# HFS v2.1 draft deployment registry. This file records names and ownership

# only; real env values remain in the gitignored root .env, while the raw

# structured runtime configuration remains in local/credentials/.

standard = "2.1"

# Preserve the existing project/Space identity; this source lane creates no

# hfs-dist bucket and does not authorize a Space rename.

project = "SouWen"

space = "BlueSkyXN/SouWen"

project_class = "preview"

target_role = "primary"

sovereignty = "sovereign"

lane = "source"

version_source = "commit"

env_file = ".env"

secret_files = ["local/credentials/souwen-hfs.yaml"]

# SouWen keeps its candidate-pinned GitHub Actions transaction as the only

# remote settings writer. This registry does not authorize generic

# hf_space_sync.py push/pull/prune, Space rename, or bucket/mount creation.

operation_mode = "registry-only"

# Fail-closed sentinel for the current reference hf_space_sync.py: a source lane

# has no dist bucket, and its validator rejects an empty dist_bucket before

# reading .env or making any network/write call. This makes diff/push/pull

# executable failures instead of relying only on the registry-only comment.

dist_bucket = ""

# Local/GitHub control credentials must not be pushed under these names.

local_only = [

"GH_TOKEN",

"HF_TOKEN",

"HF_SPACE_READ_TOKEN",

"SOUWEN_SMOKE_BEARER_TOKEN",

]

# GitHub environment secrets such as HF_SPACE_READ_TOKEN and

# SOUWEN_SMOKE_BEARER_TOKEN are owned by the release workflow and are outside

# the Space-setting schema recorded by this manifest.

# The v2.1 draft records the real Space Secret names and requires their local

# values in .env. SOUWEN_CONFIG_B64 is derived from the registered raw YAML;

# Base64 is not the only fact source. Generic sync remains executable-disabled

# by the empty dist_bucket sentinel; only the candidate-pinned workflow may

# write these registered names.

secrets = [

"SOUWEN_ADMIN_PASSWORD",

"SOUWEN_CONFIG_B64",

"UNIAPI_API_KEY",

]

variables = []

# Space Secret values are write-only remotely. Only current key names are

# tracked. SOUWEN_USER_PASSWORD is not a current Space Secret key; the runtime

# config is delivered through SOUWEN_CONFIG_B64.

workflow_owned_secrets = [

"SOUWEN_ADMIN_PASSWORD",

"SOUWEN_CONFIG_B64",

"UNIAPI_API_KEY",

]

# SOUWEN_CONFIG_B64 also exists in the GitHub hf environment for release

# preflight. The shared key name does not authorize either side to overwrite the

# other outside the existing candidate-pinned workflow.

# The release workflow transaction writes this variable and verifies it by

# immediate readback during promotion; failed settings-aware promotions pause

# for operator-led recovery because prior Space Secret values are write-only.

workflow_owned_variables = ["SOUWEN_WRAPPER_SHA"]

# SouWen has no distribution seed or mounted runtime configuration. The HFS

# wrapper renders SOUWEN_CONFIG_B64 at startup and pins SOUWEN_REF to an exact

# 40-character commit in cloud/hfs/Dockerfile.

deviations = [

"generic-sync-disabled = Empty dist_bucket intentionally makes the current reference hf_space_sync validator reject diff, push, and pull before any remote operation",

"workflow-owned-settings = Existing candidate-pinned GitHub Actions own all Space Secret and Variable writes",

"workflow-generated-provenance = SOUWEN_WRAPPER_SHA is generated and read back by the deployment transaction, not supplied as local configuration input",

]