chore: automated sync of local changes

Author: hyperpolymath

Justfile

@@ -6,10 +6,15 @@ default:
 
 # Deploy Twingate connector with specified environment
 deploy ENV="production":
+    #!/usr/bin/env bash
+    set -euo pipefail
+    values_file="$$(mktemp)"
+    trap 'rm -f "$$values_file"' EXIT
+    nickel export --format yaml "configs/{{ENV}}.ncl" > "$$values_file"
     helm upgrade --install twingate-connector ./charts/twingate-connector \
         --namespace twingate-system --create-namespace \
-        --values configs/{{ENV}}.ncl
-    @echo "✓ Deployment complete"
+        --values "$$values_file"
+    echo "✓ Deployment complete"
 
 # Remove Twingate deployment
 undeploy:
@@ -46,6 +51,11 @@ health-check:
 # Validate Helm chart
 validate:
     helm lint charts/twingate-connector
+    nickel typecheck configs/schema.ncl
+    nickel typecheck configs/base.ncl
+    nickel typecheck configs/staging.ncl
+    nickel typecheck configs/production.ncl
+    nickel export --format yaml configs/production.ncl > /dev/null
     @echo "✓ Chart validation passed"
 
 # Clean up resources

configs/production.ncl

@@ -1,6 +1,14 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
 let base = import "./base.ncl" in
-base & {
-  connector.logLevel = "warn",
-  kubernetes.replicaCount = 3,
+{
+  network = base.network,
+  connector = {
+    logLevel = "warn",
+    analyticsEnabled = base.connector.analyticsEnabled,
+  },
+  kubernetes = {
+    namespace = base.kubernetes.namespace,
+    replicaCount = 3,
+  },
+  resources = base.resources,
 }

configs/schema.ncl

@@ -0,0 +1,23 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Declarative schema/defaults for Helm values exported from Nickel.
+{
+  network | String = "your-network-name",
+  connector = {
+    logLevel | String = "info",
+    analyticsEnabled | Bool = true,
+  },
+  kubernetes = {
+    namespace | String = "twingate-system",
+    replicaCount | Number = 2,
+  },
+  resources = {
+    requests = {
+      memory | String = "128Mi",
+      cpu | String = "100m",
+    },
+    limits = {
+      memory | String = "256Mi",
+      cpu | String = "500m",
+    },
+  },
+}

configs/staging.ncl

@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+let base = import "./base.ncl" in
+{
+  network = base.network,
+  connector = {
+    logLevel = "info",
+    analyticsEnabled = base.connector.analyticsEnabled,
+  },
+  kubernetes = {
+    namespace = base.kubernetes.namespace,
+    replicaCount = 1,
+  },
+  resources = base.resources,
+}

contractiles/k9/must-check.k9.ncl

@@ -0,0 +1,49 @@
+K9!
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Repo-local K9 validator required by .machine_readable/MUST.contractile.
+# This file remains data-only and can be consumed by K9 tooling.
+
+{
+  pedigree = {
+    schema_version = "1.0.0",
+    component_type = "must-validator",
+    security = {
+      leash = 'Kennel,
+      trust_level = "data-only",
+      allow_network = false,
+      allow_filesystem_write = false,
+      allow_subprocess = false,
+    },
+    metadata = {
+      name = "must-check",
+      version = "1.0.0",
+      description = "Machine-readable checks for baseline policy and CI contract files.",
+    },
+  },
+
+  validator = {
+    id = "must-check",
+    checks = [
+      {
+        name = "mustfile_present",
+        kind = "path-exists",
+        path = "contractiles/must/Mustfile",
+      },
+      {
+        name = "policy_present",
+        kind = "path-exists",
+        path = "policy/policy.ncl",
+      },
+      {
+        name = "workflow_dir_present",
+        kind = "path-exists",
+        path = ".github/workflows",
+      },
+    ],
+  },
+
+  guidance = [
+    "Run nickel typecheck policy/policy.ncl",
+    "Run repository CI validation before merge",
+  ],
+}

contractiles/must/Mustfile

@@ -20,7 +20,7 @@ checks:
 
   - name: policy-compiles
     description: "policy/policy.ncl must compile."
-    run: "nickel check policy/policy.ncl"
+    run: "nickel typecheck policy/policy.ncl"
 
   - name: gateway-exposes-port
     description: "Service must expose the configured port."

policy/policy.ncl

@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Baseline policy contract consumed by contractiles/must/Mustfile.
+{
+  policy = {
+    version = "1.0.0",
+    enforcement = {
+      require_spdx_headers = true,
+      require_ci_security_checks = true,
+      block_committed_secrets = true,
+      require_pinned_actions = true,
+    },
+    triage = {
+      auto_fix_min_confidence = 0.95,
+      review_min_confidence = 0.85,
+    },
+  },
+}