jackin-config

Configuration schema, validation, migration, and workspace resolution for jackin❯. Owns the shape of config.toml / per-workspace config and turns it into resolved, validated structures the rest of the system consumes.

Merges the former config/ and workspace/ concerns into one crate to dissolve the config↔workspace mutual cycle that previously blocked clean crate extraction.

What this crate owns

The config and workspace schema (schema, app_config, mounts), sensitive-value handling (sensitive), and auth model (auth).
Resolution (resolve, planner) and persistence (persist, paths) of operator + workspace configuration.
Versioned migrations (migrations, versions) and validation (validation).
test_support builders for deterministic config fixtures.

Architecture tier and allowed dependencies

L0 domain (schema). Allowed workspace dependencies: jackin-core. No presentation, no infrastructure adapters, no observability — those live above.

Structure

Module	Owns	Tests
`lib.rs`	crate root, re-exports	—
`schema.rs`	config + workspace schema	—
`app_config.rs` · `app_config/`	app-config model	`tests.rs`
`mounts.rs` · `mounts/`	mounts schema	`tests.rs`
`auth.rs`	auth model	—
`sensitive.rs`	sensitive-value handling	—
`resolve.rs` · `resolve/`	resolution	`tests.rs`
`planner.rs`	planning	—
`persist.rs`	persistence	—
`paths.rs` · `paths/`	config paths	`tests.rs`
`migrations.rs` · `migrations/`	versioned migrations	`tests.rs`
`versions.rs`	version constants	—
`validation.rs`	validation	—
`editor.rs` · `editor/`	editor config	`tests.rs`
`test_support.rs`	deterministic config builders	—

Public API

Resolved config/workspace types and the resolution + migration entry points consumed by jackin-runtime, jackin-instance, jackin-isolation, and the CLI. Schema changes are versioned — see migrations and the workspace schema-versioning rules.

How to verify

cargo nextest run -p jackin-config
cargo clippy -p jackin-config --all-targets -- -D warnings