docs(rfc-002): rewrite config & CLI architecture + readiness review

Rewrite RFC-002 around a typed GraphLocator (storage: XOR server:+graph_id:),
servers:+graphs: with three-tier addressing, serve: vs servers: de-collision,
global-first layered config, a method x source auth model, and an
omnigraph-config crate extraction. Verified against code, not ticket status.

Incorporates the implementation-readiness review (10 points):
 1. current flag is --target, not --graph; --graph canonical + --target alias
 2. credential-redirection fix: endpoint-bound creds + layer identity rule + AX threat model
 3. no-arg resolution: defaults.graph for bare commands; defaults.server only namespaces unknown ids
 4. route unification spec: canonical single-mode graph_id; GET /graphs lists served set
 5. serve.graphs replaces server.graph (preserves serve-a-subset)
 6. restore query.roots (ad-hoc --query path resolution)
 7. soften 'structurally unreachable'; move mTLS key off the repo tree
 8. legacy bearer_token_env -> synthesized-server migration
 9. enumeration caveat: known-id addressing vs graph_list-gated discovery
10. mark oauth/mtls reserved; full impl deferred to V6

Also realigns the docs/dev/index.md entry.
This commit is contained in:
Ragnor Comerford 2026-06-02 13:12:06 +02:00
parent 3c2b1b8051
commit 3a53fb3c94
No known key found for this signature in database
2 changed files with 396 additions and 401 deletions

View file

@ -59,7 +59,7 @@ Working documents for in-flight feature work. Removed when the work lands.
|---|---|
| Schema-lint chassis v1 (MR-694) — `--allow-data-loss`, soft/hard drops | [schema-lint-v1-plan.md](schema-lint-v1-plan.md) |
| Inline + stored queries, request/response envelope, MCP (MR-656 / MR-976 / MR-969) | [rfc-001-queries-envelope-mcp.md](rfc-001-queries-envelope-mcp.md) |
| Config & CLI architecture — layered config, client targeting, file naming (MR-973 / MR-974 / MR-981) | [rfc-002-config-cli-architecture.md](rfc-002-config-cli-architecture.md) |
| Config & CLI architecture — global-first layered config, typed locators, multi-server targeting, auth model (MR-973 / MR-974 / MR-981) | [rfc-002-config-cli-architecture.md](rfc-002-config-cli-architecture.md) |
| MCP server surface — full tool parity, stored queries, modular auth (MR-969 / MR-956 / MR-974) | [rfc-003-mcp-server-surface.md](rfc-003-mcp-server-surface.md) |
## Boundary