feat: wire conflow config validation pipeline

Author: hyperpolymath

.conflow.yaml

@@ -0,0 +1,26 @@
+# conflow pipeline - Nickel generation
+version: "1"
+name: "boj-server"
+
+stages:
+  - name: "generate"
+    description: "Generate configuration from Nickel"
+    tool:
+      type: nickel
+      command: export
+      file: configs/config.ncl
+      format: json
+    input: "configs/config.ncl"
+    output: generated/config.json
+
+  - name: "validate"
+    description: "Validate generated configuration"
+    tool:
+      type: cue
+      command: vet
+      schemas:
+        - schemas/config.cue
+    input:
+      from_stage: generate
+    depends_on:
+      - generate

alloyiser.toml

@@ -0,0 +1,29 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# alloyiser manifest for boj-server
+
+[project]
+name = "boj-server"
+
+[[specs]]
+name = "boj-rest-api"
+source = "/var/mnt/eclipse/repos/boj-server/openapi.yaml"
+format = "openapi"
+
+[[assertions]]
+name = "no-orphan-cartridges"
+check = "all c: Cartridge | some c.owner"
+scope = 5
+
+[[assertions]]
+name = "cartridge-invoke-requires-auth"
+check = "all i: Invocation | some i.auth_token"
+scope = 5
+
+[[assertions]]
+name = "no-duplicate-cartridge-ids"
+check = "all disj c1, c2: Cartridge | c1.id != c2.id"
+scope = 6
+
+[alloy]
+solver = "sat4j"
+max-scope = 6

configs/config.ncl

@@ -0,0 +1,11 @@
+# Configuration generation
+{
+  name = "my-app",
+  replicas =
+    let env = "dev" in
+    if env == "prod" then 5
+    else if env == "staging" then 3
+    else 1,
+  port = 8080,
+  env = "dev",
+}

generated/alloyiser/boj_server.als

@@ -0,0 +1,97 @@
+module boj_server
+
+// Formal model generated by alloyiser from project 'boj-server'.
+// Verify with: java -jar alloy.jar boj_server.als
+
+abstract sig Bool {}
+
+abstract sig Int {}
+
+abstract sig Object {}
+
+abstract sig String {}
+
+sig CartridgeInfo {
+    abi_version: lone String,
+    available: lone Bool,
+    backends: set String,
+    domain: lone String,
+    ffi_status: lone String,
+    name: lone String,
+    operations: set String,
+    protocols: set String,
+    status: lone String,
+    version: lone String
+}
+
+sig CartridgeSummary {
+    available: lone Bool,
+    domain: lone String,
+    name: lone String,
+    protocols: set String,
+    status: lone String,
+    version: lone String
+}
+
+sig GitHubRepo {
+    description: lone String,
+    full_name: lone String,
+    html_url: lone String,
+    id: lone Int,
+    language: lone String,
+    stargazers_count: lone Int,
+    updated_at: lone String
+}
+
+sig HealthResponse {
+    cartridges: lone Int,
+    components: lone String,
+    status: lone String,
+    uptime_seconds: lone Int,
+    version: lone String
+}
+
+sig InvokeRequest {
+    operation: lone String,
+    params: lone Object
+}
+
+sig InvokeResponse {
+    cartridge: lone String,
+    data: lone Object,
+    duration_ms: lone Int,
+    error: lone String,
+    operation: lone String,
+    success: lone Bool
+}
+
+sig MenuResponse {
+    summary: lone Int,
+    tier_ayo: set CartridgeSummary,
+    tier_shield: set CartridgeSummary,
+    tier_teranga: set CartridgeSummary
+}
+
+sig RateLimit {
+    limit: lone String,
+    remaining: lone String,
+    reset: lone String
+}
+
+assert no_orphan_cartridges {
+    all c: Cartridge | some c.owner
+}
+check no_orphan_cartridges for 5
+
+assert cartridge_invoke_requires_auth {
+    all i: Invocation | some i.auth_token
+}
+check cartridge_invoke_requires_auth for 5
+
+assert no_duplicate_cartridge_ids {
+    all disj c1, c2: Cartridge | c1.id != c2.id
+}
+check no_duplicate_cartridge_ids for 6
+
+// Visualise a sample instance
+run {} for 5

generated/alloyiser/run-analysis.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Generated by alloyiser — Alloy analysis script
+# Requires: java, alloy.jar
+
+ALLOY_JAR="alloy.jar"
+MODEL="/var/mnt/eclipse/repos/boj-server/generated/alloyiser/boj_server.als"
+SOLVER="sat4j"
+TIMEOUT="300"
+
+echo "=== alloyiser analysis ==="
+echo "Model: $MODEL"
+echo "Solver: $SOLVER"
+echo "Assertions: 3"
+
+echo "Checking: no_orphan_cartridges..."
+timeout "$TIMEOUT" java -jar "$ALLOY_JAR" -batch -solver "$SOLVER" "$MODEL" 2>&1 | grep -A5 "no_orphan_cartridges"
+echo ""
+
+echo "Checking: cartridge_invoke_requires_auth..."
+timeout "$TIMEOUT" java -jar "$ALLOY_JAR" -batch -solver "$SOLVER" "$MODEL" 2>&1 | grep -A5 "cartridge_invoke_requires_auth"
+echo ""
+
+echo "Checking: no_duplicate_cartridge_ids..."
+timeout "$TIMEOUT" java -jar "$ALLOY_JAR" -batch -solver "$SOLVER" "$MODEL" 2>&1 | grep -A5 "no_duplicate_cartridge_ids"
+echo ""
+
+echo "=== analysis complete ==="

schemas/config.cue

@@ -0,0 +1,9 @@
+// Configuration schema
+package config
+
+#Config: {
+    name:     string
+    replicas: int & >=1
+    port:     int & >=1 & <=65535
+    env:      string
+}

wokelangiser.toml

@@ -0,0 +1,26 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# wokelangiser manifest for boj-server
+
+[project]
+name = "boj-server"
+
+[consent]
+gdpr = true
+ccpa = true
+default-state = "opt-out"
+categories = ["functional", "analytics", "third-party"]
+
+[accessibility]
+wcag-level = "AA"
+check-contrast = true
+check-alt-text = true
+check-aria = true
+min-contrast-ratio = 4.5
+
+[i18n]
+default-locale = "en-GB"
+supported-locales = ["en-GB", "fr-FR", "de-DE"]
+extract-strings = true
+
+[report]
+format = "text"