-section.toml"]
+name = "compliance_group"
+title = "Compliance & Audit Configuration"
+type = "group"
+
+# MONITORING CONFIGURATION
+# Metrics collection, health checks
+[[items]]
+description = "Configure metrics and health checks"
+includes = ["fragments/monitoring-section.toml"]
+name = "monitoring_group"
+title = "Monitoring Configuration"
+type = "group"
+
+# LOGGING CONFIGURATION
+# Log levels, formats, rotation
+[[items]]
+description = "Configure logging behavior and output"
+includes = ["fragments/logging-section.toml"]
+name = "logging_group"
+title = "Logging Configuration"
+type = "group"

.typedialog/platform/forms/extension-registry-form.toml

@@ -0,0 +1,36 @@
+[form]
+description = "Multi-instance extension distribution via Git sources (Gitea, Forgejo, GitHub) and OCI registries"
+name = "Extension Registry Configuration"
+version = "2.0"
+
+[[sections]]
+description = "Network and performance settings"
+includes = ["fragments/extension-registry/server.toml"]
+name = "Server Configuration"
+
+[[sections]]
+description = "Configure Gitea, Forgejo, and GitHub as extension sources"
+includes = [
+  "fragments/extension-registry/gitea-multi.toml",
+  "fragments/extension-registry/forgejo-multi.toml",
+  "fragments/extension-registry/github-multi.toml",
+]
+name = "Git Sources"
+
+[[sections]]
+description = "Configure OCI registries for distribution (Zot, Harbor, Docker Hub, GHCR, Quay)"
+includes = ["fragments/extension-registry/oci-multi.toml"]
+name = "OCI Registries"
+
+[[sections]]
+description = "Cache configuration and TTL settings"
+includes = ["fragments/extension-registry/cache.toml"]
+name = "Caching"
+
+[[sections]]
+description = "Single-instance configuration (automatically migrated to multi-instance format)"
+includes = [
+  "fragments/extension-registry/gitea-legacy.toml",
+  "fragments/extension-registry/oci-legacy.toml",
+]
+name = "Legacy Configuration"

.typedialog/platform/forms/fragments/README.md

@@ -0,0 +1,334 @@
+# Fragments
+
+Reusable form fragments organized FLAT in this directory (not nested subdirectories).
+
+## Purpose
+
+Fragments provide:
+- **Reusable sections** - Used by multiple forms
+- **Modularity** - Change once, applies to all forms using it
+- **Organization** - Named by purpose (workspace, server, queue, etc.)
+- **DRY principle** - Don't repeat configuration sections
+
+## Fragment Organization
+
+**CRITICAL**: All fragments are stored at the SAME LEVEL (flat directory).
+
+```toml
+fragments/
+├── workspace-section.toml              # Workspace configuration
+├── server-section.toml                 # HTTP server settings
+├── database-rocksdb-section.toml       # RocksDB database
+├── database-surrealdb-section.toml     # SurrealDB database
+├── database-postgres-section.toml      # PostgreSQL database
+├── security-section.toml               # Auth, RBAC, encryption
+├── monitoring-section.toml             # Metrics, health checks
+├── logging-section.toml                # Log configuration
+├── orchestrator-queue-section.toml     # Orchestrator queue config
+├── orchestrator-workflow-section.toml  # Orchestrator batch workflow
+├── orchestrator-storage-section.toml   # Orchestrator storage backend
+├── control-center-jwt-section.toml     # Control Center JWT
+├── control-center-rbac-section.toml    # Control Center RBAC
+├── control-center-compliance-section.toml
+├── mcp-capabilities-section.toml       # MCP capabilities
+├── mcp-tools-section.toml              # MCP tools configuration
+├── mcp-resources-section.toml          # MCP resource limits
+├── deployment-mode-section.toml        # Deployment mode selection
+├── resources-section.toml              # Resource allocation (CPU, RAM, disk)
+└── README.md                           # This file
+```
+
+Referenced in forms as:
+```toml
+[[items]]
+name = "workspace_group"
+type = "group"
+includes = ["fragments/workspace-section.toml"]  # Flat reference
+
+[[items]]
+name = "queue_group"
+type = "group"
+includes = ["fragments/orchestrator-queue-section.toml"]  # Same level
+```
+
+## Fragment Categories
+
+### Common Fragments (Used by Multiple Services)
+
+- **workspace-section.toml** - Workspace name, path, enable/disable
+- **server-section.toml** - HTTP server host, port, workers, keep-alive
+- **database-rocksdb-section.toml** - RocksDB path (filesystem-backed)
+- **database-surrealdb-section.toml** - SurrealDB embedded (no external service)
+- **database-postgres-section.toml** - PostgreSQL server connection
+- **security-section.toml** - JWT issuer, RBAC, encryption keys
+- **monitoring-section.toml** - Metrics interval, health checks
+- **logging-section.toml** - Log level, format, rotation
+- **resources-section.toml** - CPU cores, memory, disk allocation
+- **deployment-mode-section.toml** - Solo/MultiUser/CI/CD/Enterprise selection
+
+### Service-Specific Fragments
+
+**Orchestrator** (workflow engine):
+- **orchestrator-queue-section.toml** - Max concurrent tasks, retries, timeout
+- **orchestrator-workflow-section.toml** - Batch workflow settings, parallelism
+- **orchestrator-storage-section.toml** - Storage backend selection
+
+**Control Center** (policy/RBAC):
+- **control-center-jwt-section.toml** - JWT issuer, audience, token expiration
+- **control-center-rbac-section.toml** - Roles, permissions, policies
+- **control-center-compliance-section.toml** - SOC2, HIPAA, audit logging
+
+**MCP Server** (protocol):
+- **mcp-capabilities-section.toml** - Tools, prompts, resources, sampling
+- **mcp-tools-section.toml** - Tool timeout, max concurrent, categories
+- **mcp-resources-section.toml** - Max size, caching, TTL
+
+## Fragment Structure
+
+Each fragment is a TOML file containing `[[elements]]` definitions:
+
+```toml
+# fragments/workspace-section.toml
+
+[[elements]]
+border_top = true
+border_bottom = true
+name = "workspace_header"
+title = "🗂️ Workspace Configuration"
+type = "section_header"
+
+[[elements]]
+name = "workspace_name"
+type = "text"
+prompt = "Workspace Name"
+default = "default"
+required = true
+help = "Name of the workspace this service will serve"
+nickel_path = ["orchestrator", "workspace", "name"]
+
+[[elements]]
+name = "workspace_path"
+type = "text"
+prompt = "Workspace Path"
+default = "/var/lib/provisioning/orchestrator"
+required = true
+help = "Absolute path to the workspace directory"
+nickel_path = ["orchestrator", "workspace", "path"]
+
+[[elements]]
+name = "workspace_enabled"
+type = "confirm"
+prompt = "Enable Workspace?"
+default = true
+help = "Enable or disable this workspace"
+nickel_path = ["orchestrator", "workspace", "enabled"]
+```
+
+## Fragment Composition
+
+Fragments are included in main forms:
+
+```toml
+# forms/orchestrator-form.toml
+
+name = "orchestrator_configuration"
+description = "Interactive configuration for Orchestrator"
+
+# Include fragments in order
+
+[[items]]
+name = "deployment_group"
+type = "group"
+includes = ["fragments/deployment-mode-section.toml"]
+
+[[items]]
+name = "workspace_group"
+type = "group"
+includes = ["fragments/workspace-section.toml"]
+
+[[items]]
+name = "server_group"
+type = "group"
+includes = ["fragments/server-section.toml"]
+
+[[items]]
+name = "storage_group"
+type = "group"
+includes = ["fragments/orchestrator-storage-section.toml"]
+
+[[items]]
+name = "queue_group"
+type = "group"
+includes = ["fragments/orchestrator-queue-section.toml"]
+
+# Optional sections
+[[items]]
+name = "monitoring_group"
+type = "group"
+when = "enable_monitoring == true"
+includes = ["fragments/monitoring-section.toml"]
+```
+
+## Element Requirements
+
+Every element in a fragment MUST include:
+
+1. **name** - Unique identifier (used in form data)
+2. **type** - Element type (text, number, confirm, select, etc.)
+3. **prompt** - User-facing label
+4. **nickel_path** - Mapping to Nickel structure (**CRITICAL**)
+
+Example:
+```toml
+[[elements]]
+name = "max_concurrent_tasks"          # Unique identifier
+type = "number"                        # Type
+prompt = "Maximum Concurrent Tasks"    # User label
+nickel_path = ["orchestrator", "queue", "max_concurrent_tasks"]  # Nickel mapping
+```
+
+## Constraint Interpolation
+
+Fragments reference constraints dynamically:
+
+```toml
+[[elements]]
+name = "max_concurrent_tasks"
+type = "number"
+prompt = "Maximum Concurrent Tasks"
+min = "${constraint.orchestrator.queue.concurrent_tasks.min}"  # Dynamic
+max = "${constraint.orchestrator.queue.concurrent_tasks.max}"  # Dynamic
+nickel_path = ["orchestrator", "queue", "max_concurrent_tasks"]
+```
+
+The `${constraint.path.to.value}` syntax references `constraints/constraints.toml`.
+
+## Common Fragment Patterns
+
+### Workspace Fragment Pattern
+```toml
+[[elements]]
+name = "workspace_name"
+type = "text"
+prompt = "Workspace Name"
+nickel_path = ["orchestrator", "workspace", "name"]
+
+[[elements]]
+name = "workspace_path"
+type = "text"
+prompt = "Workspace Path"
+nickel_path = ["orchestrator", "workspace", "path"]
+
+[[elements]]
+name = "workspace_enabled"
+type = "confirm"
+prompt = "Enable Workspace?"
+nickel_path = ["orchestrator", "workspace", "enabled"]
+```
+
+### Server Fragment Pattern
+```toml
+[[elements]]
+name = "server_host"
+type = "text"
+prompt = "Server Host"
+default = "127.0.0.1"
+nickel_path = ["orchestrator", "server", "host"]
+
+[[elements]]
+name = "server_port"
+type = "number"
+prompt = "Server Port"
+min = "${constraint.common.server.port.min}"
+max = "${constraint.common.server.port.max}"
+nickel_path = ["orchestrator", "server", "port"]
+
+[[elements]]
+name = "server_workers"
+type = "number"
+prompt = "Worker Threads"
+min = 1
+max = 32
+nickel_path = ["orchestrator", "server", "workers"]
+```
+
+### Database Selection Pattern
+```toml
+[[elements]]
+name = "storage_backend"
+type = "select"
+prompt = "Storage Backend"
+options = [
+  { value = "filesystem", label = "📁 Filesystem" },
+  { value = "rocksdb", label = "🗄️ RocksDB (Embedded)" },
+  { value = "surrealdb", label = "📊 SurrealDB" },
+  { value = "postgres", label = "🐘 PostgreSQL" },
+]
+nickel_path = ["orchestrator", "storage", "backend"]
+
+[[elements]]
+name = "rocksdb_group"
+type = "group"
+when = "storage_backend == 'rocksdb'"
+includes = ["fragments/database-rocksdb-section.toml"]
+
+[[elements]]
+name = "postgres_group"
+type = "group"
+when = "storage_backend == 'postgres'"
+includes = ["fragments/database-postgres-section.toml"]
+
+[[elements]]
+name = "surrealdb_group"
+type = "group"
+when = "storage_backend == 'surrealdb'"
+includes = ["fragments/database-surrealdb-section.toml"]
+```
+
+## Best Practices
+
+1. **Clear naming** - Fragment name describes its purpose (queue-section, not qs)
+2. **Meaningful headers** - Each fragment starts with a section header (name, title, emoji)
+3. **Constraint interpolation** - Use `${constraint.*}` for dynamic validation
+4. **Consistent nickel_path** - Paths match actual Nickel structure
+5. **Provide defaults** - Sensible defaults improve UX
+6. **Help text** - Explain each field clearly
+7. **Group logically** - Related fields in same fragment
+8. **Test with form** - Verify fragment loads correctly in form
+
+## Adding a New Fragment
+
+1. **Create fragment file** in `forms/fragments/{name}-section.toml`
+2. **Add section header** (name, title, emoji)
+3. **Add form elements**:
+   - Include `name`, `type`, `prompt`
+   - Add `nickel_path` (CRITICAL)
+   - Add constraints if applicable
+   - Add `help` and `default` if appropriate
+4. **Include in form** - Add to main form via `includes` field
+5. **Test** - Run configuration wizard to verify fragment loads
+
+## Fragment Naming Convention
+
+- **Section fragments**: `{topic}-section.toml` (workspace-section.toml)
+- **Service-specific**: `{service}-{topic}-section.toml` (orchestrator-queue-section.toml)
+- **Database-specific**: `database-{backend}-section.toml` (database-postgres-section.toml)
+- **Deployment-specific**: `{mode}-{topic}-section.toml` (enterprise-options-section.toml)
+
+## Testing Fragments
+
+```toml
+# Validate form that uses fragment
+nu provisioning/.typedialog/provisioning/platform/scripts/configure.nu orchestrator solo --backend web
+
+# Verify constraint interpolation works
+grep "constraint\." forms/fragments/*.toml
+
+# Check nickel_path consistency
+grep "nickel_path" forms/fragments/*.toml | sort
+```
+
+---
+
+**Version**: 1.0.0
+**Last Updated**: 2025-01-05

.typedialog/platform/forms/fragments/ai-service/dag.toml

@@ -0,0 +1,44 @@
+name = "dag"
+description = "AI Service DAG Workflow Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "ai_dag_header"
+title = "🔀 DAG Workflow Configuration"
+type = "section_header"
+
+[[elements]]
+default = 10
+help = "Max concurrent DAG tasks"
+max = 100
+min = 1
+name = "ai_dag_max_concurrent_tasks"
+nickel_path = ["ai_service", "dag", "max_concurrent_tasks"]
+prompt = "Max Concurrent Tasks"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 600000
+help = "Task timeout in milliseconds"
+max = 3600000
+min = 10000
+name = "ai_dag_task_timeout"
+nickel_path = ["ai_service", "dag", "task_timeout"]
+prompt = "Task Timeout (ms)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 5
+help = "Retry attempts for failed tasks"
+max = 10
+min = 0
+name = "ai_dag_retry_attempts"
+nickel_path = ["ai_service", "dag", "retry_attempts"]
+prompt = "Retry Attempts"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/ai-service/mcp-integration.toml

@@ -0,0 +1,41 @@
+name = "mcp_integration"
+description = "AI Service MCP Integration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "ai_mcp_header"
+title = "🔧 MCP Integration"
+type = "section_header"
+
+[[elements]]
+default = false
+help = "Enable MCP (Model Context Protocol) integration"
+name = "ai_mcp_enabled"
+nickel_path = ["ai_service", "mcp", "enabled"]
+prompt = "Enable MCP"
+type = "confirm"
+
+[[elements]]
+condition = "ai_mcp_enabled == true"
+default = "http://localhost:8084"
+help = "MCP service URL"
+name = "ai_mcp_service_url"
+nickel_path = ["ai_service", "mcp", "mcp_service_url"]
+prompt = "MCP Service URL"
+required = true
+type = "text"
+
+[[elements]]
+condition = "ai_mcp_enabled == true"
+default = 30000
+help = "MCP request timeout in milliseconds"
+max = 300000
+min = 1000
+name = "ai_mcp_timeout"
+nickel_path = ["ai_service", "mcp", "timeout"]
+prompt = "Timeout (ms)"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/ai-service/monitoring.toml

@@ -0,0 +1,31 @@
+name = "monitoring"
+description = "AI Service Monitoring Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "ai_monitoring_header"
+title = "📊 Monitoring Configuration"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Enable monitoring and metrics"
+name = "ai_monitoring_enabled"
+nickel_path = ["ai_service", "monitoring", "enabled"]
+prompt = "Enable Monitoring"
+type = "confirm"
+
+[[elements]]
+condition = "ai_monitoring_enabled == true"
+default = 60000
+help = "Metrics collection interval in milliseconds"
+max = 300000
+min = 5000
+name = "ai_monitoring_metrics_interval"
+nickel_path = ["ai_service", "monitoring", "metrics_interval"]
+prompt = "Metrics Interval (ms)"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/ai-service/rag-integration.toml

@@ -0,0 +1,41 @@
+name = "rag_integration"
+description = "AI Service RAG Integration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "ai_rag_header"
+title = "🧠 RAG Integration"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Enable RAG integration"
+name = "ai_rag_enabled"
+nickel_path = ["ai_service", "rag", "enabled"]
+prompt = "Enable RAG"
+type = "confirm"
+
+[[elements]]
+condition = "ai_rag_enabled == true"
+default = "http://localhost:8083"
+help = "RAG service URL"
+name = "ai_rag_service_url"
+nickel_path = ["ai_service", "rag", "rag_service_url"]
+prompt = "RAG Service URL"
+required = true
+type = "text"
+
+[[elements]]
+condition = "ai_rag_enabled == true"
+default = 30000
+help = "RAG request timeout in milliseconds"
+max = 300000
+min = 1000
+name = "ai_rag_timeout"
+nickel_path = ["ai_service", "rag", "timeout"]
+prompt = "Timeout (ms)"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/ai-service/server.toml

@@ -0,0 +1,44 @@
+name = "server"
+description = "AI Service Server Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "ai_service_server_header"
+title = "🖥️ Server Configuration"
+type = "section_header"
+
+[[elements]]
+default = "0.0.0.0"
+help = "HTTP server bind address"
+name = "ai_service_server_host"
+nickel_path = ["ai_service", "server", "host"]
+prompt = "Server Host"
+required = true
+type = "text"
+
+[[elements]]
+default = 8082
+help = "HTTP server port (range: 1024-65535)"
+max = 65535
+min = 1024
+name = "ai_service_server_port"
+nickel_path = ["ai_service", "server", "port"]
+prompt = "Server Port"
+required = true
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 4
+help = "Number of HTTP worker threads"
+max = 32
+min = 1
+name = "ai_service_server_workers"
+nickel_path = ["ai_service", "server", "workers"]
+prompt = "Worker Threads"
+required = true
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/constraint_interpolation_guide.md

@@ -0,0 +1,226 @@
+# Constraint Interpolation Guide
+
+## Overview
+
+TypeDialog form fields can reference constraints from `constraints.toml` using Jinja2-style template syntax.
+This provides a **single source of truth** for validation limits across forms, Nickel schemas, and validators.
+
+## Pattern
+
+All numeric form fields should use constraint interpolation for `min` and `max` values:
+
+```toml
+[[elements]]
+name = "field_name"
+type = "number"
+default = 5
+help = "Field description (range: ${constraint.path.to.constraint.min}-${constraint.path.to.constraint.max})"
+min = "${constraint.path.to.constraint.min}"
+max = "${constraint.path.to.constraint.max}"
+nickel_path = ["path", "to", "field"]
+prompt = "Field Label"
+```
+
+## Benefits
+
+1. **Single Source of Truth**: Constraints defined once in `constraints.toml`, used everywhere
+2. **Dynamic Validation**: If constraint changes, all forms automatically get updated ranges
+3. **User-Friendly**: Forms show actual valid ranges in help text
+4. **Type Safety**: Constraints match Nickel schema contract ranges
+
+## Complete Constraint Mapping
+
+### Orchestrator Fragments
+
+| Fragment | Field | Constraint Path | Min | Max |
+| ---------- | ------- | ----------------- | ----- | ----- |
+| `queue-section.toml` | `queue_max_concurrent_tasks` | `orchestrator.queue.concurrent_tasks` | 1 | 100 |
+| `queue-section.toml` | `queue_retry_attempts` | `orchestrator.queue.retry_attempts` | 0 | 10 |
+| `queue-section.toml` | `queue_retry_delay` | `orchestrator.queue.retry_delay` | 1000 | 60000 |
+| `queue-section.toml` | `queue_task_timeout` | `orchestrator.queue.task_timeout` | 60000 | 86400000 |
+| `batch-section.toml` | `batch_parallel_limit` | `orchestrator.batch.parallel_limit` | 1 | 50 |
+| `batch-section.toml` | `batch_operation_timeout` | `orchestrator.batch.operation_timeout` | 60000 | 3600000 |
+| `extensions-section.toml` | `extensions_max_concurrent` | `orchestrator.extensions.max_concurrent` | 1 | 20 |
+| `extensions-section.toml` | `extensions_discovery_interval` | Not in constraints (use reasonable bounds) | 300 | 86400 |
+| `extensions-section.toml` | `extensions_init_timeout` | Not in constraints (use reasonable bounds) | 1000 | 300000 |
+| `extensions-section.toml` | `extensions_sandbox_max_memory_mb` | Not in constraints (use reasonable bounds) | 64 | 4096 |
+| `performance-section.toml` | `memory_max_heap_mb` | Not in constraints (use mode-based bounds) | 256 | 131072 |
+| `performance-section.toml` | `profiling_sample_rate` | Not in constraints (use reasonable bounds) | 10 | 1000 |
+| `storage-section.toml` | `storage_cache_ttl` | Not in constraints (use 60-3600) | 60 | 3600 |
+| `storage-section.toml` | `storage_cache_max_entries` | Not in constraints (use 10-100000) | 10 | 100000 |
+| `storage-section.toml` | `storage_compression_level` | Not in constraints (zstd: 1-19) | 1 | 19 |
+| `storage-section.toml` | `storage_gc_retention` | Not in constraints (use 3600-31536000) | 3600 | 31536000 |
+| `storage-section.toml` | `storage_gc_interval` | Not in constraints (use 300-86400) | 300 | 86400 |
+
+### Control Center Fragments
+
+| Fragment | Field | Constraint Path | Min | Max |
+| ---------- | ------- | ----------------- | ----- | ----- |
+| `security-section.toml` | `jwt_token_expiration` | `control_center.jwt.token_expiration` | 300 | 604800 |
+| `security-section.toml` | `jwt_refresh_expiration` | `control_center.jwt.refresh_expiration` | 3600 | 2592000 |
+| `security-section.toml` | `rate_limiting_max_requests` | `control_center.rate_limiting.max_requests` | 10 | 10000 |
+| `security-section.toml` | `rate_limiting_window` | `control_center.rate_limiting.window_seconds` | 1 | 3600 |
+| `security-section.toml` | `users_sessions_max_active` | Not in constraints (use 1-100) | 1 | 100 |
+| `security-section.toml` | `users_sessions_idle_timeout` | Not in constraints (use 300-86400) | 300 | 86400 |
+| `security-section.toml` | `users_sessions_absolute_timeout` | Not in constraints (use 3600-2592000) | 3600 | 2592000 |
+| `policy-section.toml` | `policy_cache_ttl` | Not in constraints (use 60-86400) | 60 | 86400 |
+| `policy-section.toml` | `policy_cache_max_policies` | Not in constraints (use 100-10000) | 100 | 10000 |
+| `policy-section.toml` | `policy_versioning_max_versions` | Not in constraints (use 1-100) | 1 | 100 |
+| `users-section.toml` | `users_registration_auto_role` | Not in constraints (select field, not numeric) | - | - |
+| `users-section.toml` | `users_sessions_max_active` | Not in constraints (use 1-100) | 1 | 100 |
+| `users-section.toml` | `users_sessions_idle_timeout` | Not in constraints (use 300-86400) | 300 | 86400 |
+| `users-section.toml` | `users_sessions_absolute_timeout` | Not in constraints (use 3600-2592000) | 3600 | 2592000 |
+| `compliance-section.toml` | `audit_retention_days` | `control_center.audit.retention_days` | 1 | 3650 |
+| `compliance-section.toml` | `compliance_validation_interval` | Not in constraints (use 1-168 hours) | 1 | 168 |
+| `compliance-section.toml` | `compliance_data_retention_years` | Not in constraints (use 1-30) | 1 | 30 |
+| `compliance-section.toml` | `compliance_audit_log_days` | Not in constraints (use 90-10950) | 90 | 10950 |
+
+### MCP Server Fragments
+
+| Fragment | Field | Constraint Path | Min | Max |
+| ---------- | ------- | ----------------- | ----- | ----- |
+| `tools-section.toml` | `tools_max_concurrent` | `mcp_server.tools.max_concurrent` | 1 | 20 |
+| `tools-section.toml` | `tools_timeout` | `mcp_server.tools.timeout` | 5000 | 600000 |
+| `prompts-section.toml` | `prompts_max_templates` | `mcp_server.prompts.max_templates` | 1 | 100 |
+| `prompts-section.toml` | `prompts_cache_ttl` | Not in constraints (use 60-86400) | 60 | 86400 |
+| `prompts-section.toml` | `prompts_versioning_max_versions` | Not in constraints (use 1-100) | 1 | 100 |
+| `resources-section.toml` | `resources_max_size` | `mcp_server.resources.max_size` | 1048576 | 1073741824 |
+| `resources-section.toml` | `resources_cache_max_size_mb` | Not in constraints (use 10-10240) | 10 | 10240 |
+| `resources-section.toml` | `resources_cache_ttl` | `mcp_server.resources.cache_ttl` | 60 | 3600 |
+| `resources-section.toml` | `resources_validation_max_depth` | Not in constraints (use 1-100) | 1 | 100 |
+| `sampling-section.toml` | `sampling_max_tokens` | `mcp_server.sampling.max_tokens` | 100 | 100000 |
+| `sampling-section.toml` | `sampling_temperature` | Not in constraints (use 0.0-2.0) | 0.0 | 2.0 |
+| `sampling-section.toml` | `sampling_cache_ttl` | Not in constraints (use 60-3600) | 60 | 3600 |
+
+### Common/Shared Fragments
+
+| Fragment | Field | Constraint Path | Min | Max |
+| ---------- | ------- | ----------------- | ----- | ----- |
+| `server-section.toml` | `server_port` | `common.server.port` | 1024 | 65535 |
+| `server-section.toml` | `server_workers` | `common.server.workers` | 1 | 32 |
+| `server-section.toml` | `server_max_connections` | `common.server.max_connections` | 10 | 10000 |
+| `server-section.toml` | `server_keep_alive` | `common.server.keep_alive` | 0 | 600 |
+| `monitoring-section.toml` | `monitoring_metrics_interval` | `common.monitoring.metrics_interval` | 10 | 300 |
+| `monitoring-section.toml` | `monitoring_health_check_interval` | `common.monitoring.health_check_interval` | 5 | 300 |
+| `logging-section.toml` | `logging_max_file_size` | `common.logging.max_file_size` | 1048576 | 1073741824 |
+| `logging-section.toml` | `logging_max_backups` | `common.logging.max_backups` | 1 | 100 |
+| `database-rocksdb-section.toml` | `database_pool_size` | Not in constraints (use 1-100) | 1 | 100 |
+| `database-rocksdb-section.toml` | `database_timeout` | Not in constraints (use 10-3600) | 10 | 3600 |
+| `database-rocksdb-section.toml` | `database_retry_attempts` | Not in constraints (use 0-10) | 0 | 10 |
+| `database-rocksdb-section.toml` | `database_retry_delay` | Not in constraints (use 1000-60000) | 1000 | 60000 |
+| `database-surrealdb-section.toml` | `pool_size` | Not in constraints (use 1-200) | 1 | 200 |
+| `database-surrealdb-section.toml` | `timeout` | Not in constraints (use 10-3600) | 10 | 3600 |
+| `database-postgres-section.toml` | `postgres_port` | Not in constraints (use 1024-65535) | 1024 | 65535 |
+| `database-postgres-section.toml` | `postgres_pool_size` | Not in constraints (use 5-200) | 5 | 200 |
+
+### Installer Fragments
+
+| Fragment | Field | Constraint Path | Min | Max |
+| ---------- | ------- | ----------------- | ----- | ----- |
+| `target-section.toml` | `remote_ssh_port` | `common.server.port` | 1024 | 65535 |
+| `preflight-section.toml` | `min_disk_gb` | `deployment.solo.disk_gb.min` (mode-dependent) | Variable | Variable |
+| `preflight-section.toml` | `min_memory_gb` | `deployment.solo.memory_mb.min` (mode-dependent) | Variable | Variable |
+| `preflight-section.toml` | `min_cpu_cores` | `deployment.solo.cpu.min` (mode-dependent) | Variable | Variable |
+| `installation-section.toml` | `parallel_services` | Not in constraints (use 1-10) | 1 | 10 |
+| `installation-section.toml` | `installation_timeout_seconds` | Not in constraints (use 0-14400) | 0 | 14400 |
+| `installation-section.toml` | `log_level` | Not in constraints (select field, not numeric) | - | - |
+| `installation-section.toml` | `validation_timeout` | Not in constraints (use 5000-300000) | 5000 | 300000 |
+| `services-section.toml` | `orchestrator_port` | `common.server.port` | 1024 | 65535 |
+| `services-section.toml` | `control_center_port` | `common.server.port` | 1024 | 65535 |
+| `services-section.toml` | `mcp_server_port` | `common.server.port` | 1024 | 65535 |
+| `services-section.toml` | `api_gateway_port` | `common.server.port` | 1024 | 65535 |
+| `database-section.toml` | `connection_pool_size` | Not in constraints (use 1-100) | 1 | 100 |
+| `database-section.toml` | `connection_pool_timeout` | Not in constraints (use 10-3600) | 10 | 3600 |
+| `database-section.toml` | `connection_idle_timeout` | Not in constraints (use 60-14400) | 60 | 14400 |
+| `storage-section.toml` | `storage_size_gb` | Not in constraints (use 10-100000) | 10 | 100000 |
+| `storage-section.toml` | `storage_replication_factor` | Not in constraints (use 2-10) | 2 | 10 |
+| `networking-section.toml` | `load_balancer_http_port` | `common.server.port` | 1024 | 65535 |
+| `networking-section.toml` | `load_balancer_https_port` | `common.server.port` | 1024 | 65535 |
+| `ha-section.toml` | `ha_cluster_size` | Not in constraints (use 3-256) | 3 | 256 |
+| `ha-section.toml` | `ha_db_quorum_size` | Not in constraints (use 1-max_cluster_size) | 1 | 256 |
+| `ha-section.toml` | `ha_health_check_interval` | Not in constraints (use 1-120) | 1 | 120 |
+| `ha-section.toml` | `ha_health_check_failure_threshold` | Not in constraints (use 1-10) | 1 | 10 |
+| `ha-section.toml` | `ha_failover_delay` | Not in constraints (use 0-600) | 0 | 600 |
+| `upgrades-section.toml` | `rolling_upgrade_parallel` | Not in constraints (use 1-10) | 1 | 10 |
+| `upgrades-section.toml` | `canary_percentage` | Not in constraints (use 1-50) | 1 | 50 |
+| `upgrades-section.toml` | `canary_duration_seconds` | Not in constraints (use 30-3600) | 30 | 3600 |
+
+## Fragments Status
+
+### ✅ Completed (Constraints Interpolated)
+- `server-section.toml` - All numeric fields updated
+- `monitoring-section.toml` - Core metrics interval updated
+- `orchestrator/queue-section.toml` - All queue fields updated
+- `orchestrator/batch-section.toml` - Parallel limit and operation timeout updated
+- `mcp-server/tools-section.toml` - Tools concurrency and timeout updated
+
+### ⏳ Remaining (Need Updates)
+- All other orchestrator fragments (extensions, performance, storage)
+- All control-center fragments (security, policy, users, compliance)
+- Remaining MCP fragments (prompts, resources, sampling)
+- All installer fragments (target, preflight, installation, services, database, storage, networking, ha, upgrades)
+- All database fragments (rocksdb, surrealdb, postgres)
+- logging-section.toml
+
+## How to Add Constraints to a Fragment
+
+1. **Identify numeric fields** with `type = "number"` that have `min` and/or `max` values
+2. **Find the constraint path** in the mapping table above
+3. **Update the field** with constraint references:
+
+```toml
+# Before
+[[elements]]
+default = 5
+min = 1
+max = 100
+name = "my_field"
+type = "number"
+
+# After
+[[elements]]
+default = 5
+help = "Field description (range: ${constraint.path.to.field.min}-${constraint.path.to.field.max})"
+min = "${constraint.path.to.field.min}"
+max = "${constraint.path.to.field.max}"
+name = "my_field"
+type = "number"
+```
+
+4. **For fields without existing constraints**, add reasonable bounds based on the domain:
+   - Timeouts: typically 1 second to 1 hour (1000-3600000 ms)
+   - Counters: typically 1-100 or 1-1000
+   - Memory: use deployment mode constraints (64MB-256GB)
+   - Ports: use `common.server.port` (1024-65535)
+
+5. **Test** that the constraint is accessible in `constraints.toml`
+
+## Example: Adding Constraint to a New Field
+
+```toml
+[[elements]]
+default = 3600
+help = "Cache timeout in seconds (range: ${constraint.common.monitoring.health_check_interval.min}-${constraint.common.monitoring.health_check_interval.max})"
+min = "${constraint.common.monitoring.health_check_interval.min}"
+max = "${constraint.common.monitoring.health_check_interval.max}"
+name = "cache_timeout_seconds"
+nickel_path = ["cache", "timeout_seconds"]
+prompt = "Cache Timeout (seconds)"
+type = "number"
+```
+
+## Integration with TypeDialog
+
+When TypeDialog processes forms:
+
+1. **Load time**: Constraint references are resolved from `constraints.toml`
+2. **Validation**: User input is validated against resolved min/max values
+3. **Help text**: Ranges are shown to user in help messages
+4. **Nickel generation**: Jinja2 templates receive validated values
+
+## See Also
+
+- `provisioning/.typedialog/provisioning/platform/constraints/constraints.toml` - Constraint definitions
+- `constraint_update_status.md` - Progress tracking for constraint interpolation updates
+- `provisioning/.typedialog/provisioning/platform/templates/*.j2` - Jinja2 templates for code generation
+- `provisioning/schemas/` - Nickel schemas (use same ranges as constraints)

.typedialog/platform/forms/fragments/constraint_update_status.md

@@ -0,0 +1,301 @@
+# Constraint Interpolation Update Status
+
+**Date**: 2025-01-05
+**Status**: Phase 1.5 - COMPLETE ✅ All Constraint Interpolation Finished
+**Progress**: 33 / 33 fragments updated (100%)
+
+## Summary
+
+Constraint interpolation has been implemented for critical numeric form fields, providing a single
+source of truth for validation limits. The comprehensive mapping guide documents which constraints
+should be applied to remaining fragments.
+
+## Completed Fragments ✅
+
+### Common/Shared Fragments
+- ✅ **server-section.toml** (100%)
+  - server_port → `common.server.port`
+  - server_workers → `common.server.workers`
+  - server_max_connections → `common.server.max_connections`
+  - server_keep_alive → `common.server.keep_alive`
+
+- ✅ **monitoring-section.toml** (1 of 1 critical field)
+  - monitoring_metrics_interval → `common.monitoring.metrics_interval`
+
+### Orchestrator Fragments
+- ✅ **orchestrator/queue-section.toml** (100%)
+  - queue_max_concurrent_tasks → `orchestrator.queue.concurrent_tasks`
+  - queue_retry_attempts → `orchestrator.queue.retry_attempts`
+  - queue_retry_delay → `orchestrator.queue.retry_delay`
+  - queue_task_timeout → `orchestrator.queue.task_timeout`
+
+- ✅ **orchestrator/batch-section.toml** (2 of 2 critical fields)
+  - batch_parallel_limit → `orchestrator.batch.parallel_limit`
+  - batch_operation_timeout → `orchestrator.batch.operation_timeout`
+
+### MCP Server Fragments
+- ✅ **mcp-server/tools-section.toml** (100%)
+  - tools_max_concurrent → `mcp_server.tools.max_concurrent`
+  - tools_timeout → `mcp_server.tools.timeout`
+
+- ✅ **mcp-server/prompts-section.toml** (100%)
+  - prompts_max_templates → `mcp_server.prompts.max_templates`
+  - prompts_cache_ttl → reasonable bounds (60-86400)
+  - prompts_versioning_max_versions → reasonable bounds (1-100)
+
+- ✅ **mcp-server/resources-section.toml** (100%)
+  - resources_max_size → `mcp_server.resources.max_size`
+  - resources_cache_ttl → `mcp_server.resources.cache_ttl`
+  - resources_cache_max_size_mb → reasonable bounds (10-10240)
+  - resources_validation_max_depth → reasonable bounds (1-100)
+
+- ✅ **mcp-server/sampling-section.toml** (100%)
+  - sampling_max_tokens → `mcp_server.sampling.max_tokens`
+  - sampling_cache_ttl → reasonable bounds (60-3600)
+
+### Control Center Fragments
+- ✅ **control-center/security-section.toml** (100%)
+  - jwt_token_expiration → `control_center.jwt.token_expiration`
+  - jwt_refresh_expiration → `control_center.jwt.refresh_expiration`
+  - rate_limiting_max_requests → `control_center.rate_limiting.max_requests`
+  - rate_limiting_window → `control_center.rate_limiting.window_seconds`
+
+- ✅ **control-center/compliance-section.toml** (100%)
+  - audit_retention_days → `control_center.audit.retention_days`
+  - compliance_validation_interval → reasonable bounds (1-168 hours)
+  - compliance_data_retention_years → reasonable bounds (1-30)
+  - compliance_audit_log_days → reasonable bounds (90-10950)
+
+### Shared/Common Fragments
+- ✅ **logging-section.toml** (100%)
+  - logging_max_file_size → `common.logging.max_file_size`
+  - logging_max_backups → `common.logging.max_backups`
+
+### Orchestrator Fragments
+- ✅ **orchestrator/extensions-section.toml** (100%)
+  - extensions_max_concurrent → `orchestrator.extensions.max_concurrent`
+  - extensions_discovery_interval → reasonable bounds (300-86400)
+  - extensions_init_timeout → reasonable bounds (1000-300000)
+  - extensions_health_check_interval → reasonable bounds (5000-300000)
+
+## All Fragments Completed ✅
+
+### Orchestrator Fragments (3/3 Complete)
+- [x] ✅ orchestrator/extensions-section.toml (100%)
+  - extensions_max_concurrent → `orchestrator.extensions.max_concurrent`
+  - extensions_discovery_interval, init_timeout, health_check_interval → reasonable bounds
+
+- [x] ✅ orchestrator/performance-section.toml (100% - TODAY)
+  - memory_initial_heap_mb → reasonable bounds (128-131072)
+  - profiling_memory_min_size_kb → reasonable bounds (1-1048576)
+  - inline_cache_max_entries → reasonable bounds (1000-1000000)
+  - inline_cache_ttl → reasonable bounds (60-86400)
+  - async_io_max_in_flight → reasonable bounds (256-1048576)
+
+- [x] ✅ orchestrator/storage-section.toml (100% - TODAY)
+  - storage_cache_ttl → reasonable bounds (60-86400)
+  - storage_cache_max_entries → reasonable bounds (10-1000000)
+  - storage_compression_level → already has max (1-19)
+  - storage_gc_retention → reasonable bounds (3600-31536000 / 1 hour-1 year)
+  - storage_gc_interval → reasonable bounds (300-86400)
+
+### Control Center Fragments (5/5 Complete)
+- [x] ✅ control-center/security-section.toml (100%)
+  - jwt_token_expiration → `control_center.jwt.token_expiration`
+  - rate_limiting_max_requests → `control_center.rate_limiting.max_requests`
+
+- [x] ✅ control-center/policy-section.toml (100% - TODAY)
+  - policy_cache_ttl → reasonable bounds (60-86400)
+  - policy_cache_max_policies → reasonable bounds (100-1000000)
+  - policy_versioning_max_versions → reasonable bounds (1-1000)
+
+- [x] ✅ control-center/users-section.toml (100% - TODAY)
+  - users_sessions_max_active → reasonable bounds (1-100)
+  - users_sessions_idle_timeout → reasonable bounds (300-86400)
+  - users_sessions_absolute_timeout → reasonable bounds (3600-604800 / 1 hour-1 week)
+
+- [x] ✅ control-center/compliance-section.toml (100%)
+  - audit_retention_days → `control_center.audit.retention_days`
+
+- [x] ✅ control-center/rbac-section.toml (100%)
+  - No numeric fields (confirm/select only)
+
+### MCP Server (3 fragments)
+- [x] ✅ mcp-server/prompts-section.toml
+
+- [x] ✅ mcp-server/resources-section.toml
+
+- [x] ✅ mcp-server/sampling-section.toml
+
+### Common Database Fragments (3 fragments)
+- [x] ✅ database-rocksdb-section.toml (100%)
+  - connection_pool_size → reasonable bounds (1-100)
+  - connection_pool_timeout → reasonable bounds (10-3600)
+  - connection_retry_attempts → reasonable bounds (0-10)
+  - connection_retry_delay → reasonable bounds (1000-60000)
+
+- [x] ✅ database-surrealdb-section.toml (100%)
+  - connection_pool_size → reasonable bounds (1-200)
+  - connection_pool_timeout → reasonable bounds (10-3600)
+  - connection_retry_attempts → reasonable bounds (0-10)
+  - connection_retry_delay → reasonable bounds (1000-60000)
+
+- [x] ✅ database-postgres-section.toml (100%)
+  - postgres_port → `common.server.port`
+  - postgres_pool_size → reasonable bounds (5-200)
+  - postgres_pool_timeout → reasonable bounds (10-3600)
+  - postgres_retry_attempts → reasonable bounds (0-10)
+  - postgres_retry_delay → reasonable bounds (1000-60000)
+
+### Other Shared Fragments (1 fragment)
+- [x] ✅ logging-section.toml
+
+### Installer Fragments (10 fragments) - ALL COMPLETE ✅
+
+- [x] ✅ installer/target-section.toml (100%)
+  - remote_ssh_port → `common.server.port`
+
+- [x] ✅ installer/preflight-section.toml (100%)
+  - min_disk_gb → reasonable bounds (1-10000)
+  - min_memory_gb → already has constraints (1-512)
+  - min_cpu_cores → already has constraints (1-128)
+
+- [x] ✅ installer/installation-section.toml (100%)
+  - parallel_services → reasonable bounds (1-10)
+  - installation_timeout_seconds → reasonable bounds (0-14400)
+  - validation_timeout → reasonable bounds (5000-300000)
+
+- [x] ✅ installer/services-section.toml (100%)
+  - orchestrator_port → `common.server.port`
+  - control_center_port → `common.server.port`
+  - mcp_server_port → `common.server.port`
+  - api_gateway_port → `common.server.port`
+
+- [x] ✅ installer/database-section.toml (100%)
+  - connection_pool_size → reasonable bounds (1-100)
+  - connection_pool_timeout → reasonable bounds (10-3600)
+  - connection_idle_timeout → reasonable bounds (60-14400)
+
+- [x] ✅ installer/storage-section.toml (100%)
+  - storage_size_gb → reasonable bounds (10-100000)
+  - storage_replication_factor → reasonable bounds (2-10)
+
+- [x] ✅ installer/networking-section.toml (100%)
+  - load_balancer_http_port → `common.server.port`
+  - load_balancer_https_port → `common.server.port`
+
+- [x] ✅ installer/ha-section.toml (100%)
+  - ha_cluster_size → reasonable bounds (3-256)
+  - ha_db_quorum_size → reasonable bounds (1-256)
+  - ha_health_check_interval → reasonable bounds (1-120)
+  - ha_health_check_timeout → reasonable bounds (1000-300000)
+  - ha_failover_delay → reasonable bounds (0-600)
+  - ha_backup_interval → reasonable bounds (300-86400)
+  - ha_metrics_interval → reasonable bounds (5-300)
+
+- [x] ✅ installer/post-install-section.toml (100%)
+  - verification_timeout → reasonable bounds (30-3600)
+
+- [x] ✅ installer/upgrades-section.toml (100%)
+  - rolling_upgrade_parallel → reasonable bounds (1-10)
+  - canary_percentage → reasonable bounds (1-50)
+  - canary_duration_seconds → reasonable bounds (30-7200)
+  - maintenance_duration_seconds → reasonable bounds (600-86400)
+  - backup_timeout_minutes → reasonable bounds (5-1440)
+  - rollback_validation_delay → reasonable bounds (30-1800)
+  - post_upgrade_health_check_interval → reasonable bounds (5-300)
+  - post_upgrade_monitoring_duration → reasonable bounds (60-86400)
+
+## How to Continue
+
+1. **Reference the mapping**: See `constraint_interpolation_guide.md` for complete field → constraint mappings
+
+2. **For fragments with existing constraints** (e.g., `security-section.toml`):
+   ```bash
+   # Update fields using the pattern from completed fragments
+   # Example: jwt_token_expiration → control_center.jwt.token_expiration
+   ```
+
+3. **For fragments without existing constraints** (e.g., `performance-section.toml`):
+   - Use reasonable domain-based ranges
+   - Document your choice in the help text
+   - Examples:
+     - Timeouts: 1s-1hr range (1000-3600000 ms)
+     - Thread counts: 1-32 range
+     - Memory: 64MB-256GB range (use deployment modes)
+     - Ports: use `common.server.port` (1024-65535)
+
+## Testing
+
+After updating a fragment:
+
+```toml
+# 1. Verify fragment syntax
+cd provisioning/.typedialog/provisioning/platform/forms/fragments
+grep -n 'min = \|max = ' <fragment-name>.toml | head -20
+
+# 2. Validate constraints exist
+cd ../..
+grep -r "$(constraint path)" constraints/constraints.toml
+
+# 3. Test form rendering
+typedialog-cli validate forms/<service>-form.toml
+```
+
+## Notes
+
+### Pattern Applied
+All numeric fields now follow this structure:
+```toml
+[[elements]]
+default = 10
+help = "Field description (range: ${constraint.path.min}-${constraint.path.max})"
+min = "${constraint.path.min}"
+max = "${constraint.path.max}"
+name = "field_name"
+nickel_path = ["path", "to", "nickel"]
+prompt = "Field Label"
+type = "number"
+```
+
+### Benefits Realized
+- ✅ Single source of truth in `constraints.toml`
+- ✅ Help text shows actual valid ranges to users
+- ✅ TypeDialog validates input against constraints
+- ✅ Jinja2 templates receive validated values
+- ✅ Easy to update limits globally (all forms auto-update)
+
+## Completion Summary
+
+**Final Status**: 33/33 fragments (100%) ✅ COMPLETE
+
+**Work Completed Today**:
+- ✅ orchestrator/performance-section.toml (5 fields with max bounds)
+- ✅ orchestrator/storage-section.toml (4 fields with max bounds)
+- ✅ control-center/policy-section.toml (3 fields with max bounds)
+- ✅ control-center/users-section.toml (3 fields with max bounds)
+- ✅ Fragments with no numeric fields (rbac, mode-selection, workspace) verified as complete
+
+**Total Progress This Session**:
+- Started: 12/33 (36%)
+- Ended: 33/33 (100%)
+- +21 fragments updated
+- +50+ numeric fields with constraint bounds added
+
+### Next Phase: Phase 8 - Nushell Scripts
+Ready to proceed with implementation:
+- Interactive configuration wizard (configure.nu)
+- Config generation from Nickel → TOML (generate-configs.nu)
+- Validation and roundtrip workflows
+- Template rendering (Docker Compose, Kubernetes)
+
+## Files
+
+- `constraints/constraints.toml` - Source of truth for all validation limits
+- `constraint_interpolation_guide.md` - Complete mapping and best practices
+- `constraint_update_status.md` - This file (progress tracking)
+
+---
+
+**To contribute**: Pick any unchecked fragment above and follow the pattern in
+`constraint_interpolation_guide.md`. Each constraint update takes ~5 minutes per fragment.

.typedialog/platform/forms/fragments/control-center/compliance-section.toml

@@ -0,0 +1,115 @@
+name = "compliance_section"
+description = "Control Center Compliance & Audit Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "compliance_section_header"
+title = "✅ Compliance & Audit"
+type = "section_header"
+
+# Audit Logging
+[[elements]]
+default = false
+help = "Enable audit logging for all actions"
+name = "audit_enabled"
+nickel_path = ["audit", "enabled"]
+prompt = "Enable Audit Logging"
+type = "confirm"
+
+[[elements]]
+condition = "audit_enabled == true"
+default = 90
+help = "Audit log retention in days (range: ${constraint.control_center.audit.retention_days.min}-${constraint.control_center.audit.retention_days.max})"
+max = "${constraint.control_center.audit.retention_days.max}"
+min = "${constraint.control_center.audit.retention_days.min}"
+name = "audit_retention_days"
+nickel_path = ["audit", "storage", "retention_days"]
+prompt = "Audit Retention (days)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "audit_enabled == true"
+default = false
+help = "Make audit logs immutable (write-once)"
+name = "audit_immutable"
+nickel_path = ["audit", "storage", "immutable"]
+prompt = "Immutable Audit Logs"
+type = "confirm"
+
+[[elements]]
+condition = "audit_enabled == true"
+default = true
+help = "Redact sensitive data from audit logs"
+name = "audit_redact_sensitive"
+nickel_path = ["audit", "redact_sensitive"]
+prompt = "Redact Sensitive Data"
+type = "confirm"
+
+# Compliance Configuration
+[[elements]]
+default = false
+help = "Enable compliance framework enforcement"
+name = "compliance_enabled"
+nickel_path = ["compliance", "enabled"]
+prompt = "Enable Compliance Framework"
+type = "confirm"
+
+[[elements]]
+condition = "compliance_enabled == true"
+default = false
+help = "Enable automated compliance validation"
+name = "compliance_validation_enabled"
+nickel_path = ["compliance", "validation", "enabled"]
+prompt = "Enable Compliance Validation"
+type = "confirm"
+
+[[elements]]
+condition = "compliance_enabled == true && compliance_validation_enabled == true"
+default = 24
+help = "Compliance validation interval in hours (range: 1-168)"
+max = 168
+min = 1
+name = "compliance_validation_interval"
+nickel_path = ["compliance", "validation", "interval_hours"]
+prompt = "Validation Interval (hours)"
+type = "custom"
+custom_type = "Number"
+
+# Data Retention
+[[elements]]
+condition = "compliance_enabled == true"
+default = 7
+help = "Data retention policy in years (range: 1-30)"
+max = 30
+min = 1
+name = "compliance_data_retention_years"
+nickel_path = ["compliance", "data_retention", "policy_years"]
+prompt = "Data Retention Policy (years)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "compliance_enabled == true"
+default = 2555
+help = "Audit log retention in days (range: 90-10950, approximately 7 years default)"
+max = 10950
+min = 90
+name = "compliance_audit_log_days"
+nickel_path = ["compliance", "data_retention", "audit_log_days"]
+prompt = "Audit Log Retention (days)"
+type = "custom"
+custom_type = "Number"
+
+# Encryption Requirements
+[[elements]]
+condition = "compliance_enabled == true"
+default = false
+help = "Require encryption for sensitive data at rest"
+name = "compliance_encryption_required"
+nickel_path = ["compliance", "encryption_required"]
+prompt = "Require Encryption"
+type = "confirm"

.typedialog/platform/forms/fragments/control-center/policy-section.toml

@@ -0,0 +1,73 @@
+name = "policy_section"
+description = "Control Center Policy Engine Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "policy_section_header"
+title = "📋 Policy Engine Configuration"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Enable policy engine"
+name = "policy_enabled"
+nickel_path = ["policy", "enabled"]
+prompt = "Enable Policy Engine"
+type = "confirm"
+
+[[elements]]
+condition = "policy_enabled == true"
+default = true
+help = "Enable policy caching"
+name = "policy_cache_enabled"
+nickel_path = ["policy", "cache", "enabled"]
+prompt = "Enable Policy Caching"
+type = "confirm"
+
+[[elements]]
+condition = "policy_enabled == true && policy_cache_enabled == true"
+default = 3600
+help = "Policy cache TTL in seconds (range: 60-86400)"
+max = 86400
+min = 60
+name = "policy_cache_ttl"
+nickel_path = ["policy", "cache", "ttl"]
+prompt = "Cache TTL (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "policy_enabled == true && policy_cache_enabled == true"
+default = 10000
+help = "Maximum policies to keep in cache (range: 100-1000000)"
+max = 1000000
+min = 100
+name = "policy_cache_max_policies"
+nickel_path = ["policy", "cache", "max_policies"]
+prompt = "Max Cached Policies"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "policy_enabled == true"
+default = true
+help = "Enable policy versioning"
+name = "policy_versioning_enabled"
+nickel_path = ["policy", "versioning", "enabled"]
+prompt = "Enable Policy Versioning"
+type = "confirm"
+
+[[elements]]
+condition = "policy_enabled == true && policy_versioning_enabled == true"
+default = 20
+help = "Maximum policy versions to keep (range: 1-1000)"
+max = 1000
+min = 1
+name = "policy_versioning_max_versions"
+nickel_path = ["policy", "versioning", "max_versions"]
+prompt = "Max Policy Versions"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/control-center/rbac-section.toml

@@ -0,0 +1,52 @@
+name = "rbac_section"
+description = "Control Center RBAC Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "rbac_section_header"
+title = "🔐 RBAC Configuration"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Enable Role-Based Access Control"
+name = "rbac_roles_admin"
+nickel_path = ["rbac", "roles", "admin"]
+prompt = "Enable Admin Role"
+type = "confirm"
+
+[[elements]]
+default = true
+help = "Enable Operator role for limited administrative access"
+name = "rbac_roles_operator"
+nickel_path = ["rbac", "roles", "operator"]
+prompt = "Enable Operator Role"
+type = "confirm"
+
+[[elements]]
+default = true
+help = "Enable Viewer role for read-only access"
+name = "rbac_roles_viewer"
+nickel_path = ["rbac", "roles", "viewer"]
+prompt = "Enable Viewer Role"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Allow dynamic role assignment at runtime"
+name = "rbac_dynamic_roles"
+nickel_path = ["rbac", "dynamic_roles"]
+prompt = "Enable Dynamic Roles"
+type = "confirm"
+
+[[elements]]
+default = "user"
+help = "Default role assigned to new users"
+name = "rbac_default_role_name"
+nickel_path = ["rbac", "default_role"]
+options = ["user", "operator", "viewer"]
+prompt = "Default Role for New Users"
+type = "select"

.typedialog/platform/forms/fragments/control-center/security-section.toml

@@ -0,0 +1,191 @@
+name = "security_section"
+description = "Control Center Security Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "security_section_header"
+title = "🔐 Security Configuration"
+type = "section_header"
+
+# JWT Configuration
+[[elements]]
+border_top = false
+default = true
+help = "Enable JWT authentication"
+name = "jwt_enabled"
+nickel_path = ["security", "jwt", "enabled"]
+prompt = "Enable JWT Authentication"
+type = "confirm"
+
+[[elements]]
+condition = "jwt_enabled == true"
+default = "control-center"
+help = "JWT token issuer identifier"
+name = "jwt_issuer"
+nickel_path = ["security", "jwt", "issuer"]
+prompt = "JWT Issuer"
+required = true
+type = "text"
+
+[[elements]]
+condition = "jwt_enabled == true"
+default = "provisioning"
+help = "JWT token audience identifier"
+name = "jwt_audience"
+nickel_path = ["security", "jwt", "audience"]
+prompt = "JWT Audience"
+required = true
+type = "text"
+
+[[elements]]
+condition = "jwt_enabled == true"
+default = 3600
+help = "JWT token expiration time in seconds (range: ${constraint.control_center.jwt.token_expiration.min}-${constraint.control_center.jwt.token_expiration.max})"
+max = "${constraint.control_center.jwt.token_expiration.max}"
+min = "${constraint.control_center.jwt.token_expiration.min}"
+name = "jwt_token_expiration"
+nickel_path = ["security", "jwt", "token_expiration"]
+prompt = "Token Expiration (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "jwt_enabled == true"
+default = 86400
+help = "JWT refresh token expiration time in seconds (range: ${constraint.control_center.jwt.refresh_expiration.min}-${constraint.control_center.jwt.refresh_expiration.max})"
+max = "${constraint.control_center.jwt.refresh_expiration.max}"
+min = "${constraint.control_center.jwt.refresh_expiration.min}"
+name = "jwt_refresh_expiration"
+nickel_path = ["security", "jwt", "refresh_expiration"]
+prompt = "Refresh Token Expiration (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "jwt_enabled == true"
+default = "HS256"
+help = "JWT signing method (HS256, RS256, ES256)"
+name = "jwt_signing_method"
+nickel_path = ["security", "jwt", "signing_method"]
+options = ["HS256", "RS256", "ES256"]
+prompt = "Signing Method"
+type = "select"
+
+# RBAC Configuration
+[[elements]]
+default = true
+help = "Enable Role-Based Access Control"
+name = "rbac_enabled"
+nickel_path = ["security", "rbac", "enabled"]
+prompt = "Enable RBAC"
+type = "confirm"
+
+[[elements]]
+condition = "rbac_enabled == true"
+default = true
+help = "Enable role hierarchy/inheritance"
+name = "rbac_hierarchy"
+nickel_path = ["security", "rbac", "hierarchy"]
+prompt = "Enable Role Hierarchy"
+type = "confirm"
+
+# MFA Configuration
+[[elements]]
+default = false
+help = "Enable Multi-Factor Authentication"
+name = "mfa_enabled"
+nickel_path = ["security", "mfa", "enabled"]
+prompt = "Enable MFA"
+type = "confirm"
+
+[[elements]]
+condition = "mfa_enabled == true"
+default = false
+help = "Require MFA for all users"
+name = "mfa_required"
+nickel_path = ["security", "mfa", "required"]
+prompt = "Require MFA for All Users"
+type = "confirm"
+
+# Rate Limiting
+[[elements]]
+default = false
+help = "Enable API rate limiting"
+name = "rate_limiting_enabled"
+nickel_path = ["security", "rate_limiting", "enabled"]
+prompt = "Enable Rate Limiting"
+type = "confirm"
+
+[[elements]]
+condition = "rate_limiting_enabled == true"
+default = 1000
+help = "Maximum API requests per time window (range: ${constraint.control_center.rate_limiting.max_requests.min}-${constraint.control_center.rate_limiting.max_requests.max})"
+max = "${constraint.control_center.rate_limiting.max_requests.max}"
+min = "${constraint.control_center.rate_limiting.max_requests.min}"
+name = "rate_limiting_max_requests"
+nickel_path = ["security", "rate_limiting", "max_requests"]
+prompt = "Max Requests per Window"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "rate_limiting_enabled == true"
+default = 60
+help = "Time window in seconds (range: ${constraint.control_center.rate_limiting.window_seconds.min}-${constraint.control_center.rate_limiting.window_seconds.max})"
+max = "${constraint.control_center.rate_limiting.window_seconds.max}"
+min = "${constraint.control_center.rate_limiting.window_seconds.min}"
+name = "rate_limiting_window"
+nickel_path = ["security", "rate_limiting", "window_seconds"]
+prompt = "Rate Limit Window (seconds)"
+type = "custom"
+custom_type = "Number"
+
+# TLS Configuration
+[[elements]]
+default = false
+help = "Enable TLS/SSL encryption"
+name = "tls_enabled"
+nickel_path = ["security", "tls", "enabled"]
+prompt = "Enable TLS/SSL"
+type = "confirm"
+
+# Session Management
+[[elements]]
+default = true
+help = "Enable session management"
+name = "sessions_enabled"
+nickel_path = ["security", "sessions", "enabled"]
+prompt = "Enable Sessions"
+type = "confirm"
+
+[[elements]]
+condition = "sessions_enabled == true"
+default = 86400
+help = "Session max age in seconds"
+min = 300
+name = "sessions_max_age"
+nickel_path = ["security", "sessions", "max_age"]
+prompt = "Session Max Age (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "sessions_enabled == true"
+default = true
+help = "Set secure flag on session cookies"
+name = "sessions_secure"
+nickel_path = ["security", "sessions", "secure"]
+prompt = "Secure Cookies"
+type = "confirm"
+
+[[elements]]
+condition = "sessions_enabled == true"
+default = true
+help = "Set HttpOnly flag on session cookies"
+name = "sessions_http_only"
+nickel_path = ["security", "sessions", "http_only"]
+prompt = "HttpOnly Cookies"
+type = "confirm"

.typedialog/platform/forms/fragments/control-center/users-section.toml

@@ -0,0 +1,95 @@
+name = "users_section"
+description = "Control Center User Management Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "users_section_header"
+title = "👥 User Management"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Enable user management"
+name = "users_enabled"
+nickel_path = ["users", "enabled"]
+prompt = "Enable User Management"
+type = "confirm"
+
+# User Registration
+[[elements]]
+condition = "users_enabled == true"
+default = true
+help = "Enable user self-registration"
+name = "users_registration_enabled"
+nickel_path = ["users", "registration", "enabled"]
+prompt = "Enable User Registration"
+type = "confirm"
+
+[[elements]]
+condition = "users_enabled == true && users_registration_enabled == true"
+default = false
+help = "Require admin approval for new registrations"
+name = "users_registration_requires_approval"
+nickel_path = ["users", "registration", "requires_approval"]
+prompt = "Require Registration Approval"
+type = "confirm"
+
+[[elements]]
+condition = "users_enabled == true && users_registration_enabled == true"
+default = "user"
+help = "Default role for newly registered users"
+name = "users_registration_auto_role"
+nickel_path = ["users", "registration", "auto_assign_role"]
+options = ["user", "operator", "viewer"]
+prompt = "Default Registration Role"
+type = "select"
+
+# User Sessions
+[[elements]]
+condition = "users_enabled == true"
+default = 5
+help = "Maximum active sessions per user (range: 1-100)"
+max = 100
+min = 1
+name = "users_sessions_max_active"
+nickel_path = ["users", "sessions", "max_active"]
+prompt = "Max Active Sessions per User"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "users_enabled == true"
+default = 3600
+help = "Session idle timeout in seconds (range: 300-86400)"
+max = 86400
+min = 300
+name = "users_sessions_idle_timeout"
+nickel_path = ["users", "sessions", "idle_timeout"]
+prompt = "Session Idle Timeout (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "users_enabled == true"
+default = 86400
+help = "Absolute session timeout in seconds (range: 3600-604800)"
+max = 604800
+min = 3600
+name = "users_sessions_absolute_timeout"
+nickel_path = ["users", "sessions", "absolute_timeout"]
+prompt = "Absolute Session Timeout (seconds)"
+type = "custom"
+custom_type = "Number"
+
+# User Audit
+[[elements]]
+condition = "users_enabled == true"
+default = false
+help = "Enable audit logging for user actions"
+name = "users_audit_enabled"
+nickel_path = ["users", "audit_enabled"]
+prompt = "Enable User Audit Logging"
+type = "confirm"

.typedialog/platform/forms/fragments/database-postgres-section.toml

@@ -0,0 +1,108 @@
+name = "database_postgres_section"
+description = "PostgreSQL Database Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "database_section_header"
+title = "💾 PostgreSQL Database Configuration"
+type = "section_header"
+
+[[elements]]
+default = "postgresql"
+help = "Database backend type"
+name = "database_backend"
+nickel_path = ["database", "backend"]
+prompt = "Database Backend"
+type = "text"
+
+[[elements]]
+help = "PostgreSQL connection string or host"
+name = "database_postgres_host"
+nickel_path = ["database", "host"]
+placeholder = "localhost"
+prompt = "PostgreSQL Host"
+required = true
+type = "text"
+
+[[elements]]
+default = 5432
+help = "PostgreSQL port number (range: ${constraint.common.server.port.min}-${constraint.common.server.port.max})"
+max = "${constraint.common.server.port.max}"
+min = "${constraint.common.server.port.min}"
+name = "database_postgres_port"
+nickel_path = ["database", "port"]
+prompt = "PostgreSQL Port"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+help = "PostgreSQL database name"
+name = "database_postgres_database"
+nickel_path = ["database", "database"]
+placeholder = "provisioning"
+prompt = "Database Name"
+required = true
+type = "text"
+
+[[elements]]
+help = "PostgreSQL username"
+name = "database_postgres_user"
+nickel_path = ["database", "user"]
+placeholder = "provisioning"
+prompt = "Username"
+required = true
+type = "text"
+
+[[elements]]
+help = "PostgreSQL password (will be stored securely)"
+name = "database_postgres_password"
+nickel_path = ["database", "password"]
+prompt = "Password"
+type = "password"
+
+[[elements]]
+default = 10
+help = "Database connection pool size (range: 5-200)"
+max = 200
+min = 5
+name = "database_pool_size"
+nickel_path = ["database", "pool_size"]
+prompt = "Connection Pool Size"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 30
+help = "Database operation timeout in seconds (range: 10-3600)"
+max = 3600
+min = 10
+name = "database_timeout"
+nickel_path = ["database", "timeout"]
+prompt = "Timeout (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 3
+help = "Number of retry attempts for failed operations (range: 0-10)"
+max = 10
+min = 0
+name = "database_retry_attempts"
+nickel_path = ["database", "retry_attempts"]
+prompt = "Retry Attempts"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 100
+help = "Delay in milliseconds between retry attempts (range: 1000-60000)"
+max = 60000
+min = 1000
+name = "database_retry_delay"
+nickel_path = ["database", "retry_delay"]
+prompt = "Retry Delay (ms)"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/database-rocksdb-section.toml

@@ -0,0 +1,72 @@
+name = "database_rocksdb_section"
+description = "RocksDB Database Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "database_section_header"
+title = "💾 RocksDB Database Configuration"
+type = "section_header"
+
+[[elements]]
+default = "rocksdb"
+help = "Database backend type"
+name = "database_backend"
+nickel_path = ["database", "backend"]
+prompt = "Database Backend"
+type = "text"
+
+[[elements]]
+default = "/var/lib/provisioning/data"
+help = "Path to RocksDB data directory"
+name = "database_path"
+nickel_path = ["database", "path"]
+prompt = "Database Path"
+required = true
+type = "text"
+
+[[elements]]
+default = 10
+help = "Database connection pool size (range: 1-100)"
+max = 100
+min = 1
+name = "database_pool_size"
+nickel_path = ["database", "pool_size"]
+prompt = "Connection Pool Size"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 30
+help = "Database operation timeout in seconds (range: 10-3600)"
+max = 3600
+min = 10
+name = "database_timeout"
+nickel_path = ["database", "timeout"]
+prompt = "Timeout (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 3
+help = "Number of retry attempts for failed operations (range: 0-10)"
+max = 10
+min = 0
+name = "database_retry_attempts"
+nickel_path = ["database", "retry_attempts"]
+prompt = "Retry Attempts"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 100
+help = "Delay in milliseconds between retry attempts (range: 1000-60000)"
+max = 60000
+min = 1000
+name = "database_retry_delay"
+nickel_path = ["database", "retry_delay"]
+prompt = "Retry Delay (ms)"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/database-surrealdb-section.toml

@@ -0,0 +1,87 @@
+name = "database_surrealdb_section"
+description = "SurrealDB Database Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "database_section_header"
+title = "💾 SurrealDB Database Configuration"
+type = "section_header"
+
+[[elements]]
+default = "surrealdb"
+help = "Database backend type"
+name = "database_backend"
+nickel_path = ["database", "backend"]
+prompt = "Database Backend"
+type = "text"
+
+[[elements]]
+help = "SurrealDB server URL (e.g., http://localhost:8000 for embedded)"
+name = "database_surrealdb_url"
+nickel_path = ["database", "surrealdb_url"]
+placeholder = "http://localhost:8000"
+prompt = "SurrealDB URL"
+type = "text"
+
+[[elements]]
+default = "provisioning"
+help = "SurrealDB namespace"
+name = "database_surrealdb_namespace"
+nickel_path = ["database", "surrealdb_namespace"]
+prompt = "Namespace"
+type = "text"
+
+[[elements]]
+default = "default"
+help = "SurrealDB database name"
+name = "database_surrealdb_database"
+nickel_path = ["database", "surrealdb_database"]
+prompt = "Database"
+type = "text"
+
+[[elements]]
+default = 10
+help = "Database connection pool size (range: 1-200)"
+max = 200
+min = 1
+name = "database_pool_size"
+nickel_path = ["database", "pool_size"]
+prompt = "Connection Pool Size"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 30
+help = "Database operation timeout in seconds (range: 10-3600)"
+max = 3600
+min = 10
+name = "database_timeout"
+nickel_path = ["database", "timeout"]
+prompt = "Timeout (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 3
+help = "Number of retry attempts for failed operations (range: 0-10)"
+max = 10
+min = 0
+name = "database_retry_attempts"
+nickel_path = ["database", "retry_attempts"]
+prompt = "Retry Attempts"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 100
+help = "Delay in milliseconds between retry attempts (range: 1000-60000)"
+max = 60000
+min = 1000
+name = "database_retry_delay"
+nickel_path = ["database", "retry_delay"]
+prompt = "Retry Delay (ms)"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/deployment/database-backend-selection.toml

@@ -0,0 +1,94 @@
+name = "database_backend_selection"
+description = "Database Backend Selection Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "database_backend_selection_header"
+title = "🗄️ Database Backend Selection"
+type = "section_header"
+
+[[elements]]
+default = "rocksdb"
+help = "Select the database backend for this service"
+name = "database_backend_selection"
+nickel_path = ["database", "backend_type"]
+options = ["rocksdb", "surrealdb_embedded", "surrealdb_server", "postgresql"]
+prompt = "Database Backend"
+required = true
+type = "select"
+
+# Backend Descriptions
+[[elements]]
+condition = "database_backend_selection == 'rocksdb'"
+default = false
+help = "RocksDB: Embedded key-value store. Zero external dependencies, local filesystem storage, good for solo/multiuser modes. Limited to single instance."
+name = "rocksdb_info"
+prompt = "RocksDB Info"
+type = "section"
+
+[[elements]]
+condition = "database_backend_selection == 'surrealdb_embedded'"
+default = false
+help = "SurrealDB (Embedded): In-process SurrealDB. No external server needed, queryable JSON/SQL, suitable for small to medium deployments."
+name = "surrealdb_embedded_info"
+prompt = "SurrealDB Embedded Info"
+type = "section"
+
+[[elements]]
+condition = "database_backend_selection == 'surrealdb_server'"
+default = false
+help = "SurrealDB (Server): External SurrealDB server. Scalable multi-instance, HA ready, suitable for multiuser/enterprise modes."
+name = "surrealdb_server_info"
+prompt = "SurrealDB Server Info"
+type = "section"
+
+[[elements]]
+condition = "database_backend_selection == 'postgresql'"
+default = false
+help = "PostgreSQL: Traditional RDBMS. Proven stability, full ACID, complex queries, suitable for enterprise with HA via replication."
+name = "postgresql_info"
+prompt = "PostgreSQL Info"
+type = "section"
+
+# Backend Selection Guidelines
+[[elements]]
+border_bottom = true
+border_top = true
+name = "backend_selection_guide"
+title = "Backend Selection Guide"
+type = "section_header"
+
+[[elements]]
+condition = "deployment_mode == 'solo'"
+default = false
+help = "Recommended for Solo: RocksDB (simplest) or SurrealDB Embedded (more features, same simplicity)"
+name = "solo_recommendation"
+prompt = "Solo Recommendation"
+type = "section"
+
+[[elements]]
+condition = "deployment_mode == 'multiuser'"
+default = false
+help = "Recommended for MultiUser: SurrealDB Server (scalable, easy clustering) or PostgreSQL (if you need traditional RDBMS)"
+name = "multiuser_recommendation"
+prompt = "MultiUser Recommendation"
+type = "section"
+
+[[elements]]
+condition = "deployment_mode == 'cicd'"
+default = false
+help = "Recommended for CI/CD: SurrealDB Embedded (ephemeral, no external deps) or RocksDB (fastest)"
+name = "cicd_recommendation"
+prompt = "CI/CD Recommendation"
+type = "section"
+
+[[elements]]
+condition = "deployment_mode == 'enterprise'"
+default = false
+help = "Recommended for Enterprise: SurrealDB Server HA (native clustering) or PostgreSQL with replication + external backup service"
+name = "enterprise_recommendation"
+prompt = "Enterprise Recommendation"
+type = "section"

.typedialog/platform/forms/fragments/deployment/mode-selection.toml

@@ -0,0 +1,98 @@
+name = "mode_selection"
+description = "Deployment Mode Selection Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "deployment_mode_section_header"
+title = "🚀 Deployment Mode"
+type = "section_header"
+
+[[elements]]
+default = "solo"
+help = "Select deployment mode which determines resource allocation and feature set"
+name = "deployment_mode"
+nickel_path = ["deployment_mode"]
+options = ["solo", "multiuser", "cicd", "enterprise"]
+prompt = "Deployment Mode"
+required = true
+type = "select"
+
+# Mode Descriptions
+[[elements]]
+border_bottom = true
+border_top = false
+name = "mode_description"
+title = "Mode Details"
+type = "section_header"
+
+# Solo Mode Info (conditional)
+[[elements]]
+condition = "deployment_mode == 'solo'"
+default = false
+help = "Solo Mode: Single developer environment. Filesystem/RocksDB storage, 2-4 CPU cores, 4GB RAM. Minimal security, no HA. Ideal for local development and testing."
+name = "mode_solo_info"
+prompt = "Solo Mode"
+type = "section"
+
+# MultiUser Mode Info (conditional)
+[[elements]]
+condition = "deployment_mode == 'multiuser'"
+default = false
+help = "MultiUser Mode: Team development environment. PostgreSQL/SurrealDB, 4-8 CPU cores, 8GB RAM. RBAC enabled, shared storage, staging-ready. Ideal for team collaboration."
+name = "mode_multiuser_info"
+prompt = "MultiUser Mode"
+type = "section"
+
+# CI/CD Mode Info (conditional)
+[[elements]]
+condition = "deployment_mode == 'cicd'"
+default = false
+help = "CI/CD Mode: Automated testing and pipeline environment. Ephemeral storage, 8+ CPU cores, 16GB RAM. API-driven, minimal UI, optimized for throughput. Ideal for automated testing."
+name = "mode_cicd_info"
+prompt = "CI/CD Mode"
+type = "section"
+
+# Enterprise Mode Info (conditional)
+[[elements]]
+condition = "deployment_mode == 'enterprise'"
+default = false
+help = "Enterprise Mode: Production high-availability environment. SurrealDB cluster, PostgreSQL HA, 16+ CPU cores, 32+ GB RAM. MFA required, compliance, full monitoring. Ideal for production deployments."
+name = "mode_enterprise_info"
+prompt = "Enterprise Mode"
+type = "section"
+
+# Mode-Specific Default Values (informational)
+[[elements]]
+condition = "deployment_mode == 'solo'"
+default = false
+help = "Resources: 2 CPU, 4GB RAM | Storage: 50GB | Database: Filesystem or RocksDB | Security: Optional | HA: None"
+name = "solo_resources_info"
+prompt = "Solo Resources"
+type = "text"
+
+[[elements]]
+condition = "deployment_mode == 'multiuser'"
+default = false
+help = "Resources: 4 CPU, 8GB RAM | Storage: 100GB | Database: PostgreSQL or SurrealDB | Security: RBAC | HA: Optional"
+name = "multiuser_resources_info"
+prompt = "MultiUser Resources"
+type = "text"
+
+[[elements]]
+condition = "deployment_mode == 'cicd'"
+default = false
+help = "Resources: 8 CPU, 16GB RAM | Storage: 200GB (ephemeral) | Database: Embedded | Security: API tokens | HA: None"
+name = "cicd_resources_info"
+prompt = "CI/CD Resources"
+type = "text"
+
+[[elements]]
+condition = "deployment_mode == 'enterprise'"
+default = false
+help = "Resources: 16+ CPU, 32+ GB RAM | Storage: 500GB+ | Database: SurrealDB Cluster HA | Security: MFA, Vault | HA: Full clustering"
+name = "enterprise_resources_info"
+prompt = "Enterprise Resources"
+type = "text"

.typedialog/platform/forms/fragments/extension-registry/auth.toml

@@ -0,0 +1,38 @@
+name = "auth"
+description = "Extension Registry Authentication Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "registry_auth_header"
+title = "🔐 Authentication"
+type = "section_header"
+
+[[elements]]
+default = ""
+help = "OCI registry username (optional)"
+name = "registry_oci_username"
+nickel_path = ["extension_registry", "oci", "username"]
+prompt = "OCI Username"
+required = false
+type = "text"
+
+[[elements]]
+default = ""
+help = "OCI registry password (optional)"
+name = "registry_oci_password"
+nickel_path = ["extension_registry", "oci", "password"]
+prompt = "OCI Password"
+required = false
+type = "password"
+
+[[elements]]
+default = ""
+help = "Gitea API token (optional)"
+name = "registry_gitea_token"
+nickel_path = ["extension_registry", "gitea", "token"]
+prompt = "Gitea Token"
+required = false
+type = "password"

.typedialog/platform/forms/fragments/extension-registry/cache.toml

@@ -0,0 +1,49 @@
+name = "cache"
+description = "Extension Registry Cache Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "registry_cache_header"
+title = "⚡ Cache Configuration"
+type = "section_header"
+
+[[elements]]
+default = 1000
+help = "Maximum cache entries (range: 10-100000)"
+max = 100000
+min = 10
+name = "registry_cache_capacity"
+nickel_path = ["extension_registry", "cache", "capacity"]
+prompt = "Cache Capacity"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 300
+help = "Cache TTL in seconds (range: 30-3600)"
+max = 3600
+min = 30
+name = "registry_cache_ttl"
+nickel_path = ["extension_registry", "cache", "ttl"]
+prompt = "Cache TTL (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = true
+help = "Cache metadata responses"
+name = "registry_cache_metadata_enabled"
+nickel_path = ["extension_registry", "cache", "metadata_cache"]
+prompt = "Cache Metadata"
+type = "confirm"
+
+[[elements]]
+default = true
+help = "Cache list responses"
+name = "registry_cache_list_enabled"
+nickel_path = ["extension_registry", "cache", "list_cache"]
+prompt = "Cache Lists"
+type = "confirm"

.typedialog/platform/forms/fragments/extension-registry/gitea.toml

@@ -0,0 +1,60 @@
+name = "gitea"
+description = "Extension Registry Gitea Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "registry_gitea_header"
+title = "🐙 Gitea Configuration"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Enable Gitea as extension source"
+name = "registry_gitea_enabled"
+nickel_path = ["extension_registry", "gitea", "enabled"]
+prompt = "Enable Gitea"
+type = "confirm"
+
+[[elements]]
+condition = "registry_gitea_enabled == true"
+default = "http://localhost:3000"
+help = "Gitea server URL"
+name = "registry_gitea_url"
+nickel_path = ["extension_registry", "gitea", "url"]
+prompt = "Gitea URL"
+required = true
+type = "text"
+
+[[elements]]
+condition = "registry_gitea_enabled == true"
+default = "provisioning"
+help = "Gitea organization name"
+name = "registry_gitea_org"
+nickel_path = ["extension_registry", "gitea", "org"]
+prompt = "Organization"
+required = true
+type = "text"
+
+[[elements]]
+condition = "registry_gitea_enabled == true"
+default = 60000
+help = "Request timeout in milliseconds"
+max = 300000
+min = 5000
+name = "registry_gitea_timeout"
+nickel_path = ["extension_registry", "gitea", "timeout"]
+prompt = "Timeout (ms)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "registry_gitea_enabled == true"
+default = false
+help = "Verify SSL certificates"
+name = "registry_gitea_verify_ssl"
+nickel_path = ["extension_registry", "gitea", "verify_ssl"]
+prompt = "Verify SSL"
+type = "confirm"

.typedialog/platform/forms/fragments/extension-registry/oci.toml

@@ -0,0 +1,60 @@
+name = "oci"
+description = "Extension Registry OCI Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "registry_oci_header"
+title = "📦 OCI Registry Configuration"
+type = "section_header"
+
+[[elements]]
+default = false
+help = "Enable OCI registry as extension source"
+name = "registry_oci_enabled"
+nickel_path = ["extension_registry", "oci", "enabled"]
+prompt = "Enable OCI Registry"
+type = "confirm"
+
+[[elements]]
+condition = "registry_oci_enabled == true"
+default = "registry.local:5000"
+help = "OCI registry URL"
+name = "registry_oci_registry"
+nickel_path = ["extension_registry", "oci", "registry"]
+prompt = "Registry URL"
+required = true
+type = "text"
+
+[[elements]]
+condition = "registry_oci_enabled == true"
+default = "provisioning"
+help = "OCI registry namespace"
+name = "registry_oci_namespace"
+nickel_path = ["extension_registry", "oci", "namespace"]
+prompt = "Namespace"
+required = true
+type = "text"
+
+[[elements]]
+condition = "registry_oci_enabled == true"
+default = 60000
+help = "Request timeout in milliseconds"
+max = 300000
+min = 5000
+name = "registry_oci_timeout"
+nickel_path = ["extension_registry", "oci", "timeout"]
+prompt = "Timeout (ms)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "registry_oci_enabled == true"
+default = false
+help = "Verify SSL certificates"
+name = "registry_oci_verify_ssl"
+nickel_path = ["extension_registry", "oci", "verify_ssl"]
+prompt = "Verify SSL"
+type = "confirm"

.typedialog/platform/forms/fragments/extension-registry/server.toml

@@ -0,0 +1,60 @@
+name = "server"
+description = "Extension Registry Server Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "registry_server_header"
+title = "🖥️ Server Configuration"
+type = "section_header"
+
+[[elements]]
+default = "0.0.0.0"
+help = "HTTP server bind address"
+name = "registry_server_host"
+nickel_path = ["extension_registry", "server", "host"]
+prompt = "Server Host"
+required = true
+type = "text"
+
+[[elements]]
+default = 8081
+help = "HTTP server port (range: 1024-65535)"
+max = 65535
+min = 1024
+name = "registry_server_port"
+nickel_path = ["extension_registry", "server", "port"]
+prompt = "Server Port"
+required = true
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 4
+help = "Number of HTTP worker threads"
+max = 32
+min = 1
+name = "registry_server_workers"
+nickel_path = ["extension_registry", "server", "workers"]
+prompt = "Worker Threads"
+required = true
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = false
+help = "Enable CORS for cross-origin requests"
+name = "registry_server_cors_enabled"
+nickel_path = ["extension_registry", "server", "cors_enabled"]
+prompt = "Enable CORS"
+type = "confirm"
+
+[[elements]]
+default = true
+help = "Enable response compression"
+name = "registry_server_compression"
+nickel_path = ["extension_registry", "server", "compression"]
+prompt = "Enable Compression"
+type = "confirm"

.typedialog/platform/forms/fragments/installer/database-section.toml

@@ -0,0 +1,252 @@
+name = "database_section"
+description = "Installer Database Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "database_section_header"
+title = "🗄️ Database Configuration"
+type = "section_header"
+
+# Database Initialization
+[[elements]]
+default = true
+help = "Automatically initialize databases during installation"
+name = "auto_init_database"
+nickel_path = ["installer", "database", "auto_init"]
+prompt = "Auto-Initialize Database"
+type = "confirm"
+
+[[elements]]
+condition = "auto_init_database == true"
+default = true
+help = "Run migrations automatically during installation"
+name = "auto_migrate"
+nickel_path = ["installer", "database", "auto_migrate"]
+prompt = "Auto-Migrate"
+type = "confirm"
+
+[[elements]]
+condition = "auto_init_database == true"
+default = true
+help = "Create default database schema and tables"
+name = "create_schema"
+nickel_path = ["installer", "database", "create_schema"]
+prompt = "Create Schema"
+type = "confirm"
+
+# Migration Settings
+[[elements]]
+condition = "auto_migrate == true"
+default = "/var/lib/provisioning/migrations"
+help = "Directory containing database migration files"
+name = "migrations_directory"
+nickel_path = ["installer", "database", "migrations", "directory"]
+prompt = "Migrations Directory"
+type = "text"
+
+[[elements]]
+condition = "auto_migrate == true"
+default = "auto"
+help = "Migration version strategy"
+name = "migration_strategy"
+nickel_path = ["installer", "database", "migrations", "strategy"]
+options = ["auto", "manual", "sequential"]
+prompt = "Migration Strategy"
+type = "select"
+
+[[elements]]
+condition = "auto_migrate == true"
+default = 300
+help = "Migration timeout in seconds"
+min = 30
+name = "migration_timeout_seconds"
+nickel_path = ["installer", "database", "migrations", "timeout_seconds"]
+prompt = "Migration Timeout (seconds)"
+type = "custom"
+custom_type = "Number"
+
+# Database Backup
+[[elements]]
+default = true
+help = "Create database backup before installation/upgrade"
+name = "backup_before_install"
+nickel_path = ["installer", "database", "backup", "before_install"]
+prompt = "Backup Before Install"
+type = "confirm"
+
+[[elements]]
+condition = "backup_before_install == true"
+default = "/var/backups/provisioning"
+help = "Directory for database backups"
+name = "backup_directory"
+nickel_path = ["installer", "database", "backup", "directory"]
+prompt = "Backup Directory"
+type = "text"
+
+[[elements]]
+condition = "backup_before_install == true"
+default = "full"
+help = "Backup type"
+name = "backup_type"
+nickel_path = ["installer", "database", "backup", "type"]
+options = ["full", "incremental", "differential"]
+prompt = "Backup Type"
+type = "select"
+
+[[elements]]
+condition = "backup_before_install == true"
+default = true
+help = "Compress database backups"
+name = "compress_backups"
+nickel_path = ["installer", "database", "backup", "compress"]
+prompt = "Compress Backups"
+type = "confirm"
+
+[[elements]]
+condition = "backup_before_install == true"
+default = 7
+help = "Backup retention in days"
+max = 365
+min = 1
+name = "backup_retention_days"
+nickel_path = ["installer", "database", "backup", "retention_days"]
+prompt = "Backup Retention (days)"
+type = "custom"
+custom_type = "Number"
+
+# Database Verification
+[[elements]]
+default = true
+help = "Verify database integrity after installation"
+name = "verify_database"
+nickel_path = ["installer", "database", "verification", "enabled"]
+prompt = "Verify Database"
+type = "confirm"
+
+[[elements]]
+condition = "verify_database == true"
+default = true
+help = "Check database consistency"
+name = "check_consistency"
+nickel_path = ["installer", "database", "verification", "check_consistency"]
+prompt = "Check Consistency"
+type = "confirm"
+
+[[elements]]
+condition = "verify_database == true"
+default = true
+help = "Check for missing indices"
+name = "check_indices"
+nickel_path = ["installer", "database", "verification", "check_indices"]
+prompt = "Check Indices"
+type = "confirm"
+
+[[elements]]
+condition = "verify_database == true"
+default = true
+help = "Validate foreign key relationships"
+name = "check_foreign_keys"
+nickel_path = ["installer", "database", "verification", "check_foreign_keys"]
+prompt = "Check Foreign Keys"
+type = "confirm"
+
+# Data Seeding
+[[elements]]
+default = false
+help = "Seed database with sample data"
+name = "seed_database"
+nickel_path = ["installer", "database", "seeding", "enabled"]
+prompt = "Seed Database"
+type = "confirm"
+
+[[elements]]
+condition = "seed_database == true"
+default = "minimal"
+help = "Sample data size"
+name = "seed_data_size"
+nickel_path = ["installer", "database", "seeding", "data_size"]
+options = ["minimal", "standard", "large"]
+prompt = "Seed Data Size"
+type = "select"
+
+[[elements]]
+condition = "seed_database == true"
+default = "seeding-data.sql"
+help = "SQL file containing seed data"
+name = "seed_data_file"
+nickel_path = ["installer", "database", "seeding", "data_file"]
+prompt = "Seed Data File"
+type = "text"
+
+# Database Pooling
+[[elements]]
+default = 10
+help = "Database connection pool size (range: 1-100)"
+max = 100
+min = 1
+name = "connection_pool_size"
+nickel_path = ["installer", "database", "pool_size"]
+prompt = "Connection Pool Size"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 300
+help = "Connection pool timeout in seconds (range: 10-3600)"
+max = 3600
+min = 10
+name = "connection_pool_timeout"
+nickel_path = ["installer", "database", "pool_timeout_seconds"]
+prompt = "Pool Timeout (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 3600
+help = "Connection idle timeout in seconds (range: 60-14400)"
+max = 14400
+min = 60
+name = "connection_idle_timeout"
+nickel_path = ["installer", "database", "idle_timeout_seconds"]
+prompt = "Idle Timeout (seconds)"
+type = "custom"
+custom_type = "Number"
+
+# Database Optimization
+[[elements]]
+default = false
+help = "Optimize database after installation"
+name = "optimize_database"
+nickel_path = ["installer", "database", "optimization", "enabled"]
+prompt = "Optimize Database"
+type = "confirm"
+
+[[elements]]
+condition = "optimize_database == true"
+default = true
+help = "Analyze query statistics"
+name = "analyze_statistics"
+nickel_path = ["installer", "database", "optimization", "analyze_statistics"]
+prompt = "Analyze Statistics"
+type = "confirm"
+
+[[elements]]
+condition = "optimize_database == true"
+default = true
+help = "Rebuild indices"
+name = "rebuild_indices"
+nickel_path = ["installer", "database", "optimization", "rebuild_indices"]
+prompt = "Rebuild Indices"
+type = "confirm"
+
+[[elements]]
+condition = "optimize_database == true"
+default = true
+help = "Vacuum database (reclaim space)"
+name = "vacuum_database"
+nickel_path = ["installer", "database", "optimization", "vacuum"]
+prompt = "Vacuum Database"
+type = "confirm"

.typedialog/platform/forms/fragments/installer/ha-section.toml

@@ -0,0 +1,302 @@
+name = "ha_section"
+description = "Installer High Availability Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "ha_section_header"
+title = "🔄 High Availability"
+type = "section_header"
+
+# HA Enablement
+[[elements]]
+default = false
+help = "Enable high availability configuration"
+name = "ha_enabled"
+nickel_path = ["installer", "ha", "enabled"]
+prompt = "Enable High Availability"
+type = "confirm"
+
+# Cluster Configuration (conditional on HA enabled)
+[[elements]]
+condition = "ha_enabled == true"
+default = 3
+help = "Number of nodes in the HA cluster"
+max = 256
+min = 3
+name = "ha_cluster_size"
+nickel_path = ["installer", "ha", "cluster_size"]
+prompt = "Cluster Size"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "ha_enabled == true"
+default = "consul"
+help = "Service discovery backend for cluster coordination"
+name = "ha_discovery_backend"
+nickel_path = ["installer", "ha", "discovery_backend"]
+options = ["consul", "etcd", "zookeeper"]
+prompt = "Discovery Backend"
+type = "select"
+
+# Cluster Node Configuration (conditional)
+[[elements]]
+condition = "ha_enabled == true"
+default = "replica"
+help = "Role of this node in the cluster"
+name = "ha_node_role"
+nickel_path = ["installer", "ha", "node_role"]
+options = ["primary", "replica", "observer"]
+prompt = "Node Role"
+type = "select"
+
+[[elements]]
+condition = "ha_enabled == true"
+default = ""
+help = "Comma-separated list of other cluster node addresses"
+name = "ha_cluster_nodes"
+nickel_path = ["installer", "ha", "cluster_nodes"]
+prompt = "Cluster Nodes"
+type = "text"
+
+# Replication Configuration
+[[elements]]
+condition = "ha_enabled == true"
+default = true
+help = "Enable database replication between cluster nodes"
+name = "ha_db_replication_enabled"
+nickel_path = ["installer", "ha", "database", "replication_enabled"]
+prompt = "Enable DB Replication"
+type = "confirm"
+
+[[elements]]
+condition = "ha_db_replication_enabled == true"
+default = "synchronous"
+help = "Database replication mode"
+name = "ha_db_replication_mode"
+nickel_path = ["installer", "ha", "database", "replication_mode"]
+options = ["synchronous", "asynchronous", "semi_synchronous"]
+prompt = "DB Replication Mode"
+type = "select"
+
+[[elements]]
+condition = "ha_enabled == true && ha_db_replication_enabled == true"
+default = 3
+help = "Minimum quorum size for write operations (range: 1-256)"
+max = 256
+min = 1
+name = "ha_db_quorum_size"
+nickel_path = ["installer", "ha", "database", "quorum_size"]
+prompt = "DB Quorum Size"
+type = "custom"
+custom_type = "Number"
+
+# Health Checks
+[[elements]]
+condition = "ha_enabled == true"
+default = true
+help = "Enable automated health checks for cluster nodes"
+name = "ha_health_checks_enabled"
+nickel_path = ["installer", "ha", "health_checks", "enabled"]
+prompt = "Enable Health Checks"
+type = "confirm"
+
+[[elements]]
+condition = "ha_health_checks_enabled == true"
+default = 10
+help = "Health check interval in seconds"
+max = 120
+min = 1
+name = "ha_health_check_interval"
+nickel_path = ["installer", "ha", "health_checks", "interval_seconds"]
+prompt = "Health Check Interval (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "ha_health_checks_enabled == true"
+default = 30000
+help = "Health check timeout in milliseconds"
+max = 300000
+min = 1000
+name = "ha_health_check_timeout"
+nickel_path = ["installer", "ha", "health_checks", "timeout_ms"]
+prompt = "Health Check Timeout (ms)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "ha_health_checks_enabled == true"
+default = 3
+help = "Number of failed checks before marking node as unhealthy"
+max = 10
+min = 1
+name = "ha_health_check_failure_threshold"
+nickel_path = ["installer", "ha", "health_checks", "failure_threshold"]
+prompt = "Failure Threshold"
+type = "custom"
+custom_type = "Number"
+
+# Failover Configuration
+[[elements]]
+condition = "ha_enabled == true"
+default = true
+help = "Enable automatic failover to replica nodes"
+name = "ha_failover_enabled"
+nickel_path = ["installer", "ha", "failover", "enabled"]
+prompt = "Enable Failover"
+type = "confirm"
+
+[[elements]]
+condition = "ha_failover_enabled == true"
+default = "automatic"
+help = "Failover strategy"
+name = "ha_failover_strategy"
+nickel_path = ["installer", "ha", "failover", "strategy"]
+options = ["automatic", "manual", "priority_based"]
+prompt = "Failover Strategy"
+type = "select"
+
+[[elements]]
+condition = "ha_failover_enabled == true"
+default = 60
+help = "Failover delay in seconds (wait before failing over)"
+max = 600
+min = 0
+name = "ha_failover_delay"
+nickel_path = ["installer", "ha", "failover", "delay_seconds"]
+prompt = "Failover Delay (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "ha_failover_enabled == true && ha_failover_strategy == 'priority_based'"
+default = 100
+help = "Priority value for node selection in failover (higher = higher priority)"
+max = 1000
+min = 0
+name = "ha_node_priority"
+nickel_path = ["installer", "ha", "failover", "node_priority"]
+prompt = "Node Priority"
+type = "custom"
+custom_type = "Number"
+
+# Split Brain Prevention
+[[elements]]
+condition = "ha_enabled == true"
+default = true
+help = "Enable split-brain detection and prevention"
+name = "ha_split_brain_enabled"
+nickel_path = ["installer", "ha", "split_brain", "enabled"]
+prompt = "Enable Split-Brain Prevention"
+type = "confirm"
+
+[[elements]]
+condition = "ha_split_brain_enabled == true"
+default = 30
+help = "Timeout for detecting split-brain in seconds"
+max = 300
+min = 5
+name = "ha_split_brain_timeout"
+nickel_path = ["installer", "ha", "split_brain", "timeout_seconds"]
+prompt = "Split-Brain Timeout (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "ha_split_brain_enabled == true"
+default = "quorum_based"
+help = "Split-brain resolution strategy"
+name = "ha_split_brain_strategy"
+nickel_path = ["installer", "ha", "split_brain", "strategy"]
+options = ["quorum_based", "majority_wins", "freeze"]
+prompt = "Split-Brain Strategy"
+type = "select"
+
+# Backup and Recovery
+[[elements]]
+condition = "ha_enabled == true"
+default = true
+help = "Enable automated cluster state backups"
+name = "ha_backup_enabled"
+nickel_path = ["installer", "ha", "backup", "enabled"]
+prompt = "Enable Backups"
+type = "confirm"
+
+[[elements]]
+condition = "ha_backup_enabled == true"
+default = 3600
+help = "Backup interval in seconds (default: 1 hour, range: 300-86400)"
+max = 86400
+min = 300
+name = "ha_backup_interval"
+nickel_path = ["installer", "ha", "backup", "interval_seconds"]
+prompt = "Backup Interval (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "ha_backup_enabled == true"
+default = 7
+help = "Backup retention in days"
+max = 365
+min = 1
+name = "ha_backup_retention_days"
+nickel_path = ["installer", "ha", "backup", "retention_days"]
+prompt = "Backup Retention (days)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "ha_backup_enabled == true"
+default = "/var/backups/provisioning-ha"
+help = "Directory for HA cluster backups"
+name = "ha_backup_directory"
+nickel_path = ["installer", "ha", "backup", "directory"]
+prompt = "Backup Directory"
+type = "text"
+
+# Load Distribution
+[[elements]]
+condition = "ha_enabled == true"
+default = true
+help = "Enable load distribution across cluster nodes"
+name = "ha_load_distribution_enabled"
+nickel_path = ["installer", "ha", "load_distribution", "enabled"]
+prompt = "Enable Load Distribution"
+type = "confirm"
+
+[[elements]]
+condition = "ha_load_distribution_enabled == true"
+default = "round_robin"
+help = "Load distribution algorithm"
+name = "ha_load_distribution_algorithm"
+nickel_path = ["installer", "ha", "load_distribution", "algorithm"]
+options = ["round_robin", "least_connections", "weighted", "ip_hash"]
+prompt = "Load Distribution Algorithm"
+type = "select"
+
+# Metrics and Monitoring
+[[elements]]
+condition = "ha_enabled == true"
+default = true
+help = "Enable detailed HA metrics collection"
+name = "ha_metrics_enabled"
+nickel_path = ["installer", "ha", "metrics", "enabled"]
+prompt = "Enable Metrics"
+type = "confirm"
+
+[[elements]]
+condition = "ha_metrics_enabled == true"
+default = 60
+help = "Metrics collection interval in seconds (range: 5-300)"
+max = 300
+min = 5
+name = "ha_metrics_interval"
+nickel_path = ["installer", "ha", "metrics", "interval_seconds"]
+prompt = "Metrics Interval (seconds)"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/installer/installation-section.toml

@@ -0,0 +1,242 @@
+name = "installation_section"
+description = "Installer Installation Strategy Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "installation_section_header"
+title = "🔧 Installation Strategy"
+type = "section_header"
+
+# Installation Mode
+[[elements]]
+default = "interactive"
+help = "Installation mode and UI"
+name = "installation_mode"
+nickel_path = ["installer", "installation", "mode"]
+options = ["interactive", "unattended", "api"]
+prompt = "Installation Mode"
+type = "select"
+
+# Parallel Service Installation
+[[elements]]
+default = 1
+help = "Number of services to install in parallel (range: 1-10, 1 = sequential)"
+max = 10
+min = 1
+name = "parallel_services"
+nickel_path = ["installer", "installation", "parallel_services"]
+prompt = "Parallel Services"
+type = "custom"
+custom_type = "Number"
+
+# Installation Timeout
+[[elements]]
+default = 1800
+help = "Installation timeout in seconds (range: 0-14400, 0 = no timeout)"
+max = 14400
+min = 0
+name = "installation_timeout_seconds"
+nickel_path = ["installer", "installation", "timeout_seconds"]
+prompt = "Installation Timeout (seconds)"
+type = "custom"
+custom_type = "Number"
+
+# Rollback Strategy
+[[elements]]
+default = true
+help = "Automatically rollback on installation failure"
+name = "rollback_on_failure"
+nickel_path = ["installer", "installation", "rollback_on_failure"]
+prompt = "Rollback on Failure"
+type = "confirm"
+
+[[elements]]
+condition = "rollback_on_failure == true"
+default = "automatic"
+help = "Rollback strategy when failure occurs"
+name = "rollback_strategy"
+nickel_path = ["installer", "installation", "rollback_strategy"]
+options = ["automatic", "manual", "snapshot"]
+prompt = "Rollback Strategy"
+type = "select"
+
+[[elements]]
+condition = "rollback_on_failure == true && rollback_strategy == 'snapshot'"
+default = true
+help = "Create system snapshot before installation for rollback"
+name = "create_pre_install_snapshot"
+nickel_path = ["installer", "installation", "create_snapshot"]
+prompt = "Create Pre-Install Snapshot"
+type = "confirm"
+
+# Installation Logging
+[[elements]]
+default = "info"
+help = "Installation logging verbosity"
+name = "log_level"
+nickel_path = ["installer", "installation", "log_level"]
+options = ["debug", "info", "warn", "error"]
+prompt = "Log Level"
+type = "select"
+
+[[elements]]
+default = "/var/log/provisioning-installer"
+help = "Directory for installation logs"
+name = "log_directory"
+nickel_path = ["installer", "installation", "log_directory"]
+prompt = "Log Directory"
+type = "text"
+
+[[elements]]
+default = true
+help = "Write installation logs to file"
+name = "write_logs_to_file"
+nickel_path = ["installer", "installation", "write_to_file"]
+prompt = "Write Logs to File"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Upload installation logs to remote server"
+name = "upload_logs"
+nickel_path = ["installer", "installation", "upload_logs", "enabled"]
+prompt = "Upload Logs"
+type = "confirm"
+
+[[elements]]
+condition = "upload_logs == true"
+default = ""
+help = "Remote log server URL"
+name = "log_server_url"
+nickel_path = ["installer", "installation", "upload_logs", "server_url"]
+prompt = "Log Server URL"
+required = true
+type = "text"
+
+# Artifact Handling
+[[elements]]
+default = false
+help = "Keep temporary artifacts after installation completes"
+name = "keep_artifacts"
+nickel_path = ["installer", "installation", "keep_artifacts"]
+prompt = "Keep Artifacts"
+type = "confirm"
+
+[[elements]]
+condition = "keep_artifacts == true"
+default = "/var/tmp/provisioning-install-artifacts"
+help = "Directory for keeping installation artifacts"
+name = "artifacts_directory"
+nickel_path = ["installer", "installation", "artifacts_directory"]
+prompt = "Artifacts Directory"
+type = "text"
+
+# Installation Hooks
+[[elements]]
+default = false
+help = "Execute custom scripts during installation"
+name = "enable_hooks"
+nickel_path = ["installer", "installation", "hooks", "enabled"]
+prompt = "Enable Installation Hooks"
+type = "confirm"
+
+[[elements]]
+condition = "enable_hooks == true"
+default = ""
+help = "Script to run before installation starts"
+name = "pre_install_hook"
+nickel_path = ["installer", "installation", "hooks", "pre_install_script"]
+prompt = "Pre-Install Hook Script"
+type = "text"
+
+[[elements]]
+condition = "enable_hooks == true"
+default = ""
+help = "Script to run after installation completes successfully"
+name = "post_install_hook"
+nickel_path = ["installer", "installation", "hooks", "post_install_script"]
+prompt = "Post-Install Hook Script"
+type = "text"
+
+[[elements]]
+condition = "enable_hooks == true"
+default = ""
+help = "Script to run on installation failure"
+name = "on_failure_hook"
+nickel_path = ["installer", "installation", "hooks", "on_failure_script"]
+prompt = "On-Failure Hook Script"
+type = "text"
+
+# Validation After Installation
+[[elements]]
+default = true
+help = "Validate installation was successful"
+name = "validate_installation"
+nickel_path = ["installer", "installation", "validation", "enabled"]
+prompt = "Validate Installation"
+type = "confirm"
+
+[[elements]]
+condition = "validate_installation == true"
+default = 30000
+help = "Installation validation timeout in milliseconds (range: 5000-300000)"
+max = 300000
+min = 5000
+name = "validation_timeout"
+nickel_path = ["installer", "installation", "validation", "timeout_ms"]
+prompt = "Validation Timeout (ms)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "validate_installation == true"
+default = true
+help = "Check all services are running"
+name = "validate_services_running"
+nickel_path = ["installer", "installation", "validation", "services_running"]
+prompt = "Validate Services Running"
+type = "confirm"
+
+[[elements]]
+condition = "validate_installation == true"
+default = true
+help = "Validate network connectivity"
+name = "validate_connectivity"
+nickel_path = ["installer", "installation", "validation", "connectivity"]
+prompt = "Validate Connectivity"
+type = "confirm"
+
+# Auto-Recovery
+[[elements]]
+default = false
+help = "Enable automatic recovery if services fail after installation"
+name = "auto_recovery_enabled"
+nickel_path = ["installer", "installation", "auto_recovery", "enabled"]
+prompt = "Enable Auto-Recovery"
+type = "confirm"
+
+[[elements]]
+condition = "auto_recovery_enabled == true"
+default = 3
+help = "Maximum number of recovery attempts"
+max = 10
+min = 1
+name = "auto_recovery_max_attempts"
+nickel_path = ["installer", "installation", "auto_recovery", "max_attempts"]
+prompt = "Max Recovery Attempts"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "auto_recovery_enabled == true"
+default = 30
+help = "Delay in seconds before attempting recovery"
+min = 5
+name = "auto_recovery_delay_seconds"
+nickel_path = ["installer", "installation", "auto_recovery", "delay_seconds"]
+prompt = "Recovery Delay (seconds)"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/installer/networking-section.toml

@@ -0,0 +1,293 @@
+name = "networking_section"
+description = "Installer Networking Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "installer_networking_section_header"
+title = "🌐 Networking Configuration"
+type = "section_header"
+
+# Network Interface Configuration
+[[elements]]
+default = "0.0.0.0"
+help = "Bind address for all services (0.0.0.0 = listen on all interfaces)"
+name = "bind_address"
+nickel_path = ["installer", "networking", "bind_address"]
+prompt = "Bind Address"
+required = true
+type = "text"
+
+[[elements]]
+default = "provisioning.local"
+help = "Primary hostname for services"
+name = "primary_hostname"
+nickel_path = ["installer", "networking", "primary_hostname"]
+prompt = "Primary Hostname"
+required = true
+type = "text"
+
+[[elements]]
+default = ""
+help = "Additional hostnames/aliases (comma-separated)"
+name = "additional_hostnames"
+nickel_path = ["installer", "networking", "additional_hostnames"]
+prompt = "Additional Hostnames"
+type = "text"
+
+# DNS Configuration
+[[elements]]
+default = true
+help = "Configure DNS for provisioning services"
+name = "configure_dns"
+nickel_path = ["installer", "networking", "dns", "configure"]
+prompt = "Configure DNS"
+type = "confirm"
+
+[[elements]]
+condition = "configure_dns == true"
+default = "127.0.0.1"
+help = "DNS server address"
+name = "dns_server"
+nickel_path = ["installer", "networking", "dns", "server"]
+prompt = "DNS Server"
+type = "text"
+
+[[elements]]
+condition = "configure_dns == true"
+default = 53
+help = "DNS server port"
+max = 65535
+min = 1
+name = "dns_port"
+nickel_path = ["installer", "networking", "dns", "port"]
+prompt = "DNS Port"
+type = "custom"
+custom_type = "Number"
+
+# TLS/HTTPS Configuration
+[[elements]]
+default = false
+help = "Enable TLS/HTTPS for service communication"
+name = "enable_tls"
+nickel_path = ["installer", "networking", "tls", "enabled"]
+prompt = "Enable TLS"
+type = "confirm"
+
+[[elements]]
+condition = "enable_tls == true"
+default = "self_signed"
+help = "TLS certificate source"
+name = "tls_certificate_source"
+nickel_path = ["installer", "networking", "tls", "certificate_source"]
+options = ["self_signed", "letsencrypt", "vault", "provided"]
+prompt = "TLS Certificate Source"
+type = "select"
+
+[[elements]]
+condition = "enable_tls == true && tls_certificate_source == 'letsencrypt'"
+default = ""
+help = "Let's Encrypt email for certificate registration"
+name = "letsencrypt_email"
+nickel_path = ["installer", "networking", "tls", "letsencrypt_email"]
+prompt = "Let's Encrypt Email"
+required = true
+type = "text"
+
+[[elements]]
+condition = "enable_tls == true && tls_certificate_source == 'provided'"
+default = "/etc/provisioning/certs/server.crt"
+help = "Path to provided certificate file"
+name = "tls_certificate_path"
+nickel_path = ["installer", "networking", "tls", "certificate_path"]
+prompt = "Certificate Path"
+type = "text"
+
+[[elements]]
+condition = "enable_tls == true && tls_certificate_source == 'provided'"
+default = "/etc/provisioning/certs/server.key"
+help = "Path to provided private key file"
+name = "tls_key_path"
+nickel_path = ["installer", "networking", "tls", "key_path"]
+prompt = "Private Key Path"
+type = "text"
+
+# Firewall Configuration
+[[elements]]
+default = true
+help = "Configure firewall rules for provisioning services"
+name = "configure_firewall"
+nickel_path = ["installer", "networking", "firewall", "configure"]
+prompt = "Configure Firewall"
+type = "confirm"
+
+[[elements]]
+condition = "configure_firewall == true"
+default = "iptables"
+help = "Firewall backend"
+name = "firewall_backend"
+nickel_path = ["installer", "networking", "firewall", "backend"]
+options = ["iptables", "firewalld", "ufw"]
+prompt = "Firewall Backend"
+type = "select"
+
+[[elements]]
+condition = "configure_firewall == true"
+default = true
+help = "Enable inbound rate limiting"
+name = "firewall_rate_limit_enabled"
+nickel_path = ["installer", "networking", "firewall", "rate_limiting", "enabled"]
+prompt = "Enable Rate Limiting"
+type = "confirm"
+
+[[elements]]
+condition = "firewall_rate_limit_enabled == true"
+default = 100
+help = "Maximum requests per minute per IP"
+min = 1
+name = "firewall_rate_limit_rpm"
+nickel_path = ["installer", "networking", "firewall", "rate_limiting", "requests_per_minute"]
+prompt = "Rate Limit (req/min)"
+type = "custom"
+custom_type = "Number"
+
+# Load Balancer Configuration
+[[elements]]
+default = false
+help = "Install and configure load balancer"
+name = "install_load_balancer"
+nickel_path = ["installer", "networking", "load_balancer", "enabled"]
+prompt = "Install Load Balancer"
+type = "confirm"
+
+[[elements]]
+condition = "install_load_balancer == true"
+default = "nginx"
+help = "Load balancer software"
+name = "load_balancer_type"
+nickel_path = ["installer", "networking", "load_balancer", "type"]
+options = ["nginx", "haproxy", "traefik"]
+prompt = "Load Balancer Type"
+type = "select"
+
+[[elements]]
+condition = "install_load_balancer == true"
+default = 80
+help = "Load balancer HTTP port (range: ${constraint.common.server.port.min}-${constraint.common.server.port.max})"
+max = "${constraint.common.server.port.max}"
+min = "${constraint.common.server.port.min}"
+name = "load_balancer_http_port"
+nickel_path = ["installer", "networking", "load_balancer", "http_port"]
+prompt = "Load Balancer HTTP Port"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "install_load_balancer == true"
+default = 443
+help = "Load balancer HTTPS port (range: ${constraint.common.server.port.min}-${constraint.common.server.port.max})"
+max = "${constraint.common.server.port.max}"
+min = "${constraint.common.server.port.min}"
+name = "load_balancer_https_port"
+nickel_path = ["installer", "networking", "load_balancer", "https_port"]
+prompt = "Load Balancer HTTPS Port"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "install_load_balancer == true"
+default = "round_robin"
+help = "Load balancing algorithm"
+name = "load_balancer_algorithm"
+nickel_path = ["installer", "networking", "load_balancer", "algorithm"]
+options = ["round_robin", "least_connections", "ip_hash", "weighted"]
+prompt = "Load Balancing Algorithm"
+type = "select"
+
+# Ingress Configuration (for Kubernetes)
+[[elements]]
+default = false
+help = "Configure Kubernetes Ingress"
+name = "configure_ingress"
+nickel_path = ["installer", "networking", "ingress", "configure"]
+prompt = "Configure Ingress"
+type = "confirm"
+
+[[elements]]
+condition = "configure_ingress == true"
+default = "nginx"
+help = "Ingress controller type"
+name = "ingress_controller"
+nickel_path = ["installer", "networking", "ingress", "controller"]
+options = ["nginx", "istio", "traefik"]
+prompt = "Ingress Controller"
+type = "select"
+
+[[elements]]
+condition = "configure_ingress == true"
+default = ""
+help = "Ingress domain name"
+name = "ingress_domain"
+nickel_path = ["installer", "networking", "ingress", "domain"]
+prompt = "Ingress Domain"
+required = true
+type = "text"
+
+# Proxy Configuration
+[[elements]]
+default = false
+help = "Configure HTTP proxy for outbound connections"
+name = "enable_http_proxy"
+nickel_path = ["installer", "networking", "proxy", "enabled"]
+prompt = "Enable HTTP Proxy"
+type = "confirm"
+
+[[elements]]
+condition = "enable_http_proxy == true"
+default = ""
+help = "HTTP proxy URL (e.g., http://proxy.example.com:3128)"
+name = "http_proxy_url"
+nickel_path = ["installer", "networking", "proxy", "http_url"]
+prompt = "HTTP Proxy URL"
+required = true
+type = "text"
+
+[[elements]]
+condition = "enable_http_proxy == true"
+default = ""
+help = "HTTPS proxy URL"
+name = "https_proxy_url"
+nickel_path = ["installer", "networking", "proxy", "https_url"]
+prompt = "HTTPS Proxy URL"
+type = "text"
+
+[[elements]]
+condition = "enable_http_proxy == true"
+default = ""
+help = "No proxy list (hosts to bypass proxy, comma-separated)"
+name = "no_proxy_list"
+nickel_path = ["installer", "networking", "proxy", "no_proxy"]
+prompt = "No Proxy List"
+type = "text"
+
+# Network Monitoring
+[[elements]]
+default = false
+help = "Enable network traffic monitoring"
+name = "enable_traffic_monitoring"
+nickel_path = ["installer", "networking", "monitoring", "enabled"]
+prompt = "Enable Traffic Monitoring"
+type = "confirm"
+
+[[elements]]
+condition = "enable_traffic_monitoring == true"
+default = 60
+help = "Traffic monitoring interval in seconds"
+min = 5
+name = "traffic_monitoring_interval"
+nickel_path = ["installer", "networking", "monitoring", "interval_seconds"]
+prompt = "Monitoring Interval (seconds)"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/installer/post-install-section.toml

@@ -0,0 +1,321 @@
+name = "post_install_section"
+description = "Installer Post-Installation Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "post_install_section_header"
+title = "✨ Post-Installation"
+type = "section_header"
+
+# Post-Installation Tasks
+[[elements]]
+default = true
+help = "Execute post-installation tasks and configuration"
+name = "run_post_install_tasks"
+nickel_path = ["installer", "post_install", "enabled"]
+prompt = "Run Post-Install Tasks"
+type = "confirm"
+
+# Service Configuration
+[[elements]]
+condition = "run_post_install_tasks == true"
+default = true
+help = "Configure default admin user and initial policies"
+name = "configure_defaults"
+nickel_path = ["installer", "post_install", "configure_defaults"]
+prompt = "Configure Defaults"
+type = "confirm"
+
+[[elements]]
+condition = "run_post_install_tasks == true && configure_defaults == true"
+default = "admin"
+help = "Default admin username"
+name = "default_admin_user"
+nickel_path = ["installer", "post_install", "default_admin_user"]
+prompt = "Default Admin User"
+type = "text"
+
+[[elements]]
+condition = "run_post_install_tasks == true && configure_defaults == true"
+default = ""
+help = "Default admin password (leave empty to auto-generate)"
+name = "default_admin_password"
+nickel_path = ["installer", "post_install", "default_admin_password"]
+prompt = "Default Admin Password"
+type = "password"
+
+[[elements]]
+condition = "run_post_install_tasks == true && configure_defaults == true"
+default = ""
+help = "Default admin email address"
+name = "default_admin_email"
+nickel_path = ["installer", "post_install", "default_admin_email"]
+prompt = "Default Admin Email"
+type = "text"
+
+# Initial Configuration
+[[elements]]
+condition = "run_post_install_tasks == true"
+default = true
+help = "Import initial workspace configuration"
+name = "import_workspace_config"
+nickel_path = ["installer", "post_install", "import_workspace_config"]
+prompt = "Import Workspace Config"
+type = "confirm"
+
+[[elements]]
+condition = "import_workspace_config == true"
+default = "/etc/provisioning/workspace-config.yaml"
+help = "Path to workspace configuration file"
+name = "workspace_config_path"
+nickel_path = ["installer", "post_install", "workspace_config_path"]
+prompt = "Workspace Config Path"
+type = "text"
+
+# Extension Loading
+[[elements]]
+condition = "run_post_install_tasks == true"
+default = false
+help = "Load extensions from registry after installation"
+name = "load_extensions_post_install"
+nickel_path = ["installer", "post_install", "load_extensions"]
+prompt = "Load Extensions"
+type = "confirm"
+
+[[elements]]
+condition = "load_extensions_post_install == true"
+default = ""
+help = "Comma-separated list of extension names to load"
+name = "extensions_to_load"
+nickel_path = ["installer", "post_install", "extensions_to_load"]
+prompt = "Extensions to Load"
+type = "text"
+
+# API Setup
+[[elements]]
+condition = "run_post_install_tasks == true"
+default = false
+help = "Configure API tokens and authentication"
+name = "setup_api_auth"
+nickel_path = ["installer", "post_install", "setup_api_auth"]
+prompt = "Setup API Authentication"
+type = "confirm"
+
+[[elements]]
+condition = "setup_api_auth == true"
+default = "jwt"
+help = "API authentication method"
+name = "api_auth_method"
+nickel_path = ["installer", "post_install", "api_auth_method"]
+options = ["jwt", "oauth2", "api_key"]
+prompt = "API Auth Method"
+type = "select"
+
+[[elements]]
+condition = "setup_api_auth == true && api_auth_method == 'jwt'"
+default = ""
+help = "JWT issuer URL"
+name = "jwt_issuer"
+nickel_path = ["installer", "post_install", "jwt_issuer"]
+prompt = "JWT Issuer"
+type = "text"
+
+# Verification Tasks
+[[elements]]
+condition = "run_post_install_tasks == true"
+default = true
+help = "Run verification tests after installation"
+name = "run_verification_tests"
+nickel_path = ["installer", "post_install", "verification", "enabled"]
+prompt = "Run Verification Tests"
+type = "confirm"
+
+[[elements]]
+condition = "run_verification_tests == true"
+default = 300
+help = "Verification test timeout in seconds (range: 30-3600)"
+max = 3600
+min = 30
+name = "verification_timeout"
+nickel_path = ["installer", "post_install", "verification", "timeout_seconds"]
+prompt = "Verification Timeout (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "run_verification_tests == true"
+default = true
+help = "Test API connectivity"
+name = "test_api_connectivity"
+nickel_path = ["installer", "post_install", "verification", "test_api_connectivity"]
+prompt = "Test API Connectivity"
+type = "confirm"
+
+[[elements]]
+condition = "run_verification_tests == true"
+default = true
+help = "Test database connectivity"
+name = "test_database_connectivity"
+nickel_path = ["installer", "post_install", "verification", "test_database_connectivity"]
+prompt = "Test Database Connectivity"
+type = "confirm"
+
+[[elements]]
+condition = "run_verification_tests == true"
+default = true
+help = "Test service health checks"
+name = "test_service_health"
+nickel_path = ["installer", "post_install", "verification", "test_service_health"]
+prompt = "Test Service Health"
+type = "confirm"
+
+[[elements]]
+condition = "run_verification_tests == true"
+default = false
+help = "Run performance benchmarks"
+name = "run_benchmarks"
+nickel_path = ["installer", "post_install", "verification", "run_benchmarks"]
+prompt = "Run Benchmarks"
+type = "confirm"
+
+# Notification and Reporting
+[[elements]]
+condition = "run_post_install_tasks == true"
+default = false
+help = "Send installation completion notification"
+name = "send_notification"
+nickel_path = ["installer", "post_install", "notification", "enabled"]
+prompt = "Send Notification"
+type = "confirm"
+
+[[elements]]
+condition = "send_notification == true"
+default = "email"
+help = "Notification method"
+name = "notification_method"
+nickel_path = ["installer", "post_install", "notification", "method"]
+options = ["email", "webhook", "slack", "teams"]
+prompt = "Notification Method"
+type = "select"
+
+[[elements]]
+condition = "send_notification == true && notification_method == 'email'"
+default = ""
+help = "Email address for completion notification"
+name = "notification_email"
+nickel_path = ["installer", "post_install", "notification", "email_address"]
+prompt = "Notification Email"
+type = "text"
+
+[[elements]]
+condition = "send_notification == true && notification_method == 'webhook'"
+default = ""
+help = "Webhook URL for completion notification"
+name = "notification_webhook_url"
+nickel_path = ["installer", "post_install", "notification", "webhook_url"]
+prompt = "Webhook URL"
+type = "text"
+
+[[elements]]
+condition = "send_notification == true && notification_method == 'slack'"
+default = ""
+help = "Slack webhook URL"
+name = "notification_slack_webhook"
+nickel_path = ["installer", "post_install", "notification", "slack_webhook_url"]
+prompt = "Slack Webhook URL"
+type = "password"
+
+[[elements]]
+condition = "send_notification == true && notification_method == 'teams'"
+default = ""
+help = "Microsoft Teams webhook URL"
+name = "notification_teams_webhook"
+nickel_path = ["installer", "post_install", "notification", "teams_webhook_url"]
+prompt = "Teams Webhook URL"
+type = "password"
+
+# Documentation and Access Information
+[[elements]]
+condition = "run_post_install_tasks == true"
+default = true
+help = "Generate installation access information and documentation"
+name = "generate_access_info"
+nickel_path = ["installer", "post_install", "generate_access_info"]
+prompt = "Generate Access Info"
+type = "confirm"
+
+[[elements]]
+condition = "generate_access_info == true"
+default = "/var/provisioning/install-info.md"
+help = "Path to save installation access information"
+name = "access_info_path"
+nickel_path = ["installer", "post_install", "access_info_path"]
+prompt = "Access Info Path"
+type = "text"
+
+[[elements]]
+condition = "run_post_install_tasks == true"
+default = false
+help = "Create compressed archive of installation logs and configs"
+name = "create_archive"
+nickel_path = ["installer", "post_install", "create_archive"]
+prompt = "Create Archive"
+type = "confirm"
+
+[[elements]]
+condition = "create_archive == true"
+default = "/var/backups/provisioning-install-archive.tar.gz"
+help = "Path for installation archive"
+name = "archive_path"
+nickel_path = ["installer", "post_install", "archive_path"]
+prompt = "Archive Path"
+type = "text"
+
+# Cleanup Tasks
+[[elements]]
+condition = "run_post_install_tasks == true"
+default = true
+help = "Clean up temporary installation files"
+name = "cleanup_temp_files"
+nickel_path = ["installer", "post_install", "cleanup", "remove_temp_files"]
+prompt = "Cleanup Temp Files"
+type = "confirm"
+
+[[elements]]
+condition = "run_post_install_tasks == true"
+default = false
+help = "Remove installation artifacts (logs, scripts)"
+name = "cleanup_artifacts"
+nickel_path = ["installer", "post_install", "cleanup", "remove_artifacts"]
+prompt = "Cleanup Artifacts"
+type = "confirm"
+
+[[elements]]
+condition = "run_post_install_tasks == true"
+default = false
+help = "Run security hardening after installation"
+name = "run_security_hardening"
+nickel_path = ["installer", "post_install", "security_hardening", "enabled"]
+prompt = "Run Security Hardening"
+type = "confirm"
+
+[[elements]]
+condition = "run_security_hardening == true"
+default = true
+help = "Disable unnecessary services"
+name = "disable_unnecessary_services"
+nickel_path = ["installer", "post_install", "security_hardening", "disable_unnecessary_services"]
+prompt = "Disable Unnecessary Services"
+type = "confirm"
+
+[[elements]]
+condition = "run_security_hardening == true"
+default = true
+help = "Apply security patches"
+name = "apply_security_patches"
+nickel_path = ["installer", "post_install", "security_hardening", "apply_patches"]
+prompt = "Apply Security Patches"
+type = "confirm"

.typedialog/platform/forms/fragments/installer/preflight-section.toml

@@ -0,0 +1,209 @@
+name = "preflight_section"
+description = "Installer Preflight Checks Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "preflight_section_header"
+title = "✅ Preflight Checks"
+type = "section_header"
+
+# Disk Space Check
+[[elements]]
+default = true
+help = "Validate sufficient disk space before installation"
+name = "check_disk_space"
+nickel_path = ["installer", "preflight", "disk_space_check", "enabled"]
+prompt = "Check Disk Space"
+type = "confirm"
+
+[[elements]]
+condition = "check_disk_space == true"
+default = 50
+help = "Minimum required disk space in GB (range: 1-10000)"
+max = 10000
+min = 1
+name = "min_disk_gb"
+nickel_path = ["installer", "preflight", "disk_space_check", "min_disk_gb"]
+prompt = "Min Disk Space (GB)"
+type = "custom"
+custom_type = "Number"
+
+# Memory Check
+[[elements]]
+default = true
+help = "Validate sufficient RAM before installation"
+name = "check_memory"
+nickel_path = ["installer", "preflight", "memory_check", "enabled"]
+prompt = "Check Memory"
+type = "confirm"
+
+[[elements]]
+condition = "check_memory == true"
+default = 4
+help = "Minimum required RAM in GB"
+max = 512
+min = 1
+name = "min_memory_gb"
+nickel_path = ["installer", "preflight", "memory_check", "min_memory_gb"]
+prompt = "Min Memory (GB)"
+type = "custom"
+custom_type = "Number"
+
+# CPU Check
+[[elements]]
+default = true
+help = "Validate minimum CPU cores before installation"
+name = "check_cpu"
+nickel_path = ["installer", "preflight", "cpu_check", "enabled"]
+prompt = "Check CPU Cores"
+type = "confirm"
+
+[[elements]]
+condition = "check_cpu == true"
+default = 2
+help = "Minimum required CPU cores"
+max = 128
+min = 1
+name = "min_cpu_cores"
+nickel_path = ["installer", "preflight", "cpu_check", "min_cpu_cores"]
+prompt = "Min CPU Cores"
+type = "custom"
+custom_type = "Number"
+
+# Network Check
+[[elements]]
+default = true
+help = "Validate network connectivity before installation"
+name = "check_network"
+nickel_path = ["installer", "preflight", "network_check", "enabled"]
+prompt = "Check Network Connectivity"
+type = "confirm"
+
+[[elements]]
+condition = "check_network == true"
+default = ""
+help = "External host to ping for connectivity test (e.g., 8.8.8.8)"
+name = "network_check_host"
+nickel_path = ["installer", "preflight", "network_check", "test_host"]
+prompt = "Network Test Host"
+type = "text"
+
+# Dependency Check
+[[elements]]
+default = true
+help = "Validate required system dependencies are available"
+name = "check_dependencies"
+nickel_path = ["installer", "preflight", "dependency_check", "enabled"]
+prompt = "Check Dependencies"
+type = "confirm"
+
+[[elements]]
+condition = "check_dependencies == true"
+default = true
+help = "Check for required container runtime (docker/podman)"
+name = "check_container_runtime"
+nickel_path = ["installer", "preflight", "dependency_check", "container_runtime"]
+prompt = "Check Container Runtime"
+type = "confirm"
+
+[[elements]]
+condition = "check_dependencies == true"
+default = false
+help = "Check for Kubernetes cluster connectivity"
+name = "check_kubernetes"
+nickel_path = ["installer", "preflight", "dependency_check", "kubernetes"]
+prompt = "Check Kubernetes"
+type = "confirm"
+
+[[elements]]
+condition = "check_dependencies == true"
+default = false
+help = "Check for required Rust toolchain"
+name = "check_rust"
+nickel_path = ["installer", "preflight", "dependency_check", "rust_toolchain"]
+prompt = "Check Rust Toolchain"
+type = "confirm"
+
+[[elements]]
+condition = "check_dependencies == true"
+default = false
+help = "Check for Nushell script engine"
+name = "check_nushell"
+nickel_path = ["installer", "preflight", "dependency_check", "nushell"]
+prompt = "Check Nushell"
+type = "confirm"
+
+# Port Availability Check
+[[elements]]
+default = false
+help = "Validate that installation ports are available"
+name = "check_ports"
+nickel_path = ["installer", "preflight", "port_check", "enabled"]
+prompt = "Check Port Availability"
+type = "confirm"
+
+[[elements]]
+condition = "check_ports == true"
+default = "9090,8080,8000"
+help = "Comma-separated list of ports to check (e.g., 9090,8080,8000)"
+name = "ports_to_check"
+nickel_path = ["installer", "preflight", "port_check", "ports"]
+prompt = "Ports to Check"
+type = "text"
+
+# Permissions Check
+[[elements]]
+default = true
+help = "Validate user has necessary permissions for installation"
+name = "check_permissions"
+nickel_path = ["installer", "preflight", "permissions_check", "enabled"]
+prompt = "Check Permissions"
+type = "confirm"
+
+[[elements]]
+condition = "check_permissions == true"
+default = false
+help = "Require root/admin permissions for installation"
+name = "require_root"
+nickel_path = ["installer", "preflight", "permissions_check", "require_root"]
+prompt = "Require Root"
+type = "confirm"
+
+# File System Check
+[[elements]]
+default = true
+help = "Validate file system compatibility (must support extended attributes)"
+name = "check_filesystem"
+nickel_path = ["installer", "preflight", "filesystem_check", "enabled"]
+prompt = "Check File System"
+type = "confirm"
+
+[[elements]]
+condition = "check_filesystem == true"
+default = false
+help = "Require SELinux support"
+name = "require_selinux"
+nickel_path = ["installer", "preflight", "filesystem_check", "require_selinux"]
+prompt = "Require SELinux"
+type = "confirm"
+
+# Preflight Check Behavior
+[[elements]]
+default = false
+help = "Skip failed preflight checks and continue installation"
+name = "ignore_preflight_failures"
+nickel_path = ["installer", "preflight", "ignore_failures"]
+prompt = "Ignore Preflight Failures"
+type = "confirm"
+
+[[elements]]
+default = "warn"
+help = "How to handle preflight warnings"
+name = "preflight_failure_mode"
+nickel_path = ["installer", "preflight", "failure_mode"]
+options = ["warn", "error", "fatal"]
+prompt = "Failure Mode"
+type = "select"

.typedialog/platform/forms/fragments/installer/services-section.toml

@@ -0,0 +1,197 @@
+name = "services_section"
+description = "Installer Services Selection Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "services_section_header"
+title = "🚀 Services Selection"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Install Orchestrator (workflow engine and task scheduling)"
+name = "install_orchestrator"
+nickel_path = ["installer", "services", "orchestrator", "enabled"]
+prompt = "Install Orchestrator"
+type = "confirm"
+
+[[elements]]
+default = true
+help = "Install Control Center (policy and RBAC management)"
+name = "install_control_center"
+nickel_path = ["installer", "services", "control_center", "enabled"]
+prompt = "Install Control Center"
+type = "confirm"
+
+[[elements]]
+default = true
+help = "Install MCP Server (Model Context Protocol interface)"
+name = "install_mcp_server"
+nickel_path = ["installer", "services", "mcp_server", "enabled"]
+prompt = "Install MCP Server"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Install AI Service (AI model integration and inference)"
+name = "install_ai_service"
+nickel_path = ["installer", "services", "ai_service", "enabled"]
+prompt = "Install AI Service"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Install Vault Service (secrets and KMS management)"
+name = "install_vault_service"
+nickel_path = ["installer", "services", "vault_service", "enabled"]
+prompt = "Install Vault Service"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Install RAG Service (retrieval-augmented generation)"
+name = "install_rag_service"
+nickel_path = ["installer", "services", "rag_service", "enabled"]
+prompt = "Install RAG Service"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Install Extension Registry (OCI registry for extensions)"
+name = "install_extension_registry"
+nickel_path = ["installer", "services", "extension_registry", "enabled"]
+prompt = "Install Extension Registry"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Install Detector Service (system monitoring and detection)"
+name = "install_detector"
+nickel_path = ["installer", "services", "detector", "enabled"]
+prompt = "Install Detector"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Install API Gateway (request routing and load balancing)"
+name = "install_api_gateway"
+nickel_path = ["installer", "services", "api_gateway", "enabled"]
+prompt = "Install API Gateway"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Install monitoring stack (Prometheus, Grafana, Loki)"
+name = "install_monitoring_stack"
+nickel_path = ["installer", "services", "monitoring_stack", "enabled"]
+prompt = "Install Monitoring Stack"
+type = "confirm"
+
+# Service Dependencies and Configuration
+[[elements]]
+condition = "install_orchestrator == true"
+default = true
+help = "Start Orchestrator immediately after installation"
+name = "orchestrator_auto_start"
+nickel_path = ["installer", "services", "orchestrator", "auto_start"]
+prompt = "Orchestrator Auto-Start"
+type = "confirm"
+
+[[elements]]
+condition = "install_control_center == true"
+default = true
+help = "Start Control Center immediately after installation"
+name = "control_center_auto_start"
+nickel_path = ["installer", "services", "control_center", "auto_start"]
+prompt = "Control Center Auto-Start"
+type = "confirm"
+
+[[elements]]
+condition = "install_mcp_server == true"
+default = true
+help = "Start MCP Server immediately after installation"
+name = "mcp_server_auto_start"
+nickel_path = ["installer", "services", "mcp_server", "auto_start"]
+prompt = "MCP Server Auto-Start"
+type = "confirm"
+
+# Service Ports Configuration
+[[elements]]
+condition = "install_orchestrator == true"
+default = 9090
+help = "Port for Orchestrator service (range: ${constraint.common.server.port.min}-${constraint.common.server.port.max})"
+max = "${constraint.common.server.port.max}"
+min = "${constraint.common.server.port.min}"
+name = "orchestrator_port"
+nickel_path = ["installer", "services", "orchestrator", "port"]
+prompt = "Orchestrator Port"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "install_control_center == true"
+default = 8080
+help = "Port for Control Center service (range: ${constraint.common.server.port.min}-${constraint.common.server.port.max})"
+max = "${constraint.common.server.port.max}"
+min = "${constraint.common.server.port.min}"
+name = "control_center_port"
+nickel_path = ["installer", "services", "control_center", "port"]
+prompt = "Control Center Port"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "install_mcp_server == true"
+default = 8000
+help = "Port for MCP Server service (range: ${constraint.common.server.port.min}-${constraint.common.server.port.max})"
+max = "${constraint.common.server.port.max}"
+min = "${constraint.common.server.port.min}"
+name = "mcp_server_port"
+nickel_path = ["installer", "services", "mcp_server", "port"]
+prompt = "MCP Server Port"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "install_api_gateway == true"
+default = 8443
+help = "Port for API Gateway service (range: ${constraint.common.server.port.min}-${constraint.common.server.port.max})"
+max = "${constraint.common.server.port.max}"
+min = "${constraint.common.server.port.min}"
+name = "api_gateway_port"
+nickel_path = ["installer", "services", "api_gateway", "port"]
+prompt = "API Gateway Port"
+type = "custom"
+custom_type = "Number"
+
+# Service Update Strategy
+[[elements]]
+default = "rolling"
+help = "Strategy for updating services during installation"
+name = "service_update_strategy"
+nickel_path = ["installer", "services", "update_strategy"]
+options = ["rolling", "blue_green", "canary"]
+prompt = "Service Update Strategy"
+type = "select"
+
+[[elements]]
+default = false
+help = "Enable health checks between service updates"
+name = "enable_health_checks"
+nickel_path = ["installer", "services", "health_checks", "enabled"]
+prompt = "Enable Health Checks"
+type = "confirm"
+
+[[elements]]
+condition = "enable_health_checks == true"
+default = 30
+help = "Health check interval in seconds"
+min = 5
+name = "health_check_interval"
+nickel_path = ["installer", "services", "health_checks", "interval_seconds"]
+prompt = "Health Check Interval (seconds)"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/installer/storage-section.toml

@@ -0,0 +1,242 @@
+name = "storage_section"
+description = "Installer Storage Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "installer_storage_section_header"
+title = "💾 Storage Configuration"
+type = "section_header"
+
+# Storage Location
+[[elements]]
+default = "/var/lib/provisioning"
+help = "Root directory for provisioning data storage"
+name = "storage_root_path"
+nickel_path = ["installer", "storage", "root_path"]
+prompt = "Storage Root Path"
+required = true
+type = "text"
+
+[[elements]]
+default = 500
+help = "Allocated storage space in GB (range: 10-100000)"
+max = 100000
+min = 10
+name = "storage_size_gb"
+nickel_path = ["installer", "storage", "size_gb"]
+prompt = "Storage Size (GB)"
+type = "custom"
+custom_type = "Number"
+
+# Storage Backend Selection
+[[elements]]
+default = "filesystem"
+help = "Storage backend type"
+name = "installer_storage_backend"
+nickel_path = ["installer", "storage", "backend"]
+options = ["filesystem", "object_storage", "block_storage"]
+prompt = "Storage Backend"
+type = "select"
+
+# Filesystem Storage (conditional)
+[[elements]]
+condition = "installer_storage_backend == 'filesystem'"
+default = "ext4"
+help = "File system type"
+name = "filesystem_type"
+nickel_path = ["installer", "storage", "filesystem", "type"]
+options = ["ext4", "xfs", "btrfs", "zfs"]
+prompt = "File System Type"
+type = "select"
+
+[[elements]]
+condition = "installer_storage_backend == 'filesystem'"
+default = true
+help = "Enable file system snapshots"
+name = "filesystem_snapshots_enabled"
+nickel_path = ["installer", "storage", "filesystem", "snapshots", "enabled"]
+prompt = "Enable Snapshots"
+type = "confirm"
+
+# Object Storage (conditional)
+[[elements]]
+condition = "installer_storage_backend == 'object_storage'"
+default = "s3"
+help = "Object storage provider"
+name = "object_storage_provider"
+nickel_path = ["installer", "storage", "object_storage", "provider"]
+options = ["s3", "gcs", "azure_blob", "minio"]
+prompt = "Object Storage Provider"
+type = "select"
+
+[[elements]]
+condition = "installer_storage_backend == 'object_storage'"
+default = ""
+help = "Object storage endpoint URL"
+name = "object_storage_endpoint"
+nickel_path = ["installer", "storage", "object_storage", "endpoint"]
+prompt = "Storage Endpoint"
+required = true
+type = "text"
+
+[[elements]]
+condition = "installer_storage_backend == 'object_storage'"
+default = ""
+help = "Object storage bucket name"
+name = "object_storage_bucket"
+nickel_path = ["installer", "storage", "object_storage", "bucket"]
+prompt = "Storage Bucket"
+required = true
+type = "text"
+
+[[elements]]
+condition = "installer_storage_backend == 'object_storage'"
+default = ""
+help = "Object storage access key ID (will be encrypted)"
+name = "object_storage_access_key"
+nickel_path = ["installer", "storage", "object_storage", "access_key"]
+prompt = "Access Key"
+required = true
+type = "password"
+
+[[elements]]
+condition = "installer_storage_backend == 'object_storage'"
+default = ""
+help = "Object storage secret access key (will be encrypted)"
+name = "object_storage_secret_key"
+nickel_path = ["installer", "storage", "object_storage", "secret_key"]
+prompt = "Secret Key"
+required = true
+type = "password"
+
+# Block Storage (conditional)
+[[elements]]
+condition = "installer_storage_backend == 'block_storage'"
+default = "local"
+help = "Block storage type"
+name = "block_storage_type"
+nickel_path = ["installer", "storage", "block_storage", "type"]
+options = ["local", "san", "nas"]
+prompt = "Block Storage Type"
+type = "select"
+
+[[elements]]
+condition = "installer_storage_backend == 'block_storage'"
+default = "/dev/sdb"
+help = "Block device path"
+name = "block_device_path"
+nickel_path = ["installer", "storage", "block_storage", "device_path"]
+prompt = "Block Device Path"
+type = "text"
+
+# Storage Compression and Encryption
+[[elements]]
+default = false
+help = "Enable compression for stored data"
+name = "storage_compression_enabled"
+nickel_path = ["installer", "storage", "compression", "enabled"]
+prompt = "Enable Compression"
+type = "confirm"
+
+[[elements]]
+condition = "storage_compression_enabled == true"
+default = "zstd"
+help = "Compression algorithm"
+name = "storage_compression_algorithm"
+nickel_path = ["installer", "storage", "compression", "algorithm"]
+options = ["zstd", "gzip", "snappy"]
+prompt = "Compression Algorithm"
+type = "select"
+
+[[elements]]
+default = true
+help = "Enable encryption for stored data"
+name = "storage_encryption_enabled"
+nickel_path = ["installer", "storage", "encryption", "enabled"]
+prompt = "Enable Encryption"
+type = "confirm"
+
+[[elements]]
+condition = "storage_encryption_enabled == true"
+default = "aes256"
+help = "Encryption algorithm"
+name = "storage_encryption_algorithm"
+nickel_path = ["installer", "storage", "encryption", "algorithm"]
+options = ["aes256", "chacha20"]
+prompt = "Encryption Algorithm"
+type = "select"
+
+[[elements]]
+condition = "storage_encryption_enabled == true"
+default = "age"
+help = "Key management system for encryption keys"
+name = "storage_kms"
+nickel_path = ["installer", "storage", "encryption", "kms"]
+options = ["age", "sops", "vault", "kms"]
+prompt = "Key Management"
+type = "select"
+
+# Storage Replication
+[[elements]]
+default = false
+help = "Enable storage replication for redundancy"
+name = "storage_replication_enabled"
+nickel_path = ["installer", "storage", "replication", "enabled"]
+prompt = "Enable Replication"
+type = "confirm"
+
+[[elements]]
+condition = "storage_replication_enabled == true"
+default = 3
+help = "Number of replicas (range: 2-10)"
+max = 10
+min = 2
+name = "storage_replication_factor"
+nickel_path = ["installer", "storage", "replication", "factor"]
+prompt = "Replication Factor"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "storage_replication_enabled == true"
+default = "sync"
+help = "Replication mode"
+name = "storage_replication_mode"
+nickel_path = ["installer", "storage", "replication", "mode"]
+options = ["sync", "async", "hybrid"]
+prompt = "Replication Mode"
+type = "select"
+
+# Storage Cleanup
+[[elements]]
+default = true
+help = "Enable automatic cleanup of old data"
+name = "storage_cleanup_enabled"
+nickel_path = ["installer", "storage", "cleanup", "enabled"]
+prompt = "Enable Cleanup"
+type = "confirm"
+
+[[elements]]
+condition = "storage_cleanup_enabled == true"
+default = 90
+help = "Retention period for archived data in days"
+max = 3650
+min = 7
+name = "storage_cleanup_retention_days"
+nickel_path = ["installer", "storage", "cleanup", "retention_days"]
+prompt = "Retention Period (days)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "storage_cleanup_enabled == true"
+default = "weekly"
+help = "Cleanup schedule"
+name = "storage_cleanup_schedule"
+nickel_path = ["installer", "storage", "cleanup", "schedule"]
+options = ["daily", "weekly", "monthly"]
+prompt = "Cleanup Schedule"
+type = "select"

.typedialog/platform/forms/fragments/installer/target-section.toml

@@ -0,0 +1,164 @@
+name = "target_section"
+description = "Installer Target Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "target_section_header"
+title = "🎯 Installation Target"
+type = "section_header"
+
+# Target Type Selection
+[[elements]]
+default = "local"
+help = "Target environment for installation"
+name = "target_type"
+nickel_path = ["installer", "target", "type"]
+options = ["local", "remote", "kubernetes", "docker"]
+prompt = "Target Type"
+required = true
+type = "select"
+
+# Local Installation (conditional)
+[[elements]]
+condition = "target_type == 'local'"
+default = "/opt/provisioning"
+help = "Installation directory for local deployment"
+name = "local_install_path"
+nickel_path = ["installer", "target", "local_path"]
+prompt = "Installation Path"
+required = true
+type = "text"
+
+# Remote Installation (conditional)
+[[elements]]
+condition = "target_type == 'remote'"
+default = "example.com"
+help = "Hostname or IP address of remote host"
+name = "remote_host"
+nickel_path = ["installer", "target", "remote_host"]
+prompt = "Remote Host"
+required = true
+type = "text"
+
+[[elements]]
+condition = "target_type == 'remote'"
+default = 22
+help = "SSH port for remote access (range: ${constraint.common.server.port.min}-${constraint.common.server.port.max})"
+max = "${constraint.common.server.port.max}"
+min = "${constraint.common.server.port.min}"
+name = "remote_ssh_port"
+nickel_path = ["installer", "target", "remote_ssh_port"]
+prompt = "SSH Port"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "target_type == 'remote'"
+default = "ubuntu"
+help = "SSH username for remote access"
+name = "remote_ssh_user"
+nickel_path = ["installer", "target", "remote_ssh_user"]
+prompt = "SSH User"
+required = true
+type = "text"
+
+[[elements]]
+condition = "target_type == 'remote'"
+default = ""
+help = "Path to SSH private key (leave empty to use ssh-agent)"
+name = "remote_ssh_key_path"
+nickel_path = ["installer", "target", "remote_ssh_key_path"]
+prompt = "SSH Key Path"
+type = "text"
+
+[[elements]]
+condition = "target_type == 'remote'"
+default = false
+help = "Accept unknown SSH host keys"
+name = "remote_ssh_insecure"
+nickel_path = ["installer", "target", "remote_ssh_insecure"]
+prompt = "Accept Unknown Keys"
+type = "confirm"
+
+# Kubernetes Installation (conditional)
+[[elements]]
+condition = "target_type == 'kubernetes'"
+default = "default"
+help = "Kubernetes namespace for installation"
+name = "k8s_namespace"
+nickel_path = ["installer", "target", "k8s_namespace"]
+prompt = "Kubernetes Namespace"
+required = true
+type = "text"
+
+[[elements]]
+condition = "target_type == 'kubernetes'"
+default = "provisioning"
+help = "Kubernetes context to use"
+name = "k8s_context"
+nickel_path = ["installer", "target", "k8s_context"]
+prompt = "Kubernetes Context"
+type = "text"
+
+# Docker Installation (conditional)
+[[elements]]
+condition = "target_type == 'docker'"
+default = "unix:///var/run/docker.sock"
+help = "Docker daemon endpoint"
+name = "docker_host"
+nickel_path = ["installer", "target", "docker_host"]
+prompt = "Docker Host"
+required = true
+type = "text"
+
+# Cloud Provider Configuration (for all types)
+[[elements]]
+default = "none"
+help = "Cloud provider for monitoring and management APIs"
+name = "cloud_provider"
+nickel_path = ["installer", "target", "cloud_provider"]
+options = ["none", "aws", "gcp", "azure", "digitalocean", "linode"]
+prompt = "Cloud Provider"
+type = "select"
+
+[[elements]]
+condition = "cloud_provider != 'none'"
+default = ""
+help = "Cloud provider region"
+name = "cloud_region"
+nickel_path = ["installer", "target", "cloud_region"]
+prompt = "Cloud Region"
+required = true
+type = "text"
+
+[[elements]]
+condition = "cloud_provider != 'none'"
+default = ""
+help = "Cloud provider API key or credentials (will be encrypted)"
+name = "cloud_credentials"
+nickel_path = ["installer", "target", "cloud_credentials"]
+prompt = "Cloud Credentials"
+type = "password"
+
+# Operating System Detection
+[[elements]]
+default = "auto"
+help = "Target operating system"
+name = "target_os"
+nickel_path = ["installer", "target", "os"]
+options = ["auto", "linux", "macos", "windows"]
+prompt = "Target OS"
+type = "select"
+
+[[elements]]
+condition = "target_os == 'linux'"
+default = "auto"
+help = "Linux distribution"
+name = "target_linux_distro"
+nickel_path = ["installer", "target", "linux_distro"]
+options = ["auto", "ubuntu", "debian", "centos", "rhel", "alpine"]
+prompt = "Linux Distribution"
+type = "select"

.typedialog/platform/forms/fragments/installer/upgrades-section.toml

@@ -0,0 +1,370 @@
+name = "upgrades_section"
+description = "Installer Upgrades Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "upgrades_section_header"
+title = "📦 Upgrades Configuration"
+type = "section_header"
+
+# Auto-Upgrade Settings
+[[elements]]
+default = false
+help = "Enable automatic system updates and upgrades"
+name = "auto_upgrade_enabled"
+nickel_path = ["installer", "upgrades", "auto_upgrade", "enabled"]
+prompt = "Enable Auto-Upgrade"
+type = "confirm"
+
+[[elements]]
+condition = "auto_upgrade_enabled == true"
+default = true
+help = "Check for updates at startup"
+name = "check_updates_on_startup"
+nickel_path = ["installer", "upgrades", "auto_upgrade", "check_on_startup"]
+prompt = "Check Updates on Startup"
+type = "confirm"
+
+[[elements]]
+condition = "auto_upgrade_enabled == true"
+default = false
+help = "Automatically apply patches without confirmation"
+name = "auto_apply_patches"
+nickel_path = ["installer", "upgrades", "auto_upgrade", "auto_apply_patches"]
+prompt = "Auto-Apply Patches"
+type = "confirm"
+
+# Update Channels
+[[elements]]
+default = "stable"
+help = "Software update channel preference"
+name = "update_channel"
+nickel_path = ["installer", "upgrades", "update_channel"]
+options = ["stable", "lts", "beta", "nightly"]
+prompt = "Update Channel"
+type = "select"
+
+# Upgrade Strategy
+[[elements]]
+default = "rolling"
+help = "Strategy for applying upgrades"
+name = "upgrade_strategy"
+nickel_path = ["installer", "upgrades", "strategy"]
+options = ["rolling", "blue_green", "canary", "maintenance_window"]
+prompt = "Upgrade Strategy"
+type = "select"
+
+[[elements]]
+condition = "upgrade_strategy == 'rolling'"
+default = 1
+help = "Number of services to upgrade in parallel"
+max = 10
+min = 1
+name = "rolling_upgrade_parallel"
+nickel_path = ["installer", "upgrades", "rolling", "parallel_services"]
+prompt = "Parallel Services"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "upgrade_strategy == 'canary'"
+default = 10
+help = "Percentage of traffic to route to canary version"
+max = 50
+min = 1
+name = "canary_percentage"
+nickel_path = ["installer", "upgrades", "canary", "traffic_percentage"]
+prompt = "Canary Traffic %"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "upgrade_strategy == 'canary'"
+default = 300
+help = "Canary test duration in seconds (range: 30-7200)"
+max = 7200
+min = 30
+name = "canary_duration_seconds"
+nickel_path = ["installer", "upgrades", "canary", "duration_seconds"]
+prompt = "Canary Duration (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "upgrade_strategy == 'maintenance_window'"
+default = "sunday"
+help = "Day of week for maintenance window"
+name = "maintenance_day"
+nickel_path = ["installer", "upgrades", "maintenance_window", "day"]
+options = ["sunday", "monday", "tuesday", "wednesday", "thursday", "friday", "saturday"]
+prompt = "Maintenance Day"
+type = "select"
+
+[[elements]]
+condition = "upgrade_strategy == 'maintenance_window'"
+default = "02:00"
+help = "Time of day for maintenance window (HH:MM format, UTC)"
+name = "maintenance_time"
+nickel_path = ["installer", "upgrades", "maintenance_window", "time"]
+prompt = "Maintenance Time (UTC)"
+type = "text"
+
+[[elements]]
+condition = "upgrade_strategy == 'maintenance_window'"
+default = 3600
+help = "Maximum duration of maintenance window in seconds (range: 600-86400)"
+max = 86400
+min = 600
+name = "maintenance_duration_seconds"
+nickel_path = ["installer", "upgrades", "maintenance_window", "max_duration_seconds"]
+prompt = "Max Duration (seconds)"
+type = "custom"
+custom_type = "Number"
+
+# Pre-Upgrade Checks
+[[elements]]
+default = true
+help = "Run checks before upgrading"
+name = "pre_upgrade_checks_enabled"
+nickel_path = ["installer", "upgrades", "pre_checks", "enabled"]
+prompt = "Enable Pre-Upgrade Checks"
+type = "confirm"
+
+[[elements]]
+condition = "pre_upgrade_checks_enabled == true"
+default = true
+help = "Check disk space requirements"
+name = "check_disk_space_for_upgrade"
+nickel_path = ["installer", "upgrades", "pre_checks", "check_disk_space"]
+prompt = "Check Disk Space"
+type = "confirm"
+
+[[elements]]
+condition = "pre_upgrade_checks_enabled == true"
+default = true
+help = "Check service health before upgrade"
+name = "check_service_health_pre_upgrade"
+nickel_path = ["installer", "upgrades", "pre_checks", "check_service_health"]
+prompt = "Check Service Health"
+type = "confirm"
+
+[[elements]]
+condition = "pre_upgrade_checks_enabled == true"
+default = true
+help = "Check API/database connectivity"
+name = "check_connectivity_pre_upgrade"
+nickel_path = ["installer", "upgrades", "pre_checks", "check_connectivity"]
+prompt = "Check Connectivity"
+type = "confirm"
+
+[[elements]]
+condition = "pre_upgrade_checks_enabled == true"
+default = true
+help = "Validate backup integrity"
+name = "validate_backup_integrity"
+nickel_path = ["installer", "upgrades", "pre_checks", "validate_backup_integrity"]
+prompt = "Validate Backup Integrity"
+type = "confirm"
+
+# Backup Before Upgrade
+[[elements]]
+default = true
+help = "Create backup before upgrade"
+name = "backup_before_upgrade"
+nickel_path = ["installer", "upgrades", "backup_before_upgrade"]
+prompt = "Backup Before Upgrade"
+type = "confirm"
+
+[[elements]]
+condition = "backup_before_upgrade == true"
+default = "full"
+help = "Type of backup to create"
+name = "pre_upgrade_backup_type"
+nickel_path = ["installer", "upgrades", "backup_type"]
+options = ["full", "incremental", "snapshot"]
+prompt = "Backup Type"
+type = "select"
+
+[[elements]]
+condition = "backup_before_upgrade == true"
+default = 30
+help = "Backup timeout in minutes"
+max = 1440
+min = 5
+name = "backup_timeout_minutes"
+nickel_path = ["installer", "upgrades", "backup_timeout_minutes"]
+prompt = "Backup Timeout (minutes)"
+type = "custom"
+custom_type = "Number"
+
+# Upgrade Rollback
+[[elements]]
+default = true
+help = "Enable automatic rollback on upgrade failure"
+name = "enable_rollback_on_failure"
+nickel_path = ["installer", "upgrades", "rollback", "enabled"]
+prompt = "Enable Rollback"
+type = "confirm"
+
+[[elements]]
+condition = "enable_rollback_on_failure == true"
+default = "automatic"
+help = "Rollback strategy"
+name = "rollback_on_failure_strategy"
+nickel_path = ["installer", "upgrades", "rollback", "strategy"]
+options = ["automatic", "manual", "data_aware"]
+prompt = "Rollback Strategy"
+type = "select"
+
+[[elements]]
+condition = "enable_rollback_on_failure == true"
+default = 300
+help = "Time to wait after upgrade before validating success (seconds, range: 30-1800)"
+max = 1800
+min = 30
+name = "rollback_validation_delay"
+nickel_path = ["installer", "upgrades", "rollback", "validation_delay_seconds"]
+prompt = "Validation Delay (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "enable_rollback_on_failure == true"
+default = true
+help = "Perform database migrations rollback"
+name = "rollback_database_migrations"
+nickel_path = ["installer", "upgrades", "rollback", "database_migrations"]
+prompt = "Rollback DB Migrations"
+type = "confirm"
+
+# Service-Specific Upgrades
+[[elements]]
+default = true
+help = "Upgrade Orchestrator service"
+name = "upgrade_orchestrator"
+nickel_path = ["installer", "upgrades", "services", "orchestrator"]
+prompt = "Upgrade Orchestrator"
+type = "confirm"
+
+[[elements]]
+default = true
+help = "Upgrade Control Center service"
+name = "upgrade_control_center"
+nickel_path = ["installer", "upgrades", "services", "control_center"]
+prompt = "Upgrade Control Center"
+type = "confirm"
+
+[[elements]]
+default = true
+help = "Upgrade MCP Server service"
+name = "upgrade_mcp_server"
+nickel_path = ["installer", "upgrades", "services", "mcp_server"]
+prompt = "Upgrade MCP Server"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Upgrade AI Service"
+name = "upgrade_ai_service"
+nickel_path = ["installer", "upgrades", "services", "ai_service"]
+prompt = "Upgrade AI Service"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Upgrade RAG Service"
+name = "upgrade_rag_service"
+nickel_path = ["installer", "upgrades", "services", "rag_service"]
+prompt = "Upgrade RAG Service"
+type = "confirm"
+
+# Health Checks After Upgrade
+[[elements]]
+default = true
+help = "Run health checks after upgrade completes"
+name = "health_checks_post_upgrade"
+nickel_path = ["installer", "upgrades", "post_upgrade", "health_checks_enabled"]
+prompt = "Health Checks After Upgrade"
+type = "confirm"
+
+[[elements]]
+condition = "health_checks_post_upgrade == true"
+default = 60
+help = "Health check interval after upgrade in seconds (range: 5-300)"
+max = 300
+min = 5
+name = "post_upgrade_health_check_interval"
+nickel_path = ["installer", "upgrades", "post_upgrade", "health_check_interval_seconds"]
+prompt = "Health Check Interval (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "health_checks_post_upgrade == true"
+default = 600
+help = "Duration to monitor health after upgrade in seconds (range: 60-86400)"
+max = 86400
+min = 60
+name = "post_upgrade_monitoring_duration"
+nickel_path = ["installer", "upgrades", "post_upgrade", "monitoring_duration_seconds"]
+prompt = "Monitoring Duration (seconds)"
+type = "custom"
+custom_type = "Number"
+
+# Version Constraints
+[[elements]]
+default = false
+help = "Enforce version constraints for upgrades"
+name = "enable_version_constraints"
+nickel_path = ["installer", "upgrades", "version_constraints", "enabled"]
+prompt = "Enable Version Constraints"
+type = "confirm"
+
+[[elements]]
+condition = "enable_version_constraints == true"
+default = "compatible"
+help = "Version compatibility mode"
+name = "version_constraint_mode"
+nickel_path = ["installer", "upgrades", "version_constraints", "mode"]
+options = ["compatible", "minimum", "maximum", "exact"]
+prompt = "Version Constraint Mode"
+type = "select"
+
+[[elements]]
+condition = "enable_version_constraints == true && version_constraint_mode == 'minimum'"
+default = ""
+help = "Minimum version to upgrade to (e.g., 3.1.0)"
+name = "minimum_version"
+nickel_path = ["installer", "upgrades", "version_constraints", "minimum_version"]
+prompt = "Minimum Version"
+type = "text"
+
+[[elements]]
+condition = "enable_version_constraints == true && version_constraint_mode == 'maximum'"
+default = ""
+help = "Maximum version to upgrade to (e.g., 4.0.0)"
+name = "maximum_version"
+nickel_path = ["installer", "upgrades", "version_constraints", "maximum_version"]
+prompt = "Maximum Version"
+type = "text"
+
+# Notification
+[[elements]]
+default = false
+help = "Send notification when upgrade completes"
+name = "notify_on_upgrade_complete"
+nickel_path = ["installer", "upgrades", "notification", "enabled"]
+prompt = "Notify on Upgrade Complete"
+type = "confirm"
+
+[[elements]]
+condition = "notify_on_upgrade_complete == true"
+default = ""
+help = "Email address for upgrade completion notification"
+name = "upgrade_notification_email"
+nickel_path = ["installer", "upgrades", "notification", "email"]
+prompt = "Notification Email"
+type = "text"

.typedialog/platform/forms/fragments/logging-section.toml

@@ -0,0 +1,61 @@
+name = "logging_section"
+description = "Logging Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "logging_section_header"
+title = "📝 Logging Configuration"
+type = "section_header"
+
+[[elements]]
+default = "info"
+help = "Log level (debug, info, warn, error)"
+name = "logging_level"
+nickel_path = ["logging", "level"]
+options = ["debug", "info", "warn", "error"]
+prompt = "Log Level"
+type = "select"
+
+[[elements]]
+default = "text"
+help = "Log format (text, json)"
+name = "logging_format"
+nickel_path = ["logging", "format"]
+options = ["text", "json"]
+prompt = "Log Format"
+type = "select"
+
+[[elements]]
+default = false
+help = "Enable file-based logging with rotation"
+name = "logging_file_enabled"
+nickel_path = ["logging", "file", "enabled"]
+prompt = "Enable File Logging"
+type = "confirm"
+
+[[elements]]
+condition = "logging_file_enabled == true"
+default = 10485760
+help = "Maximum log file size in bytes before rotation (range: ${constraint.common.logging.max_file_size.min}-${constraint.common.logging.max_file_size.max})"
+max = "${constraint.common.logging.max_file_size.max}"
+min = "${constraint.common.logging.max_file_size.min}"
+name = "logging_max_file_size"
+nickel_path = ["logging", "file", "max_size"]
+prompt = "Max File Size (bytes)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "logging_file_enabled == true"
+default = 10
+help = "Maximum number of backup log files to keep (range: ${constraint.common.logging.max_backups.min}-${constraint.common.logging.max_backups.max})"
+max = "${constraint.common.logging.max_backups.max}"
+min = "${constraint.common.logging.max_backups.min}"
+name = "logging_max_backups"
+nickel_path = ["logging", "file", "max_backups"]
+prompt = "Max Backup Files"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/mcp-server/prompts-section.toml

@@ -0,0 +1,73 @@
+name = "prompts_section"
+description = "MCP Server Prompts Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "prompts_section_header"
+title = "💬 Prompts Configuration"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Enable MCP prompts capability"
+name = "prompts_enabled"
+nickel_path = ["prompts", "enabled"]
+prompt = "Enable Prompts"
+type = "confirm"
+
+[[elements]]
+condition = "prompts_enabled == true"
+default = 100
+help = "Maximum custom prompt templates (range: ${constraint.mcp_server.prompts.max_templates.min}-${constraint.mcp_server.prompts.max_templates.max})"
+max = "${constraint.mcp_server.prompts.max_templates.max}"
+min = "${constraint.mcp_server.prompts.max_templates.min}"
+name = "prompts_max_templates"
+nickel_path = ["prompts", "max_templates"]
+prompt = "Max Prompt Templates"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "prompts_enabled == true"
+default = true
+help = "Enable prompt response caching"
+name = "prompts_cache_enabled"
+nickel_path = ["prompts", "cache", "enabled"]
+prompt = "Enable Prompt Caching"
+type = "confirm"
+
+[[elements]]
+condition = "prompts_enabled == true && prompts_cache_enabled == true"
+default = 3600
+help = "Prompt cache TTL in seconds (range: 60-86400)"
+max = 86400
+min = 60
+name = "prompts_cache_ttl"
+nickel_path = ["prompts", "cache", "ttl"]
+prompt = "Cache TTL (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "prompts_enabled == true"
+default = false
+help = "Enable prompt versioning"
+name = "prompts_versioning_enabled"
+nickel_path = ["prompts", "versioning", "enabled"]
+prompt = "Enable Prompt Versioning"
+type = "confirm"
+
+[[elements]]
+condition = "prompts_enabled == true && prompts_versioning_enabled == true"
+default = 10
+help = "Maximum prompt versions to keep (range: 1-100)"
+max = 100
+min = 1
+name = "prompts_versioning_max_versions"
+nickel_path = ["prompts", "versioning", "max_versions"]
+prompt = "Max Prompt Versions"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/mcp-server/resources-section.toml

@@ -0,0 +1,85 @@
+name = "resources_section"
+description = "MCP Server Resources Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "resources_section_header"
+title = "📦 Resources Configuration"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Enable MCP resources capability"
+name = "resources_enabled"
+nickel_path = ["resources", "enabled"]
+prompt = "Enable Resources"
+type = "confirm"
+
+[[elements]]
+condition = "resources_enabled == true"
+default = 104857600
+help = "Maximum resource size in bytes (range: ${constraint.mcp_server.resources.max_size.min}-${constraint.mcp_server.resources.max_size.max})"
+max = "${constraint.mcp_server.resources.max_size.max}"
+min = "${constraint.mcp_server.resources.max_size.min}"
+name = "resources_max_size"
+nickel_path = ["resources", "max_size"]
+prompt = "Max Resource Size (bytes)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "resources_enabled == true"
+default = true
+help = "Enable resource caching"
+name = "resources_cache_enabled"
+nickel_path = ["resources", "cache", "enabled"]
+prompt = "Enable Resource Caching"
+type = "confirm"
+
+[[elements]]
+condition = "resources_enabled == true && resources_cache_enabled == true"
+default = 512
+help = "Maximum cache size in MB (range: 10-10240)"
+max = 10240
+min = 10
+name = "resources_cache_max_size_mb"
+nickel_path = ["resources", "cache", "max_size_mb"]
+prompt = "Max Cache Size (MB)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "resources_enabled == true && resources_cache_enabled == true"
+default = 3600
+help = "Resource cache TTL in seconds (range: ${constraint.mcp_server.resources.cache_ttl.min}-${constraint.mcp_server.resources.cache_ttl.max})"
+max = "${constraint.mcp_server.resources.cache_ttl.max}"
+min = "${constraint.mcp_server.resources.cache_ttl.min}"
+name = "resources_cache_ttl"
+nickel_path = ["resources", "cache", "ttl"]
+prompt = "Cache TTL (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "resources_enabled == true"
+default = true
+help = "Enable resource validation"
+name = "resources_validation_enabled"
+nickel_path = ["resources", "validation", "enabled"]
+prompt = "Enable Resource Validation"
+type = "confirm"
+
+[[elements]]
+condition = "resources_enabled == true && resources_validation_enabled == true"
+default = 10
+help = "Maximum nesting depth for resources (range: 1-100)"
+max = 100
+min = 1
+name = "resources_validation_max_depth"
+nickel_path = ["resources", "validation", "max_depth"]
+prompt = "Max Nesting Depth"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/mcp-server/sampling-section.toml

@@ -0,0 +1,73 @@
+name = "sampling_section"
+description = "MCP Server Sampling Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "sampling_section_header"
+title = "🎲 Sampling Configuration"
+type = "section_header"
+
+[[elements]]
+default = false
+help = "Enable sampling capability for AI model inference"
+name = "sampling_enabled"
+nickel_path = ["sampling", "enabled"]
+prompt = "Enable Sampling"
+type = "confirm"
+
+[[elements]]
+condition = "sampling_enabled == true"
+default = 4096
+help = "Maximum tokens for sampling output (range: ${constraint.mcp_server.sampling.max_tokens.min}-${constraint.mcp_server.sampling.max_tokens.max})"
+max = "${constraint.mcp_server.sampling.max_tokens.max}"
+min = "${constraint.mcp_server.sampling.max_tokens.min}"
+name = "sampling_max_tokens"
+nickel_path = ["sampling", "max_tokens"]
+prompt = "Max Tokens"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "sampling_enabled == true"
+help = "Sampling model to use (e.g., gpt-4, claude-3)"
+name = "sampling_model"
+nickel_path = ["sampling", "model"]
+placeholder = "gpt-4"
+prompt = "Sampling Model"
+type = "text"
+
+[[elements]]
+condition = "sampling_enabled == true"
+default = 0.7
+help = "Temperature for sampling (0.0-2.0, higher = more creative)"
+max = 2.0
+min = 0.0
+name = "sampling_temperature"
+nickel_path = ["sampling", "temperature"]
+prompt = "Temperature"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "sampling_enabled == true"
+default = true
+help = "Enable sampling result caching"
+name = "sampling_cache_enabled"
+nickel_path = ["sampling", "cache", "enabled"]
+prompt = "Enable Sampling Cache"
+type = "confirm"
+
+[[elements]]
+condition = "sampling_enabled == true && sampling_cache_enabled == true"
+default = 3600
+help = "Sampling cache TTL in seconds (range: 60-3600)"
+max = 3600
+min = 60
+name = "sampling_cache_ttl"
+nickel_path = ["sampling", "cache", "ttl"]
+prompt = "Cache TTL (seconds)"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/mcp-server/tools-section.toml

@@ -0,0 +1,81 @@
+name = "tools_section"
+description = "MCP Server Tools Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "tools_section_header"
+title = "🔧 Tools Configuration"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Enable MCP tools capability"
+name = "tools_enabled"
+nickel_path = ["tools", "enabled"]
+prompt = "Enable Tools"
+type = "confirm"
+
+[[elements]]
+condition = "tools_enabled == true"
+default = 5
+help = "Maximum concurrent tool executions (range: ${constraint.mcp_server.tools.max_concurrent.min}-${constraint.mcp_server.tools.max_concurrent.max})"
+max = "${constraint.mcp_server.tools.max_concurrent.max}"
+min = "${constraint.mcp_server.tools.max_concurrent.min}"
+name = "tools_max_concurrent"
+nickel_path = ["tools", "max_concurrent"]
+prompt = "Max Concurrent Tools"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "tools_enabled == true"
+default = 30000
+help = "Tool execution timeout in milliseconds (range: ${constraint.mcp_server.tools.timeout.min}-${constraint.mcp_server.tools.timeout.max})"
+max = "${constraint.mcp_server.tools.timeout.max}"
+min = "${constraint.mcp_server.tools.timeout.min}"
+name = "tools_timeout"
+nickel_path = ["tools", "timeout"]
+prompt = "Tool Timeout (ms)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "tools_enabled == true"
+default = true
+help = "Enable tool input validation"
+name = "tools_validation_enabled"
+nickel_path = ["tools", "validation", "enabled"]
+prompt = "Enable Tool Validation"
+type = "confirm"
+
+[[elements]]
+condition = "tools_enabled == true && tools_validation_enabled == true"
+default = false
+help = "Enable strict validation mode"
+name = "tools_validation_strict"
+nickel_path = ["tools", "validation", "strict_mode"]
+prompt = "Strict Validation Mode"
+type = "confirm"
+
+[[elements]]
+condition = "tools_enabled == true"
+default = false
+help = "Enable tool execution caching"
+name = "tools_cache_enabled"
+nickel_path = ["tools", "cache", "enabled"]
+prompt = "Enable Tool Caching"
+type = "confirm"
+
+[[elements]]
+condition = "tools_enabled == true && tools_cache_enabled == true"
+default = 3600
+help = "Tool cache TTL in seconds"
+min = 60
+name = "tools_cache_ttl"
+nickel_path = ["tools", "cache", "ttl"]
+prompt = "Cache TTL (seconds)"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/monitoring-section.toml

@@ -0,0 +1,40 @@
+name = "monitoring_section"
+description = "Monitoring Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "monitoring_section_header"
+title = "📊 Monitoring Configuration"
+type = "section_header"
+
+[[elements]]
+default = false
+help = "Enable monitoring and metrics collection"
+name = "monitoring_enabled"
+nickel_path = ["monitoring", "enabled"]
+prompt = "Enable Monitoring"
+type = "confirm"
+
+[[elements]]
+condition = "monitoring_enabled == true"
+default = true
+help = "Enable metrics collection from this service"
+name = "monitoring_metrics_enabled"
+nickel_path = ["monitoring", "metrics", "enabled"]
+prompt = "Enable Metrics Collection"
+type = "confirm"
+
+[[elements]]
+condition = "monitoring_enabled == true && monitoring_metrics_enabled == true"
+default = 60
+help = "Metrics collection interval in seconds (range: ${constraint.common.monitoring.metrics_interval.min}-${constraint.common.monitoring.metrics_interval.max})"
+max = "${constraint.common.monitoring.metrics_interval.max}"
+min = "${constraint.common.monitoring.metrics_interval.min}"
+name = "monitoring_metrics_interval"
+nickel_path = ["monitoring", "metrics", "interval"]
+prompt = "Metrics Collection Interval (seconds)"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/orchestrator/batch-section.toml

@@ -0,0 +1,101 @@
+name = "batch_section"
+description = "Orchestrator Batch Workflow Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "batch_section_header"
+title = "🔄 Batch Workflow Configuration"
+type = "section_header"
+
+[[elements]]
+default = 5
+help = "Parallel operation limit for batch jobs (range: ${constraint.orchestrator.batch.parallel_limit.min}-${constraint.orchestrator.batch.parallel_limit.max})"
+max = "${constraint.orchestrator.batch.parallel_limit.max}"
+min = "${constraint.orchestrator.batch.parallel_limit.min}"
+name = "batch_parallel_limit"
+nickel_path = ["batch", "parallel_limit"]
+prompt = "Parallel Limit"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 1800000
+help = "Batch operation timeout in milliseconds (range: ${constraint.orchestrator.batch.operation_timeout.min}-${constraint.orchestrator.batch.operation_timeout.max})"
+max = "${constraint.orchestrator.batch.operation_timeout.max}"
+min = "${constraint.orchestrator.batch.operation_timeout.min}"
+name = "batch_operation_timeout"
+nickel_path = ["batch", "operation_timeout"]
+prompt = "Operation Timeout (ms)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = true
+help = "Enable checkpoint support for batch recovery"
+name = "batch_checkpointing_enabled"
+nickel_path = ["batch", "checkpointing", "enabled"]
+prompt = "Enable Checkpointing"
+type = "confirm"
+
+[[elements]]
+condition = "batch_checkpointing_enabled == true"
+default = 100
+help = "Checkpoint interval (number of operations before checkpoint)"
+min = 10
+name = "batch_checkpoint_interval"
+nickel_path = ["batch", "checkpointing", "interval"]
+prompt = "Checkpoint Interval"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "batch_checkpointing_enabled == true"
+default = 10
+help = "Maximum number of checkpoints to keep"
+min = 1
+name = "batch_checkpoint_max_checkpoints"
+nickel_path = ["batch", "checkpointing", "max_checkpoints"]
+prompt = "Max Checkpoints"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = true
+help = "Enable rollback strategy for failed batches"
+name = "batch_rollback_enabled"
+nickel_path = ["batch", "rollback", "enabled"]
+prompt = "Enable Rollback"
+type = "confirm"
+
+[[elements]]
+condition = "batch_rollback_enabled == true"
+default = "checkpoint_based"
+help = "Rollback strategy (checkpoint_based, full, partial)"
+name = "batch_rollback_strategy"
+nickel_path = ["batch", "rollback", "strategy"]
+options = ["checkpoint_based", "full", "partial"]
+prompt = "Rollback Strategy"
+type = "select"
+
+[[elements]]
+condition = "batch_rollback_enabled == true"
+default = 5
+help = "Maximum rollback depth"
+max = 20
+min = 1
+name = "batch_rollback_max_depth"
+nickel_path = ["batch", "rollback", "max_rollback_depth"]
+prompt = "Max Rollback Depth"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = false
+help = "Enable batch operation metrics"
+name = "batch_metrics"
+nickel_path = ["batch", "metrics"]
+prompt = "Batch Metrics"
+type = "confirm"

.typedialog/platform/forms/fragments/orchestrator/extensions-section.toml

@@ -0,0 +1,192 @@
+name = "extensions_section"
+description = "Orchestrator Extensions Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "extensions_section_header"
+title = "🔌 Extensions Configuration"
+type = "section_header"
+
+# Extension Auto-Loading
+[[elements]]
+default = false
+help = "Automatically load extensions from registry at startup"
+name = "auto_load_extensions"
+nickel_path = ["orchestrator", "extensions", "auto_load"]
+prompt = "Auto-Load Extensions"
+type = "confirm"
+
+# OCI Registry Configuration (conditional on auto-load)
+[[elements]]
+condition = "auto_load_extensions == true"
+default = "http://localhost:5000"
+help = "OCI registry URL for discovering extensions (e.g., http://harbor:5000)"
+name = "oci_registry_url"
+nickel_path = ["orchestrator", "extensions", "oci_registry_url"]
+prompt = "OCI Registry URL"
+required = true
+type = "text"
+
+[[elements]]
+condition = "auto_load_extensions == true"
+default = "provisioning"
+help = "Namespace/project in OCI registry for extensions"
+name = "oci_namespace"
+nickel_path = ["orchestrator", "extensions", "oci_namespace"]
+prompt = "OCI Namespace"
+required = true
+type = "text"
+
+[[elements]]
+condition = "auto_load_extensions == true"
+default = ""
+help = "OCI registry authentication username (leave empty for anonymous)"
+name = "oci_registry_username"
+nickel_path = ["orchestrator", "extensions", "oci_registry_username"]
+prompt = "OCI Registry Username"
+type = "text"
+
+[[elements]]
+condition = "auto_load_extensions == true"
+default = ""
+help = "OCI registry authentication password (leave empty for anonymous)"
+name = "oci_registry_password"
+nickel_path = ["orchestrator", "extensions", "oci_registry_password"]
+prompt = "OCI Registry Password"
+type = "password"
+
+# Extension Discovery Configuration
+[[elements]]
+condition = "auto_load_extensions == true"
+default = 3600
+help = "Extension discovery interval in seconds (range: 300-86400)"
+max = 86400
+min = 300
+name = "extensions_discovery_interval"
+nickel_path = ["orchestrator", "extensions", "discovery_interval_seconds"]
+prompt = "Discovery Interval (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "auto_load_extensions == true"
+default = 5
+help = "Maximum number of concurrent extension loads (range: ${constraint.orchestrator.extensions.max_concurrent.min}-${constraint.orchestrator.extensions.max_concurrent.max})"
+max = "${constraint.orchestrator.extensions.max_concurrent.max}"
+min = "${constraint.orchestrator.extensions.max_concurrent.min}"
+name = "extensions_max_concurrent"
+nickel_path = ["orchestrator", "extensions", "max_concurrent"]
+prompt = "Max Concurrent Extensions"
+type = "custom"
+custom_type = "Number"
+
+# Extension Execution Settings
+[[elements]]
+condition = "auto_load_extensions == true"
+default = 30000
+help = "Timeout for extension initialization in milliseconds (range: 1000-300000)"
+max = 300000
+min = 1000
+name = "extensions_init_timeout"
+nickel_path = ["orchestrator", "extensions", "init_timeout_ms"]
+prompt = "Init Timeout (ms)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "auto_load_extensions == true"
+default = false
+help = "Enable sandboxed execution for untrusted extensions"
+name = "extensions_sandbox_enabled"
+nickel_path = ["orchestrator", "extensions", "sandbox", "enabled"]
+prompt = "Enable Sandbox Mode"
+type = "confirm"
+
+[[elements]]
+condition = "auto_load_extensions == true && extensions_sandbox_enabled == true"
+default = true
+help = "Restrict network access for sandboxed extensions"
+name = "extensions_sandbox_restrict_network"
+nickel_path = ["orchestrator", "extensions", "sandbox", "restrict_network"]
+prompt = "Restrict Network Access"
+type = "confirm"
+
+[[elements]]
+condition = "auto_load_extensions == true && extensions_sandbox_enabled == true"
+default = 512
+help = "Maximum memory for sandboxed extension in MB (range: 64-4096)"
+max = 4096
+min = 64
+name = "extensions_sandbox_max_memory_mb"
+nickel_path = ["orchestrator", "extensions", "sandbox", "max_memory_mb"]
+prompt = "Max Memory (MB)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "auto_load_extensions == true && extensions_sandbox_enabled == true"
+default = 1
+help = "Maximum CPU cores for sandboxed extension"
+max = 8
+min = 0.1
+name = "extensions_sandbox_max_cpu"
+nickel_path = ["orchestrator", "extensions", "sandbox", "max_cpu"]
+prompt = "Max CPU Cores"
+type = "custom"
+custom_type = "Number"
+
+# Extension Versioning and Compatibility
+[[elements]]
+condition = "auto_load_extensions == true"
+default = true
+help = "Enable version compatibility checking"
+name = "extensions_version_check_enabled"
+nickel_path = ["orchestrator", "extensions", "version_check", "enabled"]
+prompt = "Enable Version Check"
+type = "confirm"
+
+[[elements]]
+condition = "auto_load_extensions == true"
+default = false
+help = "Allow prerelease/beta extension versions"
+name = "extensions_allow_prerelease"
+nickel_path = ["orchestrator", "extensions", "allow_prerelease"]
+prompt = "Allow Prerelease Versions"
+type = "confirm"
+
+# Extension Health Checking
+[[elements]]
+condition = "auto_load_extensions == true"
+default = true
+help = "Enable health checks for loaded extensions"
+name = "extensions_health_check_enabled"
+nickel_path = ["orchestrator", "extensions", "health_check", "enabled"]
+prompt = "Enable Health Checks"
+type = "confirm"
+
+[[elements]]
+condition = "auto_load_extensions == true && extensions_health_check_enabled == true"
+default = 30000
+help = "Health check interval in milliseconds (range: 5000-300000)"
+max = 300000
+min = 5000
+name = "extensions_health_check_interval"
+nickel_path = ["orchestrator", "extensions", "health_check", "interval_ms"]
+prompt = "Health Check Interval (ms)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "auto_load_extensions == true && extensions_health_check_enabled == true"
+default = 3
+help = "Number of failed health checks before unloading extension"
+max = 10
+min = 1
+name = "extensions_health_check_failure_threshold"
+nickel_path = ["orchestrator", "extensions", "health_check", "failure_threshold"]
+prompt = "Failure Threshold"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/orchestrator/performance-section.toml

@@ -0,0 +1,244 @@
+name = "performance_section"
+description = "Orchestrator Performance Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "performance_section_header"
+title = "⚡ Performance Configuration"
+type = "section_header"
+
+# CPU and Memory Settings
+[[elements]]
+default = false
+help = "Enable CPU affinity binding for threads"
+name = "cpu_affinity_enabled"
+nickel_path = ["orchestrator", "performance", "cpu_affinity", "enabled"]
+prompt = "Enable CPU Affinity"
+type = "confirm"
+
+[[elements]]
+condition = "cpu_affinity_enabled == true"
+default = "round_robin"
+help = "CPU core assignment strategy"
+name = "cpu_affinity_strategy"
+nickel_path = ["orchestrator", "performance", "cpu_affinity", "strategy"]
+options = ["round_robin", "sequential", "interleave"]
+prompt = "CPU Affinity Strategy"
+type = "select"
+
+# Memory Configuration
+[[elements]]
+default = false
+help = "Enable JVM-style memory limit enforcement"
+name = "memory_limits_enabled"
+nickel_path = ["orchestrator", "performance", "memory_limits", "enabled"]
+prompt = "Enable Memory Limits"
+type = "confirm"
+
+[[elements]]
+condition = "memory_limits_enabled == true"
+default = 4096
+help = "Maximum heap memory in MB"
+max = 131072
+min = 256
+name = "memory_max_heap_mb"
+nickel_path = ["orchestrator", "performance", "memory_limits", "max_heap_mb"]
+prompt = "Max Heap Memory (MB)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "memory_limits_enabled == true"
+default = 1024
+help = "Initial heap memory allocation in MB (range: 128-131072)"
+max = 131072
+min = 128
+name = "memory_initial_heap_mb"
+nickel_path = ["orchestrator", "performance", "memory_limits", "initial_heap_mb"]
+prompt = "Initial Heap Memory (MB)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "memory_limits_enabled == true"
+default = 80
+help = "Garbage collection trigger threshold (%)"
+max = 95
+min = 50
+name = "memory_gc_threshold_percent"
+nickel_path = ["orchestrator", "performance", "memory_limits", "gc_threshold_percent"]
+prompt = "GC Threshold (%)"
+type = "custom"
+custom_type = "Number"
+
+# Profiling Settings
+[[elements]]
+default = false
+help = "Enable performance profiling (CPU, memory, I/O)"
+name = "profiling_enabled"
+nickel_path = ["orchestrator", "performance", "profiling", "enabled"]
+prompt = "Enable Profiling"
+type = "confirm"
+
+[[elements]]
+condition = "profiling_enabled == true"
+default = "sampling"
+help = "Profiling mode (sampling = low overhead, instrumentation = detailed)"
+name = "profiling_mode"
+nickel_path = ["orchestrator", "performance", "profiling", "mode"]
+options = ["sampling", "instrumentation"]
+prompt = "Profiling Mode"
+type = "select"
+
+[[elements]]
+condition = "profiling_enabled == true"
+default = 100
+help = "Profiling sampling rate in Hz (samples per second)"
+max = 1000
+min = 10
+name = "profiling_sample_rate"
+nickel_path = ["orchestrator", "performance", "profiling", "sample_rate_hz"]
+prompt = "Sampling Rate (Hz)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "profiling_enabled == true"
+default = "json"
+help = "Profiling output format"
+name = "profiling_format"
+nickel_path = ["orchestrator", "performance", "profiling", "format"]
+options = ["json", "protobuf", "pprof"]
+prompt = "Profiling Format"
+type = "select"
+
+[[elements]]
+condition = "profiling_enabled == true"
+default = "/var/lib/provisioning/orchestrator/profiles"
+help = "Directory for profiling data output"
+name = "profiling_output_path"
+nickel_path = ["orchestrator", "performance", "profiling", "output_path"]
+prompt = "Profiling Output Path"
+type = "text"
+
+[[elements]]
+condition = "profiling_enabled == true"
+default = true
+help = "Enable memory profiling (allocations, heap usage)"
+name = "profiling_memory_enabled"
+nickel_path = ["orchestrator", "performance", "profiling", "memory_profiling", "enabled"]
+prompt = "Enable Memory Profiling"
+type = "confirm"
+
+[[elements]]
+condition = "profiling_enabled == true && profiling_memory_enabled == true"
+default = 512
+help = "Minimum allocation size to profile in KB (range: 1-1048576)"
+max = 1048576
+min = 1
+name = "profiling_memory_min_size_kb"
+nickel_path = ["orchestrator", "performance", "profiling", "memory_profiling", "min_alloc_kb"]
+prompt = "Min Allocation Size (KB)"
+type = "custom"
+custom_type = "Number"
+
+# Caching and Optimization
+[[elements]]
+default = true
+help = "Enable inline caching for hot paths"
+name = "inline_cache_enabled"
+nickel_path = ["orchestrator", "performance", "inline_cache", "enabled"]
+prompt = "Enable Inline Cache"
+type = "confirm"
+
+[[elements]]
+condition = "inline_cache_enabled == true"
+default = 10000
+help = "Maximum inline cache entries (range: 1000-1000000)"
+max = 1000000
+min = 1000
+name = "inline_cache_max_entries"
+nickel_path = ["orchestrator", "performance", "inline_cache", "max_entries"]
+prompt = "Max Cache Entries"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "inline_cache_enabled == true"
+default = 3600
+help = "Inline cache TTL in seconds (range: 60-86400)"
+max = 86400
+min = 60
+name = "inline_cache_ttl"
+nickel_path = ["orchestrator", "performance", "inline_cache", "ttl_seconds"]
+prompt = "Cache TTL (seconds)"
+type = "custom"
+custom_type = "Number"
+
+# Thread Pool Configuration
+[[elements]]
+default = 4
+help = "Number of worker threads for task execution"
+max = 256
+min = 1
+name = "thread_pool_size"
+nickel_path = ["orchestrator", "performance", "thread_pool", "size"]
+prompt = "Thread Pool Size"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 128
+help = "Work queue size per worker thread"
+max = 10000
+min = 8
+name = "thread_pool_queue_size"
+nickel_path = ["orchestrator", "performance", "thread_pool", "queue_size"]
+prompt = "Work Queue Size"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = "work_stealing"
+help = "Thread pool scheduling strategy"
+name = "thread_pool_strategy"
+nickel_path = ["orchestrator", "performance", "thread_pool", "strategy"]
+options = ["work_stealing", "fifo", "priority"]
+prompt = "Thread Pool Strategy"
+type = "select"
+
+# I/O Optimization
+[[elements]]
+default = true
+help = "Enable async I/O operations"
+name = "async_io_enabled"
+nickel_path = ["orchestrator", "performance", "async_io", "enabled"]
+prompt = "Enable Async I/O"
+type = "confirm"
+
+[[elements]]
+condition = "async_io_enabled == true"
+default = 4
+help = "Number of I/O worker threads"
+max = 32
+min = 1
+name = "async_io_worker_threads"
+nickel_path = ["orchestrator", "performance", "async_io", "worker_threads"]
+prompt = "I/O Worker Threads"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "async_io_enabled == true"
+default = 65536
+help = "Maximum I/O operations in flight (range: 256-1048576)"
+max = 1048576
+min = 256
+name = "async_io_max_in_flight"
+nickel_path = ["orchestrator", "performance", "async_io", "max_in_flight"]
+prompt = "Max I/O In Flight"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/orchestrator/queue-section.toml

@@ -0,0 +1,79 @@
+name = "queue_section"
+description = "Orchestrator Queue Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "queue_section_header"
+title = "📦 Queue Configuration"
+type = "section_header"
+
+[[elements]]
+default = 5
+help = "Maximum number of concurrent tasks running simultaneously (range: ${constraint.orchestrator.queue.concurrent_tasks.min}-${constraint.orchestrator.queue.concurrent_tasks.max})"
+max = "${constraint.orchestrator.queue.concurrent_tasks.max}"
+min = "${constraint.orchestrator.queue.concurrent_tasks.min}"
+name = "queue_max_concurrent_tasks"
+nickel_path = ["queue", "max_concurrent_tasks"]
+prompt = "Max Concurrent Tasks"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 3
+help = "Number of retry attempts for failed tasks (range: ${constraint.orchestrator.queue.retry_attempts.min}-${constraint.orchestrator.queue.retry_attempts.max})"
+max = "${constraint.orchestrator.queue.retry_attempts.max}"
+min = "${constraint.orchestrator.queue.retry_attempts.min}"
+name = "queue_retry_attempts"
+nickel_path = ["queue", "retry_attempts"]
+prompt = "Retry Attempts"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 5000
+help = "Delay in milliseconds between retry attempts (range: ${constraint.orchestrator.queue.retry_delay.min}-${constraint.orchestrator.queue.retry_delay.max})"
+max = "${constraint.orchestrator.queue.retry_delay.max}"
+min = "${constraint.orchestrator.queue.retry_delay.min}"
+name = "queue_retry_delay"
+nickel_path = ["queue", "retry_delay"]
+prompt = "Retry Delay (ms)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 3600000
+help = "Task timeout in milliseconds (range: ${constraint.orchestrator.queue.task_timeout.min}-${constraint.orchestrator.queue.task_timeout.max})"
+max = "${constraint.orchestrator.queue.task_timeout.max}"
+min = "${constraint.orchestrator.queue.task_timeout.min}"
+name = "queue_task_timeout"
+nickel_path = ["queue", "task_timeout"]
+prompt = "Task Timeout (ms)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = true
+help = "Enable persistent queue storage"
+name = "queue_persist"
+nickel_path = ["queue", "persist"]
+prompt = "Persistent Queue"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Enable priority queue support for task ordering"
+name = "queue_priority_queue"
+nickel_path = ["queue", "priority_queue"]
+prompt = "Priority Queue"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Enable queue metrics collection"
+name = "queue_metrics"
+nickel_path = ["queue", "metrics"]
+prompt = "Queue Metrics"
+type = "confirm"

.typedialog/platform/forms/fragments/orchestrator/storage-section.toml

@@ -0,0 +1,181 @@
+name = "storage_section"
+description = "Orchestrator Storage Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "storage_section_header"
+title = "💾 Storage Configuration"
+type = "section_header"
+
+# Storage Backend Selection
+[[elements]]
+default = "filesystem"
+help = "Storage backend for workflow state and artifacts"
+name = "storage_backend"
+nickel_path = ["orchestrator", "storage", "backend"]
+options = ["filesystem", "surrealdb_embedded", "surrealdb_server"]
+prompt = "Storage Backend"
+type = "select"
+
+# Filesystem Storage (conditional)
+[[elements]]
+condition = "storage_backend == 'filesystem'"
+default = "/var/lib/provisioning/orchestrator/data"
+help = "Path for local filesystem storage (absolute path required)"
+name = "storage_path"
+nickel_path = ["orchestrator", "storage", "path"]
+prompt = "Storage Path"
+required = true
+type = "text"
+
+# SurrealDB Embedded (conditional)
+[[elements]]
+condition = "storage_backend == 'surrealdb_embedded'"
+default = "/var/lib/provisioning/orchestrator/surrealdb"
+help = "Path for embedded SurrealDB data directory"
+name = "surrealdb_embedded_path"
+nickel_path = ["orchestrator", "storage", "path"]
+prompt = "SurrealDB Data Path"
+required = true
+type = "text"
+
+# SurrealDB Server (conditional)
+[[elements]]
+condition = "storage_backend == 'surrealdb_server'"
+default = "http://localhost:8000"
+help = "URL for SurrealDB server (e.g., http://surrealdb:8000)"
+name = "surrealdb_url"
+nickel_path = ["orchestrator", "storage", "surrealdb_url"]
+prompt = "SurrealDB URL"
+required = true
+type = "text"
+
+[[elements]]
+condition = "storage_backend == 'surrealdb_server'"
+default = "provisioning"
+help = "SurrealDB namespace"
+name = "surrealdb_namespace"
+nickel_path = ["orchestrator", "storage", "surrealdb_namespace"]
+prompt = "Namespace"
+required = true
+type = "text"
+
+[[elements]]
+condition = "storage_backend == 'surrealdb_server'"
+default = "orchestrator"
+help = "SurrealDB database name"
+name = "surrealdb_database"
+nickel_path = ["orchestrator", "storage", "surrealdb_database"]
+prompt = "Database"
+required = true
+type = "text"
+
+# Storage Cache Configuration
+[[elements]]
+default = false
+help = "Enable storage caching for improved performance"
+name = "storage_cache_enabled"
+nickel_path = ["orchestrator", "storage", "cache", "enabled"]
+prompt = "Enable Storage Cache"
+type = "confirm"
+
+[[elements]]
+condition = "storage_cache_enabled == true"
+default = "lru"
+help = "Cache eviction policy"
+name = "storage_cache_eviction_policy"
+nickel_path = ["orchestrator", "storage", "cache", "eviction_policy"]
+options = ["lru", "lfu", "fifo"]
+prompt = "Cache Eviction Policy"
+type = "select"
+
+[[elements]]
+condition = "storage_cache_enabled == true"
+default = 3600
+help = "Cache TTL in seconds (range: 60-86400)"
+max = 86400
+min = 60
+name = "storage_cache_ttl"
+nickel_path = ["orchestrator", "storage", "cache", "ttl"]
+prompt = "Cache TTL (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "storage_cache_enabled == true"
+default = 1000
+help = "Maximum cache entries (range: 10-1000000)"
+max = 1000000
+min = 10
+name = "storage_cache_max_entries"
+nickel_path = ["orchestrator", "storage", "cache", "max_entries"]
+prompt = "Max Cache Entries"
+type = "custom"
+custom_type = "Number"
+
+# Storage Compression Configuration
+[[elements]]
+default = false
+help = "Enable compression for stored data"
+name = "storage_compression_enabled"
+nickel_path = ["orchestrator", "storage", "compression", "enabled"]
+prompt = "Enable Compression"
+type = "confirm"
+
+[[elements]]
+condition = "storage_compression_enabled == true"
+default = "snappy"
+help = "Compression algorithm"
+name = "storage_compression_algorithm"
+nickel_path = ["orchestrator", "storage", "compression", "algorithm"]
+options = ["snappy", "zstd", "gzip"]
+prompt = "Compression Algorithm"
+type = "select"
+
+[[elements]]
+condition = "storage_compression_enabled == true && storage_compression_algorithm == 'zstd'"
+default = 3
+help = "Compression level (1-19, higher = better compression but slower)"
+max = 19
+min = 1
+name = "storage_compression_level"
+nickel_path = ["orchestrator", "storage", "compression", "level"]
+prompt = "Compression Level"
+type = "custom"
+custom_type = "Number"
+
+# Storage Garbage Collection
+[[elements]]
+default = true
+help = "Enable automatic garbage collection of orphaned artifacts"
+name = "storage_gc_enabled"
+nickel_path = ["orchestrator", "storage", "gc", "enabled"]
+prompt = "Enable Garbage Collection"
+type = "confirm"
+
+[[elements]]
+condition = "storage_gc_enabled == true"
+default = 604800
+help = "Retention period for artifacts in seconds (default: 7 days, range: 3600-31536000)"
+max = 31536000
+min = 3600
+name = "storage_gc_retention"
+nickel_path = ["orchestrator", "storage", "gc", "retention_seconds"]
+prompt = "GC Retention (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "storage_gc_enabled == true"
+default = 3600
+help = "Garbage collection interval in seconds (default: 1 hour, range: 300-86400)"
+max = 86400
+min = 300
+name = "storage_gc_interval"
+nickel_path = ["orchestrator", "storage", "gc", "interval_seconds"]
+prompt = "GC Interval (seconds)"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/provisioning-daemon/actions.toml

@@ -0,0 +1,51 @@
+name = "actions"
+description = "Provisioning Daemon Actions Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "daemon_actions_header"
+title = "✓ Actions Configuration"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Auto-cleanup completed tasks"
+name = "daemon_actions_auto_cleanup"
+nickel_path = ["provisioning_daemon", "actions", "auto_cleanup"]
+prompt = "Auto-cleanup"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Auto-update provisioning system"
+name = "daemon_actions_auto_update"
+nickel_path = ["provisioning_daemon", "actions", "auto_update"]
+prompt = "Auto-update"
+type = "confirm"
+
+[[elements]]
+default = true
+help = "Sync workspace configuration"
+name = "daemon_actions_workspace_sync"
+nickel_path = ["provisioning_daemon", "actions", "workspace_sync"]
+prompt = "Workspace Sync"
+type = "confirm"
+
+[[elements]]
+default = true
+help = "Cleanup ephemeral resources"
+name = "daemon_actions_ephemeral_cleanup"
+nickel_path = ["provisioning_daemon", "actions", "ephemeral_cleanup"]
+prompt = "Ephemeral Cleanup"
+type = "confirm"
+
+[[elements]]
+default = true
+help = "Perform health checks"
+name = "daemon_actions_health_checks"
+nickel_path = ["provisioning_daemon", "actions", "health_checks"]
+prompt = "Health Checks"
+type = "confirm"

.typedialog/platform/forms/fragments/provisioning-daemon/daemon.toml

@@ -0,0 +1,41 @@
+name = "daemon"
+description = "Provisioning Daemon Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "daemon_config_header"
+title = "⚙️ Daemon Configuration"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Enable provisioning daemon"
+name = "daemon_enabled"
+nickel_path = ["provisioning_daemon", "daemon", "enabled"]
+prompt = "Enable Daemon"
+type = "confirm"
+
+[[elements]]
+default = 30
+help = "Polling interval in seconds"
+max = 3600
+min = 5
+name = "daemon_poll_interval"
+nickel_path = ["provisioning_daemon", "daemon", "poll_interval"]
+prompt = "Poll Interval (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 4
+help = "Maximum worker threads"
+max = 32
+min = 1
+name = "daemon_max_workers"
+nickel_path = ["provisioning_daemon", "daemon", "max_workers"]
+prompt = "Max Workers"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/provisioning-daemon/health.toml

@@ -0,0 +1,44 @@
+name = "health"
+description = "Provisioning Daemon Health Check Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "daemon_health_header"
+title = "❤️ Health Check Configuration"
+type = "section_header"
+
+[[elements]]
+default = 60000
+help = "Health check interval in milliseconds"
+max = 300000
+min = 5000
+name = "daemon_health_check_interval"
+nickel_path = ["provisioning_daemon", "health", "check_interval"]
+prompt = "Check Interval (ms)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 30000
+help = "Health check timeout in milliseconds"
+max = 60000
+min = 1000
+name = "daemon_health_check_timeout"
+nickel_path = ["provisioning_daemon", "health", "timeout"]
+prompt = "Timeout (ms)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 3
+help = "Failure threshold before marking unhealthy"
+max = 10
+min = 1
+name = "daemon_health_failure_threshold"
+nickel_path = ["provisioning_daemon", "health", "failure_threshold"]
+prompt = "Failure Threshold"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/provisioning-daemon/logging.toml

@@ -0,0 +1,46 @@
+name = "logging"
+description = "Provisioning Daemon Logging Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "daemon_logging_header"
+title = "📝 Logging Configuration"
+type = "section_header"
+
+[[elements]]
+default = "info"
+help = "Logging level"
+name = "daemon_logging_level"
+nickel_path = ["provisioning_daemon", "logging", "level"]
+options = ["trace", "debug", "info", "warn", "error"]
+prompt = "Log Level"
+type = "select"
+
+[[elements]]
+default = "/var/log/provisioning/daemon.log"
+help = "Log file path"
+name = "daemon_logging_file"
+nickel_path = ["provisioning_daemon", "logging", "file"]
+prompt = "Log File"
+required = true
+type = "text"
+
+[[elements]]
+default = "json"
+help = "Log format"
+name = "daemon_logging_format"
+nickel_path = ["provisioning_daemon", "logging", "format"]
+options = ["json", "text"]
+prompt = "Log Format"
+type = "select"
+
+[[elements]]
+default = false
+help = "Send logs to syslog"
+name = "daemon_logging_syslog"
+nickel_path = ["provisioning_daemon", "logging", "syslog"]
+prompt = "Enable Syslog"
+type = "confirm"

.typedialog/platform/forms/fragments/provisioning-daemon/workers.toml

@@ -0,0 +1,44 @@
+name = "workers"
+description = "Provisioning Daemon Worker Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "daemon_workers_header"
+title = "👷 Worker Configuration"
+type = "section_header"
+
+[[elements]]
+default = 4
+help = "Worker pool size"
+max = 32
+min = 1
+name = "daemon_worker_pool_size"
+nickel_path = ["provisioning_daemon", "workers", "pool_size"]
+prompt = "Pool Size"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 1000
+help = "Task queue capacity"
+max = 100000
+min = 10
+name = "daemon_worker_task_queue_size"
+nickel_path = ["provisioning_daemon", "workers", "task_queue_size"]
+prompt = "Queue Size"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 300000
+help = "Worker timeout in milliseconds"
+max = 3600000
+min = 10000
+name = "daemon_worker_timeout"
+nickel_path = ["provisioning_daemon", "workers", "timeout"]
+prompt = "Timeout (ms)"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/provisioning/.typedialog/provisioning/platform/scripts/README.md

@@ -0,0 +1,98 @@
+# TypeDialog + Nickel Configuration Scripts
+
+Phase 8 Nushell automation scripts for interactive configuration workflow, config generation, validation, and deployment.
+
+## Quick Start
+
+```toml
+# 1. Interactive Configuration (TypeDialog)
+nu scripts/configure.nu orchestrator solo
+
+# 2. Generate TOML configs
+nu scripts/generate-configs.nu orchestrator solo
+
+# 3. Validate configuration
+nu scripts/validate-config.nu provisioning/.typedialog/provisioning/platform/values/orchestrator.solo.ncl
+
+# 4. Render Docker Compose
+nu scripts/render-docker-compose.nu solo
+
+# 5. Full deployment workflow
+nu scripts/install-services.nu orchestrator solo --docker
+```
+
+## Scripts Overview
+
+### Shared Helpers
+- **ansi.nu** - ANSI color and emoji output formatting
+- **paths.nu** - Path validation and directory structure helpers  
+- **external.nu** - Safe external command execution with error handling
+
+### Core Configuration Scripts
+- **configure.nu** - Interactive TypeDialog configuration wizard
+- **generate-configs.nu** - Export Nickel configs to TOML
+- **validate-config.nu** - Validate Nickel configuration
+
+### Rendering Scripts
+- **render-docker-compose.nu** - Render Docker Compose from Nickel templates
+- **render-kubernetes.nu** - Render Kubernetes manifests from Nickel templates
+
+### Deployment & Monitoring Scripts
+- **install-services.nu** - Full deployment orchestration
+- **detect-services.nu** - Auto-detect running services
+
+## Supported Services
+- orchestrator (port 9090)
+- control-center (port 8080)
+- mcp-server (port 8888)
+- installer (port 8000)
+
+## Supported Deployment Modes
+- solo (2 CPU, 4GB RAM)
+- multiuser (4 CPU, 8GB RAM)
+- cicd (8 CPU, 16GB RAM)
+- enterprise (16+ CPU, 32+ GB RAM)
+
+## Nushell Compliance
+All scripts follow Nushell 0.109.0+ guidelines with proper type signatures, error handling, and no try-catch blocks.
+
+## Examples
+
+### Single Service Configuration
+```toml
+nu scripts/configure.nu orchestrator solo --backend web
+nu scripts/validate-config.nu provisioning/.typedialog/provisioning/platform/values/orchestrator.solo.ncl
+nu scripts/generate-configs.nu orchestrator solo
+cargo run -p orchestrator -- --config provisioning/platform/config/orchestrator.solo.toml
+```
+
+### Docker Compose Deployment
+```toml
+nu scripts/generate-configs.nu orchestrator multiuser
+nu scripts/render-docker-compose.nu multiuser
+docker-compose -f provisioning/platform/infrastructure/docker/docker-compose.multiuser.yml up -d
+```
+
+### Kubernetes Deployment
+```yaml
+nu scripts/generate-configs.nu orchestrator enterprise
+nu scripts/render-kubernetes.nu enterprise --namespace production
+nu scripts/install-services.nu all enterprise --kubernetes --namespace production
+```
+
+## Phase 8 Status
+
+✅ Phase 8.A: Shared helper modules
+✅ Phase 8.B: Core configuration scripts  
+✅ Phase 8.C: Rendering scripts
+✅ Phase 8.D: Deployment orchestration
+✅ Phase 8.E: Testing and documentation
+
+## Requirements
+
+- Nushell 0.109.1+
+- Nickel 1.15.1+
+- TypeDialog CLI
+- yq v4.50.1+
+- Docker (optional)
+- kubectl (optional)

.typedialog/platform/forms/fragments/rag/embeddings.toml

@@ -0,0 +1,60 @@
+name = "embeddings"
+description = "RAG Embeddings Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "rag_embeddings_header"
+title = "🧠 Embeddings Configuration"
+type = "section_header"
+
+[[elements]]
+default = "local"
+help = "Embedding model provider (openai, local, anthropic)"
+name = "rag_embeddings_provider"
+nickel_path = ["rag", "embeddings", "provider"]
+options = ["openai", "local", "anthropic"]
+prompt = "Provider"
+required = true
+type = "select"
+
+[[elements]]
+default = "all-MiniLM-L6-v2"
+help = "Embedding model name"
+name = "rag_embeddings_model"
+nickel_path = ["rag", "embeddings", "model"]
+prompt = "Model"
+required = true
+type = "text"
+
+[[elements]]
+default = 384
+help = "Embedding dimension (384, 768, 1536, 3072)"
+name = "rag_embeddings_dimension"
+nickel_path = ["rag", "embeddings", "dimension"]
+options = [384, 768, 1536, 3072]
+prompt = "Dimension"
+type = "select"
+
+[[elements]]
+default = 32
+help = "Batch size for embedding operations"
+max = 1000
+min = 1
+name = "rag_embeddings_batch_size"
+nickel_path = ["rag", "embeddings", "batch_size"]
+prompt = "Batch Size"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+condition = "rag_embeddings_provider != 'local'"
+default = ""
+help = "API key for embedding service"
+name = "rag_embeddings_api_key"
+nickel_path = ["rag", "embeddings", "api_key"]
+prompt = "API Key"
+required = false
+type = "password"

.typedialog/platform/forms/fragments/rag/ingestion.toml

@@ -0,0 +1,57 @@
+name = "ingestion"
+description = "RAG Document Ingestion Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "rag_ingestion_header"
+title = "📄 Document Ingestion Configuration"
+type = "section_header"
+
+[[elements]]
+default = true
+help = "Auto-ingest documents on startup"
+name = "rag_ingestion_auto_ingest"
+nickel_path = ["rag", "ingestion", "auto_ingest"]
+prompt = "Auto-ingest"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Watch for file changes and auto-ingest"
+name = "rag_ingestion_watch_files"
+nickel_path = ["rag", "ingestion", "watch_files"]
+prompt = "Watch Files"
+type = "confirm"
+
+[[elements]]
+default = 512
+help = "Document chunk size in characters"
+max = 4096
+min = 128
+name = "rag_ingestion_chunk_size"
+nickel_path = ["rag", "ingestion", "chunk_size"]
+prompt = "Chunk Size"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 50
+help = "Overlap between chunks in characters"
+max = 1000
+min = 0
+name = "rag_ingestion_overlap"
+nickel_path = ["rag", "ingestion", "overlap"]
+prompt = "Chunk Overlap"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = "md, txt, toml"
+help = "Supported document types (comma-separated)"
+name = "rag_ingestion_doc_types"
+nickel_path = ["rag", "ingestion", "doc_types"]
+prompt = "Document Types"
+type = "text"

.typedialog/platform/forms/fragments/rag/llm.toml

@@ -0,0 +1,72 @@
+name = "llm"
+description = "RAG Language Model Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "rag_llm_header"
+title = "🤖 Language Model Configuration"
+type = "section_header"
+
+[[elements]]
+default = "anthropic"
+help = "LLM provider (anthropic, openai, ollama)"
+name = "rag_llm_provider"
+nickel_path = ["rag", "llm", "provider"]
+options = ["anthropic", "openai", "ollama"]
+prompt = "Provider"
+required = true
+type = "select"
+
+[[elements]]
+default = "claude-3-5-sonnet-20241022"
+help = "Model name"
+name = "rag_llm_model"
+nickel_path = ["rag", "llm", "model"]
+prompt = "Model"
+required = true
+type = "text"
+
+[[elements]]
+condition = "rag_llm_provider != 'ollama'"
+default = ""
+help = "API key for LLM service"
+name = "rag_llm_api_key"
+nickel_path = ["rag", "llm", "api_key"]
+prompt = "API Key"
+required = false
+type = "password"
+
+[[elements]]
+condition = "rag_llm_provider == 'ollama'"
+default = "http://localhost:11434"
+help = "Ollama API URL"
+name = "rag_llm_api_url"
+nickel_path = ["rag", "llm", "api_url"]
+prompt = "API URL"
+required = false
+type = "text"
+
+[[elements]]
+default = 0.7
+help = "Model temperature (0.0-2.0)"
+max = 2.0
+min = 0.0
+name = "rag_llm_temperature"
+nickel_path = ["rag", "llm", "temperature"]
+prompt = "Temperature"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 2048
+help = "Maximum tokens to generate"
+max = 32768
+min = 1
+name = "rag_llm_max_tokens"
+nickel_path = ["rag", "llm", "max_tokens"]
+prompt = "Max Tokens"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/rag/retrieval.toml

@@ -0,0 +1,49 @@
+name = "retrieval"
+description = "RAG Retrieval Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "rag_retrieval_header"
+title = "🔍 Retrieval Configuration"
+type = "section_header"
+
+[[elements]]
+default = 5
+help = "Number of top results to return"
+max = 100
+min = 1
+name = "rag_retrieval_top_k"
+nickel_path = ["rag", "retrieval", "top_k"]
+prompt = "Top K Results"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 0.75
+help = "Minimum similarity threshold (0.0-1.0)"
+max = 1.0
+min = 0.0
+name = "rag_retrieval_similarity_threshold"
+nickel_path = ["rag", "retrieval", "similarity_threshold"]
+prompt = "Similarity Threshold"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = false
+help = "Enable re-ranking of results"
+name = "rag_retrieval_reranking"
+nickel_path = ["rag", "retrieval", "reranking"]
+prompt = "Enable Re-ranking"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Enable hybrid search (keyword + semantic)"
+name = "rag_retrieval_hybrid"
+nickel_path = ["rag", "retrieval", "hybrid"]
+prompt = "Enable Hybrid Search"
+type = "confirm"

.typedialog/platform/forms/fragments/rag/vector-db.toml

@@ -0,0 +1,50 @@
+name = "vector_db"
+description = "RAG Vector Database Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "rag_vector_db_header"
+title = "🗄️ Vector Database Configuration"
+type = "section_header"
+
+[[elements]]
+default = "memory"
+help = "Vector database type (memory, surrealdb, qdrant, milvus)"
+name = "rag_vector_db_type"
+nickel_path = ["rag", "vector_db", "db_type"]
+options = ["memory", "surrealdb", "qdrant", "milvus"]
+prompt = "Database Type"
+required = true
+type = "select"
+
+[[elements]]
+condition = "rag_vector_db_type != 'memory'"
+default = "http://localhost:8000"
+help = "Vector database URL"
+name = "rag_vector_db_url"
+nickel_path = ["rag", "vector_db", "url"]
+prompt = "Database URL"
+required = false
+type = "text"
+
+[[elements]]
+default = "provisioning"
+help = "Vector database namespace"
+name = "rag_vector_db_namespace"
+nickel_path = ["rag", "vector_db", "namespace"]
+prompt = "Namespace"
+required = true
+type = "text"
+
+[[elements]]
+condition = "rag_vector_db_type == 'surrealdb'"
+default = "rag"
+help = "Database name"
+name = "rag_vector_db_database"
+nickel_path = ["rag", "vector_db", "database"]
+prompt = "Database Name"
+required = false
+type = "text"

.typedialog/platform/forms/fragments/server-section.toml

@@ -0,0 +1,93 @@
+name = "server_section"
+description = "HTTP Server Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "server_section_header"
+title = "🌐 HTTP Server Configuration"
+type = "section_header"
+
+[[elements]]
+default = "127.0.0.1"
+help = "Address to bind the HTTP server to (127.0.0.1=local, 0.0.0.0=all interfaces)"
+name = "server_host"
+nickel_path = ["server", "host"]
+prompt = "Server Host/Address"
+required = true
+type = "text"
+
+[[elements]]
+default = 9090
+help = "HTTP server port number (range: ${constraint.common.server.port.min}-${constraint.common.server.port.max})"
+max = "${constraint.common.server.port.max}"
+min = "${constraint.common.server.port.min}"
+name = "server_port"
+nickel_path = ["server", "port"]
+prompt = "Server Port"
+required = true
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 4
+help = "Number of worker threads for HTTP server (range: ${constraint.common.server.workers.min}-${constraint.common.server.workers.max})"
+max = "${constraint.common.server.workers.max}"
+min = "${constraint.common.server.workers.min}"
+name = "server_workers"
+nickel_path = ["server", "workers"]
+prompt = "Worker Threads"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 75
+help = "TCP keep-alive timeout in seconds (0 = disabled, range: ${constraint.common.server.keep_alive.min}-${constraint.common.server.keep_alive.max})"
+max = "${constraint.common.server.keep_alive.max}"
+min = "${constraint.common.server.keep_alive.min}"
+name = "server_keep_alive"
+nickel_path = ["server", "keep_alive"]
+prompt = "Keep-Alive Timeout (seconds)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 100
+help = "Maximum number of concurrent TCP connections (range: ${constraint.common.server.max_connections.min}-${constraint.common.server.max_connections.max})"
+max = "${constraint.common.server.max_connections.max}"
+min = "${constraint.common.server.max_connections.min}"
+name = "server_max_connections"
+nickel_path = ["server", "max_connections"]
+prompt = "Max Connections"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = 30000
+help = "Request timeout in milliseconds"
+min = 1000
+name = "server_request_timeout"
+nickel_path = ["server", "request_timeout"]
+prompt = "Request Timeout (ms)"
+type = "custom"
+custom_type = "Number"
+
+[[elements]]
+default = true
+help = "Enable graceful shutdown to allow in-flight requests to complete"
+name = "server_graceful_shutdown"
+nickel_path = ["server", "graceful_shutdown"]
+prompt = "Graceful Shutdown"
+type = "confirm"
+
+[[elements]]
+default = 30
+help = "Graceful shutdown timeout in seconds"
+min = 1
+name = "server_shutdown_timeout"
+nickel_path = ["server", "shutdown_timeout"]
+prompt = "Shutdown Timeout (seconds)"
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/vault-service/ha.toml

@@ -0,0 +1,30 @@
+name = "ha"
+description = "Vault Service High Availability Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "vault_ha_header"
+title = "🔄 High Availability Configuration"
+type = "section_header"
+
+[[elements]]
+default = false
+help = "Enable high availability mode with clustering"
+name = "vault_ha_enabled"
+nickel_path = ["vault_service", "deployment", "ha_enabled"]
+prompt = "Enable HA Mode"
+type = "confirm"
+
+[[elements]]
+condition = "vault_ha_enabled == true"
+default = "raft"
+help = "HA cluster backend (Raft integrated or external Consul)"
+name = "vault_ha_mode"
+nickel_path = ["vault_service", "deployment", "ha_mode"]
+options = ["raft", "consul"]
+prompt = "HA Mode"
+required = true
+type = "select"

.typedialog/platform/forms/fragments/vault-service/mount.toml

@@ -0,0 +1,29 @@
+name = "mount"
+description = "Vault Service Mount Point Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "vault_mount_header"
+title = "📍 Mount Point Configuration"
+type = "section_header"
+
+[[elements]]
+default = "transit"
+help = "Vault mount point path for secret engine"
+name = "vault_mount_point"
+nickel_path = ["vault_service", "mount", "path"]
+prompt = "Mount Point"
+required = true
+type = "text"
+
+[[elements]]
+default = "provisioning-master"
+help = "Name of the encryption key to use"
+name = "vault_mount_key_name"
+nickel_path = ["vault_service", "mount", "key"]
+prompt = "Key Name"
+required = true
+type = "text"

.typedialog/platform/forms/fragments/vault-service/server.toml

@@ -0,0 +1,32 @@
+name = "server"
+description = "Vault Service Server Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "vault_server_header"
+title = "🖥️ Server Configuration"
+type = "section_header"
+
+[[elements]]
+default = "127.0.0.1"
+help = "HTTP server bind address (127.0.0.1 for local, 0.0.0.0 for all interfaces)"
+name = "vault_server_host"
+nickel_path = ["vault_service", "server", "host"]
+prompt = "Server Host"
+required = true
+type = "text"
+
+[[elements]]
+default = 8200
+help = "HTTP server port (range: 1024-65535)"
+max = 65535
+min = 1024
+name = "vault_server_port"
+nickel_path = ["vault_service", "server", "port"]
+prompt = "Server Port"
+required = true
+type = "custom"
+custom_type = "Number"

.typedialog/platform/forms/fragments/vault-service/storage.toml

@@ -0,0 +1,40 @@
+name = "storage"
+description = "Vault Service Storage Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "vault_storage_header"
+title = "💾 Storage Configuration"
+type = "section_header"
+
+[[elements]]
+default = "filesystem"
+help = "Storage backend for secrets (filesystem, surrealdb, etcd, memory)"
+name = "vault_storage_backend"
+nickel_path = ["vault_service", "storage", "backend"]
+options = ["filesystem", "memory", "surrealdb", "etcd", "postgresql"]
+prompt = "Storage Backend"
+required = true
+type = "select"
+
+[[elements]]
+condition = "vault_storage_backend == 'filesystem'"
+default = "/var/lib/vault/data"
+help = "Path for local filesystem storage (absolute path required)"
+name = "vault_storage_path"
+nickel_path = ["vault_service", "storage", "path"]
+prompt = "Storage Path"
+required = true
+type = "text"
+
+[[elements]]
+default = ""
+help = "Encryption key for at-rest encryption (base64 encoded, optional)"
+name = "vault_storage_encryption_key"
+nickel_path = ["vault_service", "storage", "encryption_key"]
+prompt = "Encryption Key (optional)"
+required = false
+type = "text"

.typedialog/platform/forms/fragments/vault-service/tls.toml

@@ -0,0 +1,49 @@
+name = "tls"
+description = "Vault Service TLS Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+border_bottom = false
+border_top = true
+name = "vault_tls_header"
+title = "🔒 TLS Configuration"
+type = "section_header"
+
+[[elements]]
+default = false
+help = "Enable TLS certificate verification for secure connections"
+name = "vault_tls_verify"
+nickel_path = ["vault_service", "tls", "verify"]
+prompt = "Verify TLS Certificates"
+type = "confirm"
+
+[[elements]]
+condition = "vault_tls_verify == true"
+default = ""
+help = "Path to CA certificate file for TLS verification"
+name = "vault_tls_ca_cert_path"
+nickel_path = ["vault_service", "tls", "ca_cert_path"]
+prompt = "CA Certificate Path"
+required = false
+type = "text"
+
+[[elements]]
+condition = "vault_tls_verify == true"
+default = ""
+help = "Path to client certificate file (optional)"
+name = "vault_tls_client_cert_path"
+nickel_path = ["vault_service", "tls", "client_cert_path"]
+prompt = "Client Certificate Path (optional)"
+required = false
+type = "text"
+
+[[elements]]
+condition = "vault_tls_verify == true"
+default = ""
+help = "Path to client key file (optional)"
+name = "vault_tls_client_key_path"
+nickel_path = ["vault_service", "tls", "client_key_path"]
+prompt = "Client Key Path (optional)"
+required = false
+type = "text"

.typedialog/platform/forms/fragments/workspace-section.toml

@@ -0,0 +1,38 @@
+name = "workspace_section"
+description = "Workspace Configuration Fragment"
+display_mode = "complete"
+
+
+[[elements]]
+help = "Name of the workspace this service will serve"
+name = "workspace_name"
+nickel_path = ["workspace", "name"]
+placeholder = "default"
+prompt = "Workspace Name"
+required = true
+type = "text"
+
+[[elements]]
+help = "Absolute path to the workspace directory"
+name = "workspace_path"
+nickel_path = ["workspace", "path"]
+placeholder = "/var/lib/provisioning/{service}"
+prompt = "Workspace Path"
+required = true
+type = "text"
+
+[[elements]]
+default = true
+help = "Enable or disable this service for the workspace"
+name = "workspace_enabled"
+nickel_path = ["workspace", "enabled"]
+prompt = "Enable Service"
+type = "confirm"
+
+[[elements]]
+default = false
+help = "Allow this service instance to serve multiple workspaces"
+name = "multi_workspace_mode"
+nickel_path = ["workspace", "multi_workspace"]
+prompt = "Multi-Workspace Mode"
+type = "confirm"

.typedialog/platform/forms/installer-form.toml

@@ -0,0 +1,113 @@
+description = "Interactive configuration for Provisioning Platform Installer (deployment and lifecycle management)"
+display_mode = "complete"
+fallback_locale = "en-US"
+name = "installer_configuration"
+
+# ============================================================================
+# INSTALLER SERVICE FORM - COMPOSED FROM FRAGMENTS
+# ============================================================================
+# This form uses fragment composition pattern for modular configuration
+# All fragments are located in ./fragments/ subdirectory
+# ============================================================================
+
+# DEPLOYMENT MODE SELECTION
+# Determines deployment environment and service resources
+[[items]]
+description = "Select deployment mode and database backend for installed services"
+includes = [
+  "fragments/deployment/mode-selection.toml",
+  "fragments/deployment/database-backend-selection.toml",
+]
+name = "deployment_mode_group"
+title = "Deployment Configuration"
+type = "group"
+
+# INSTALLATION TARGET CONFIGURATION
+# Target environment: local, remote, kubernetes, docker
+[[items]]
+description = "Configure target environment and connectivity"
+includes = ["fragments/installer/target-section.toml"]
+name = "target_group"
+title = "Installation Target"
+type = "group"
+
+# PREFLIGHT CHECKS CONFIGURATION
+# Disk, memory, CPU, network, dependencies, ports validation
+[[items]]
+description = "Configure pre-installation validation checks"
+includes = ["fragments/installer/preflight-section.toml"]
+name = "preflight_group"
+title = "Preflight Checks"
+type = "group"
+
+# INSTALLATION STRATEGY CONFIGURATION
+# Installation mode, parallelization, timeout, rollback, logging, hooks
+[[items]]
+description = "Configure installation behavior and strategy"
+includes = ["fragments/installer/installation-section.toml"]
+name = "installation_group"
+title = "Installation Strategy"
+type = "group"
+
+# SERVICES SELECTION CONFIGURATION
+# Which services to install, ports, auto-start, health checks
+[[items]]
+description = "Select which services to install and configure their deployment"
+includes = ["fragments/installer/services-section.toml"]
+name = "services_group"
+title = "Services Selection"
+type = "group"
+
+# DATABASE CONFIGURATION
+# Database initialization, migrations, backup, verification, optimization
+[[items]]
+description = "Configure database initialization and management"
+includes = ["fragments/installer/database-section.toml"]
+name = "database_group"
+title = "Database Configuration"
+type = "group"
+
+# STORAGE CONFIGURATION
+# Storage location, backend, compression, encryption, replication, cleanup
+[[items]]
+description = "Configure storage for provisioning data and artifacts"
+includes = ["fragments/installer/storage-section.toml"]
+name = "storage_group"
+title = "Storage Configuration"
+type = "group"
+
+# NETWORKING CONFIGURATION
+# Bind address, DNS, TLS, firewall, load balancer, ingress, proxy
+[[items]]
+description = "Configure networking, DNS, TLS, and firewall"
+includes = ["fragments/installer/networking-section.toml"]
+name = "networking_group"
+title = "Networking Configuration"
+type = "group"
+
+# HIGH AVAILABILITY CONFIGURATION
+# Cluster setup, replication, health checks, failover, backup, load distribution
+[[items]]
+description = "Configure high availability and clustering"
+includes = ["fragments/installer/ha-section.toml"]
+name = "ha_group"
+title = "High Availability Configuration"
+type = "group"
+
+# POST-INSTALLATION CONFIGURATION
+# Admin user, workspace config, extensions, API setup, verification, cleanup
+[[items]]
+description = "Configure post-installation tasks and verification"
+includes = ["fragments/installer/post-install-section.toml"]
+name = "post_install_group"
+title = "Post-Installation Configuration"
+type = "group"
+
+# UPGRADES CONFIGURATION
+# Auto-upgrade, channels, strategies, pre-checks, backup, rollback, health monitoring
+[[items]]
+description = "Configure automatic updates and upgrade strategies"
+includes = ["fragments/installer/upgrades-section.toml"]
+name = "upgrades_group"
+title = "Upgrades Configuration"
+type = "group"

.typedialog/platform/forms/mcp-server-form.toml

@@ -0,0 +1,121 @@
+description = "Interactive configuration for MCP Server service (Model Context Protocol interface)"
+display_mode = "complete"
+fallback_locale = "en-US"
+name = "mcp_server_configuration"
+
+# ============================================================================
+# MCP SERVER SERVICE FORM - COMPOSED FROM FRAGMENTS
+# ============================================================================
+# This form uses fragment composition pattern for modular configuration
+# All fragments are located in ./fragments/ subdirectory
+# ============================================================================
+
+# DEPLOYMENT MODE SELECTION
+# Determines service resources and feature set (solo/multiuser/cicd/enterprise)
+[[items]]
+description = "Select deployment mode and database backend"
+includes = [
+  "fragments/deployment/mode-selection.toml",
+  "fragments/deployment/database-backend-selection.toml",
+]
+name = "deployment_mode_group"
+title = "Deployment Configuration"
+type = "group"
+
+# WORKSPACE CONFIGURATION
+# Workspace name, path, and context
+[[items]]
+description = "Configure workspace context for this MCP Server instance"
+includes = ["fragments/workspace-section.toml"]
+name = "workspace_group"
+title = "Workspace Settings"
+type = "group"
+
+# SERVER CONFIGURATION
+# HTTP server settings (host, port, workers, connections)
+[[items]]
+description = "Configure HTTP server for MCP Server"
+includes = ["fragments/server-section.toml"]
+name = "server_group"
+title = "Server Settings"
+type = "group"
+
+# DATABASE BACKEND CONFIGURATION
+# Conditional sections based on selected backend
+[[items]]
+condition = "database_backend_selection == 'rocksdb'"
+description = "Configure RocksDB backend for MCP state"
+includes = ["fragments/database-rocksdb-section.toml"]
+name = "database_rocksdb_group"
+title = "RocksDB Configuration"
+type = "group"
+
+[[items]]
+condition = "database_backend_selection == 'surrealdb_embedded' || database_backend_selection == 'surrealdb_server'"
+description = "Configure SurrealDB backend for MCP state"
+includes = ["fragments/database-surrealdb-section.toml"]
+name = "database_surrealdb_group"
+title = "SurrealDB Configuration"
+type = "group"
+
+[[items]]
+condition = "database_backend_selection == 'postgresql'"
+description = "Configure PostgreSQL backend for MCP state"
+includes = ["fragments/database-postgres-section.toml"]
+name = "database_postgres_group"
+title = "PostgreSQL Configuration"
+type = "group"
+
+# MCP-SPECIFIC: TOOLS CONFIGURATION
+# Tool management, validation, caching, concurrent execution
+[[items]]
+description = "Configure MCP tools, execution, and caching"
+includes = ["fragments/mcp-server/tools-section.toml"]
+name = "tools_group"
+title = "Tools Configuration"
+type = "group"
+
+# MCP-SPECIFIC: PROMPTS CONFIGURATION
+# Custom prompt templates, versioning, caching
+[[items]]
+description = "Configure custom prompt templates and management"
+includes = ["fragments/mcp-server/prompts-section.toml"]
+name = "prompts_group"
+title = "Prompts Configuration"
+type = "group"
+
+# MCP-SPECIFIC: RESOURCES CONFIGURATION
+# Resource management, max size, caching, validation
+[[items]]
+description = "Configure MCP resources and resource management"
+includes = ["fragments/mcp-server/resources-section.toml"]
+name = "resources_group"
+title = "Resources Configuration"
+type = "group"
+
+# MCP-SPECIFIC: SAMPLING CONFIGURATION
+# AI model sampling, temperature, output tokens, caching
+[[items]]
+description = "Configure AI model sampling and inference"
+includes = ["fragments/mcp-server/sampling-section.toml"]
+name = "sampling_group"
+title = "Sampling Configuration"
+type = "group"
+
+# MONITORING CONFIGURATION
+# Metrics collection, health checks
+[[items]]
+description = "Configure metrics and health checks"
+includes = ["fragments/monitoring-section.toml"]
+name = "monitoring_group"
+title = "Monitoring Configuration"
+type = "group"
+
+# LOGGING CONFIGURATION
+# Log levels, formats, rotation
+[[items]]
+description = "Configure logging behavior and output"
+includes = ["fragments/logging-section.toml"]
+name = "logging_group"
+title = "Logging Configuration"
+type = "group"