# muninn-gate mounted config — REDACTED EXAMPLE (committed).
# The real file (with bearer-key secrets) lives on corviduo-dev at
# /opt/docker/conf/muninn-gate/muninn-gate.yaml and is gitignored.
#
# Schema is CLOSED: an unknown field (top-level or per-key) is a BOOT FAILURE,
# not a warning. Read once at boot; every validation failure aborts before the
# socket binds. Four top-level fields only.

# Absolute, existing directory, same volume as the personal muninn watcher.
# Byte-identical to the watcher's view: /data/state/ingestion in both containers.
ingestion_root: /data/state/ingestion

# Submit-path allowlist (non-empty; each absolute, existing, a directory).
# Canonicalized at boot. Ratified 2026-07-30. Real shared dir as of 2026-08-01
# (mimir-inbox — the writer — deployed on corviduo-dev:8091): 1000:1000 0755,
# writer rw / gate+watcher ro. Path-agreement probe PASS (muninn-dev, same
# inode+bytes across writer/gate/watcher; admission byte-identity preserving).
staging_roots:
  - /mnt/muninn-staging/mimir-inbox

# Bearer credentials. `name` = non-secret caller identity, recorded as
# `submitted_by`. Flat scopes (no hierarchy/inheritance): read | submit | control.
# Names AND key values must both be unique; a padded key fails boot.
keys:
  - name: mimir-inbox
    key: <64-hex-secret, provisioned by infra-ops>
    scopes: [read, submit, control]  # control added 2026-08-01 for mimir-dev cancel/retry
  - name: ops-curl
    key: <different 64-hex-secret>
    scopes: [read, submit, control]

# WG-internal address — observability only, NOT read by the app. Keep consistent
# with the launcher's --host/--port (the launcher is authoritative).
bind: 10.250.50.152:8090