Skip to content

Governed configuration-value edit

Status: implemented Era 8 capability, default disabled.

Capability contract

  • Capability ID: governed_configuration_value_edit
  • Operator outcome: inspect and change one named, allowlisted, non-secret env-style scalar without supplying a file path or raw replacement text.
  • Read-only operation: Oracle, inspect configuration <configuration-id>.
  • Mutation operation: Oracle, propose setting <configuration-id> to "<allowed-value>".
  • Target identity: ConfigurationTargetRegistry, populated only from LUNA_GOVERNED_CONFIGURATION_TARGETS.
  • Source of truth: one exact regular UTF-8 file under LUNA_GOVERNED_WORKSPACE, one exact key, and one allowed-value set.
  • Proposal type: existing immutable GovernedProposal file-patch record with configuration identity and representation references included in its hash.
  • Approval authority: Lich, bound to the exact proposal hash and scope.
  • Validation authority: canonical governed-action preflight plus current registry, representation, target, old-value, allowed-value, file-hash, executor, approval, expiry, and freshness checks.
  • Execution authority: existing bounded atomic text-replacement executor.
  • Evidence: durable Zeus before/after file evidence.
  • Receipt: existing durable governed-action execution and rollback receipts.
  • Rollback: exact content restoration after a separate Lich approval.
  • Restart behavior: configuration targets declare whether the affected service requires restart. The capability reports the requirement but never restarts a service.
  • Oracle commands: inspect, propose, queue, validate, apply, audit, and inspect again through the shared runtime.
  • Transport path: Discord, Terminal TUI, and Web TUI normalize into the same RuntimeKernel and GovernedActionService.
  • Rubick posture: implemented and wired when the registry and durable service are present; execution ready only when both dedicated gates, the target allowlist, workspace, and durable store are ready.
  • Meepo transitions: unchanged. The existing governed proposal transition matrix remains authoritative.
  • Persistence: proposal, Lich approval, Zeus evidence, receipt, rollback approval, and rollback receipt use the existing SQLite authorities.
  • Known limitations: env-style KEY=value scalars only; one exact key; no inline-comment semantics; no arbitrary path; no YAML, JSON, TOML, Compose, shell, service reload, or automatic restart.

Registry configuration

Mutation requires both existing file-patch enablement and the dedicated configuration gate:

LUNA_GOVERNED_FILE_PATCH_ENABLED=true
LUNA_GOVERNED_CONFIGURATION_EDIT_ENABLED=true
LUNA_GOVERNED_WORKSPACE=/data/governed_workspace

LUNA_GOVERNED_CONFIGURATION_TARGETS is a JSON list. Each entry contains:

{
  "configuration_id": "demo.mode",
  "component": "demo",
  "label": "Demo mode",
  "relative_path": "config/demo.conf",
  "key": "MODE",
  "allowed_values": ["safe", "strict"],
  "sensitive": false,
  "restart_required": true,
  "affected_service": "demo-service",
  "representation": "env_key_value_v1"
}

Configuration IDs and paths are never inferred from conversational context. Unknown, duplicate, missing, secret-like, unsupported, symlinked, traversing, oversized, non-UTF-8, or stale targets fail closed. A source containing secret-like keys cannot enter proposal persistence, preventing full sensitive configuration content from entering governed file evidence.

Operator workflow

Oracle, inspect configuration demo.mode.
Oracle, propose setting demo.mode to "strict".
Oracle, show my action queue.
Oracle, validate proposal <proposal-id>.
Approve proposal <proposal-id>.
Oracle, apply approved proposal <proposal-id>.
Oracle, audit proposal <proposal-id>.
Oracle, inspect configuration demo.mode.

Approval and apply are separate requests. Oracle only adapts explicit operator vocabulary to the existing governed lifecycle; it does not approve or execute independently. If restart is required, the result says so and reports that no automatic restart occurred.

Validation

Focused validation:

python -m pytest -q \
  tests/test_governed_configuration_edit.py \
  tests/test_governed_action_lifecycle.py \
  tests/test_oracle_governed_action_preflight.py \
  tests/test_oracle_governed_proposal_intake.py \
  tests/test_oracle_governed_apply.py \
  tests/test_oracle_governed_action_audit.py \
  tests/test_oracle_action_queue.py \
  tests/test_runtime_composition.py \
  tests/test_rubick_capability_registry.py \
  tests/test_meepo.py