init

cordis.patch.yml

@@ -0,0 +1,29 @@
+# The layer this bundle contributes to a dsh profile that lists it.
+#
+# Two rows, and they are different halves of one idea:
+#
+#   facet-policy  — the HOST half. Owns the deployment's facet configuration
+#                   (enforcement mode, standing extra roots) and the live
+#                   per-session grants, and publishes them as `ctx.facetPolicy`.
+#                   Mounted globally because the policy is a fact about this
+#                   deployment, not about one agent.
+#
+# The PRESET half lives in ./presets/facet.patch.yml: it mounts the `facet`
+# agent preset, which is where enforcement actually happens — a guard mounted
+# inside a preset sees only that preset's agents.
+#
+# Configuration belongs here, in the profile's own patch layer, because that is
+# the layer where this machine's facts are known:
+#
+#   - id: facet-policy
+#     name: dsh-facet
+#     config:
+#       mode: ask
+#       extraRoots:
+#         - /srv/my-project/src/shared
+
+- insert:
+    - id: facet-policy
+      name: dsh-facet
+      config:
+        mode: ask