# The layer this bundle contributes to a dsh profile that lists it.
#
# Two rows, and they are different halves of one idea:
#
#   facet-policy  — the HOST half. Owns the deployment's facet configuration
#                   (enforcement mode, standing extra roots) and the live
#                   per-session grants, and publishes them as `ctx.facetPolicy`.
#                   Mounted globally because the policy is a fact about this
#                   deployment, not about one agent.
#
# The PRESET half lives in ./presets/facet.patch.yml: it mounts the `facet`
# agent preset, which is where enforcement actually happens — a guard mounted
# inside a preset sees only that preset's agents.
#
# Configuration belongs here, in the profile's own patch layer, because that is
# the layer where this machine's facts are known:
#
#   - id: facet-policy
#     name: dsh-facet
#     config:
#       mode: ask
#       extraRoots:
#         - /srv/my-project/src/shared

- insert:
    - id: facet-policy
      name: dsh-facet
      config:
        mode: ask