Configuration¶

Nerthus.Core (until cutover). This page describes the frozen system that runs today and is deleted at cutover. Replaced by: Configure a Platform instance.

Everything that tunes a Nerthus deployment without a recompile lives under .nerthus/ at the repo root. There are three kinds of knob: the daemon config (config.json — read once at boot), the Rada-editable data tables (data-tables/ — read on each use), and the tunable PU constants (the pu block of config.json). The client never reads any of them — it asks the daemon, whose public schema route serves the effective table contents. This page is the lookup contract for file locations, shapes, defaults, and precedence; what each table means is owned by its domain page and linked from here.

Committed vs. private¶

The full .nerthus/ layout is owned by Architecture. Nerthus never hardcodes a secret into a tracked file. Discord delivery resolves channels by name (@discord tags in the contributor store), so the committed lore holds only channel names — lore, not secrets; the bot token delivery now needs is a host-local secret, never committed. The tradeoff is recorded under Secrets.

.nerthus/config.json¶

One committed JSON object, merged key-by-key over the daemon defaults — an omitted key falls back; an unknown key is merged but nothing reads it. A fresh scaffold writes the seed block rather than an empty object; every other key below is added by hand when the Rada changes a policy, so the file stays diff-friendly. Canonical shape (the values shown are the built-in defaults):

{
  "server": { "bind": "127.0.0.1", "port": 0, "read_only": false,
              "sync_max_age_min": 60, "sync_branch": "",
              "gc_interval_min": 60, "reader_threads": 0, "search_index": "",
              "selfheal_interval_ms": 5000,
              "mention_index_interval_min": 15, "event_journal": true },
  "corpora": { "mc": "", "dziel": "", "adnotacje": "", "probki": "", "logi": "", "lang": "" },
  "content_gate": { "sniff_chars": 400, "binary_share": 0.2 },
  "scrape": { "pdf_confidence_floor": 0.5, "max_payload_bytes": 20971520 },
  "schedules": { "close_reminder": { "owner": "off" },
                 "map_checkup": { "owner": "fleet" },
                 "settlement": { "owner": "ci" },
                 "alias_autopilot": { "owner": "fleet" } },
  "alias_autopilot": { "interval_minutes": 30, "max_per_tick": 20 },
  "lineage_autopilot": { "interval_minutes": 60, "max_per_tick": 10, "auto_merge": true,
                         "lore_projects": ["margonem/nerthus/it/repozytorium-fabularne-prodkopia"] },
  "integrations": {
    "discord": { "enabled": true, "rate_per_minute": 30, "jwks_url": "https://discord.com/api/oauth2/keys",
                 "client_id": "", "issuer": "https://discord.com", "jwks_cache_ttl_min": 1440,
                 "guild_id": "", "api_base": "https://discord.com/api/v10", "channel_cache_ttl_min": 60,
                 "close_reminder": { "first_reminder_delay_hours": 0, "interval_hours": 24, "cooldown_hours": 48 },
                 "converge_announce": { "enabled": true, "channel": "szary-monitoring", "category": "IT", "max_authors": 5 },
                 "dispatch": { "window_ms": 5000, "near_deadline_ms": 3000, "skew_alert_ms": 2000,
                               "max_attempts": 3, "max_per_tick": 1, "tick_budget_ms": 2000 } },
    "lang": { "frames_config": "" },
    "logs": {
      "hosts": ["krisaphalon.ct8.pl", "pastebin.com", "docs.google.com", "drive.google.com", "imgur.com", "wklejamy.pl", "ntpd.eu"],
      "fetch_timeout_ms": 15000,
      "failed_ttl_hours": 24,
      "failed_max_attempts": 5
    },
    "margonem": {
      "profile_url": "https://www.margonem.pl/profile/view,",
      "validate_url": "https://public-api.margonem.pl/account/validate",
      "signing_key_url": "https://staticinfo.margonem.pl/.well-known/signing-key.pem",
      "signing_key_cache_ttl_s": 86400,
      "auth_timestamp_skew_s": 300,
      "session_ttl_s": 14400,
      "map_checkup": {
        "interval_hours": 24,
        "request_delay_ms": 100, "timeout_ms": 10000, "max_probe_steps": 5,
        "failure_budget": 20, "batch_size": 300, "tick_budget_ms": 4000,
        "retry_cooldown_ms": 30000,
        "hosts": ["micc.garmory-cdn.cloud"]
      }
    }
  },
  "sessions": { "staged": false },
  "normalization": { "narrator_near_form_score": 0.85 },
  "fleet": { "auto_failover": { "after_sweeps": 3, "cooldown_hours": 24 } },
  "pu": {
    "monthly_base": 1.0, "monthly_cap": 5.0,
    "election_window_months": 6, "election_threshold": 3.0,
    "new_character": { "divisor": 2.0, "bonus": 20.0, "floor": 20.0 }
  }
}

The seeded starter¶

A scaffold with no config.json gets one holding the schedules block and the close-reminder tunables at their defaults. Later boots add any seed block the file is missing and touch nothing else, so a clone made before a knob existed still shows it. Both writes are subject to the write gate, which keeps a replica from handing the publish tick repo dirt to sweep up.

The seed is a subset on purpose. Writing the whole default table into a committed file would pin every default at scaffold time, and the pinned copy would shadow later module defaults for the life of the repo.

A handful of keys the daemon reads have no entry in the default table at all, so the shape above does not show them. Their fallback lives in the consumer that reads them rather than in the merge, and each row below marks them outside the default table.

schedules¶

One owner per recurring workload. The close reminder and the map checkup each exist twice — as the primary's in-daemon tick and as a GitLab schedule — and nothing coordinates the two at run time: the reminder's cooldown ledger is machine-local and the CI pass runs with noDedup, so two live halves mean two nudges per open session. This block is what makes that impossible.

A value outside a workload's allowed set falls back to its default and warns on stderr. The daemon reads the owner per tick, so handing a workload over is one commit: every host picks it up on its next sync, with nothing to restart and no window where both sides fire. A CI job whose workload it does not own exits 0 with skipped: owner=… in its log, since a daily red pipeline teaches people to ignore pipelines.

Ownership does not decide where a job runs — that is the runner tag, Set up a runner.

server¶

selfheal_interval_ms bounds a stat pass over every session-bearing file — a thousand of them on the production corpus. At 0 that pass runs ahead of every answer, which caps the loop however many reader threads sit behind it; at the default an edit made outside the daemon is visible within five seconds instead of on the very next request. Nothing the daemon writes waits for it: every write rebuilds the model directly, and so does a converge.

reader_threads is worth raising on a host that serves the dashboard, together with the interval. Measured on a 3282-session corpus with eight clients, four readers answer 87 requests a second at a median of 8 ms against 70 and 39 ms single-threaded. What it buys is isolation rather than throughput — reads stop queueing behind a settle run, a mass fetch, or a rebuild. Which routes are poolable, and which a replica may answer at all, are owned by the API reference.

The two sync_* keys tune the in-daemon git sync but can never enable it — enablement is host-local (local/sync.json or a bound boot parameter; see Precedence), so both keys are inert on every non-syncing clone. The sync subsystem itself is owned by Sync.

When the daemon is published behind a Cloudflare Tunnel, the container pins port to 8787 so the edge ingress has a stable loopback target. bind still stays loopback: cloudflared shares the daemon's network namespace and reaches 127.0.0.1:8787, so nothing binds a public interface (Publish the API).

corpora¶

Empty means the corpus is absent on this host, and absent is a supported state rather than a boot failure: the roster reads as empty and every moderation surface says so, the external tier holds nothing and says so — present and unreachable, rather than a host that refuses to boot. Each path is configured rather than derived from the lore root because each repository's merge rights are deliberately separate from the lore repo's, which is the reason it is a repository of its own.

The two youngest keys carry a legacy fallback the older three do not: corpora.logi and corpora.lang empty do not mean the corpus is gone — the daemon falls back to the nerthus.logs/ and nerthus.lang/ inside the lore checkout, where both trees lived until the August 2026 repository splits. An un-migrated host therefore keeps serving the archive and the annotations it already has with zero configuration, and a post-split lore clone simply has nothing at the legacy path, which is the same supported absence as everywhere else. Unsetting either key is also the rollback for the corresponding split (Splitting out the transcript archive, Splitting out the annotation tree).

How many of the five a given host sets is a fleet's decision rather than a property of the daemon. Measured 2026-08-23 on the dev fleet — torneg, karka-han and eder, all three identical: local/corpora.json carries three of the five keys, mc, logi and lang. The lore checkout is not among them and never is — it is /repo itself — so the same fleet is three sibling corpora on this page's denominator and four served trees on Fleet's. corpora.dziel and corpora.adnotacje are unset on every host, so GET /training/samples answers available: false, reason: NoStoreConfigured there and the external tier holds nothing. Both volumes exist and mount empty, which is a state the fleet chose (fleet.settings.yml).

content_gate¶

The gate runs at the fetch, where the content type is in hand exactly once, and refuses a payload that is not a transcript into a .failed marker instead of an archive slot (Logs & audit). Both numbers are measured rather than chosen. Over all 1 174 raw copies in the development archive, one binary payload reads 43.9% replacement characters, the worst real transcript reads 2.7% — a Windows-1250 paste decoded as UTF-8, every Polish letter mojibake and every word still legible — and the next one after that reads 0.01%. A gate at 20% sits in the middle of a sixteenfold gap; a tighter one is not safer, because it deletes that session.

Both keys serve three callers, not one. The gate takes the caller's expectation as a parameter — a transcript, a page, or a binary artifact — so a works-repository fetch (Fetch a source) asks the same four checks a different question rather than carrying a second gate. The numbers are shared because the sniff window and the binary threshold do not depend on what was asked for.

scrape¶

Both belong to the works-repository fetch and to nothing else; a host that never runs one ignores them. The floor exists because a scanned PDF is a document with no readable text, and a sidecar made from it would be an empty work standing where a real one should be — so it is recorded and refused, with its original kept. The separation measured so far is total rather than marginal: a text PDF from the producer the corpus's own PDFs come from scores 1.0, an image-only page scores 0.0, and nothing between the two has been seen. 0.5 is the middle of that gap. There is deliberately no page equivalent. A web page extracted imperfectly still carries its text, so its number is written into the sidecar and never used to refuse it — the operator ruling is that quality problems are recorded, not repaired by guessing.

integrations.lang¶

This is the key GET /model/evaluation refuses by name. Without a readable copy the answer is "no frames-config.json is readable on this host: set integrations.lang.frames_config, or drop a copy at <model root>/frames-config.json. Without it this daemon cannot say what the engage gate would compare" — a refusal that names a config key which, until now, appeared on no page of this site. Either arm satisfies it: the config key, or the file at the model root beside the artifacts (The model artifact).

The gate's own numbers carry their provenance inside the file — a measured block with its date, unit, method, population and gain — and Governance proposals explains how to read them. Nothing on this host recomputes them, so a stale copy reports a stale gate silently; the file's date is the only thing that says how old the answer is.

No logging block¶

There is no logging config block. The three JSONL stream names under .nerthus/log/ — operational, request, audit — are fixed in code, the streams are append-only with no rotation, and request bodies are never logged (see Logs). Earlier drafts declared level, retention_days, and request_body keys; they were dropped as unenforced promises — a future consumer reintroduces its key together with the code that reads it.

integrations.discord¶

The first four keys carry Discord sign-in, whose flow is owned by Permissions. client_id is the switch: Discord signs every registered application's tokens from one JWKS, so the audience is what binds a token to this deployment, and a host that has not set it accepts none. A kid the cached document does not carry drives exactly one refetch, so a rotation lands before the TTL does. A jwks key holding a key document short-circuits the fetch; only the test suite sets it.

Delivery detail lives in Logs. Per-person channels never live in config — they are @discord tags (kanał, kategoria[, cel]) on the ## Osoby blocks of the committed contributor store; the bot token is host-local (see Secrets), never in config.

The converge_announce sub-block is the other direction: not a message this host sends about a person, but a message it sends about itself. Each time a sync tick fast-forwards one of the repositories this host holds onto a commit it did not already have, the bot posts one plain-content line to the tech channel naming the host, the repository, the short sha, and the people who wrote the commits it took up. It covers the lore checkout and every corpus in corpora alike.

One message per host, not one per fleet. GitLab already says that main moved; what nothing could say is that a particular host — with its own interval, its own network and its own volume — is now serving those bytes. Six hosts converging is six lines, and a host that stays quiet while its peers announce is the point of the design rather than a cost of it.

The author names and addresses are the commits' author fields (%an / %ae) read with --no-merges. The lore repository lands every change as a merge commit, so the tip's author is whoever pressed merge; a message built off the tip would name that person for every announce the fleet ever makes.

Only the primary delivers today: the fleet agent renders the bot token for that role alone, so a replica records a SKIP with reason no_token instead of posting.

Only a tick that fast-forwarded announces. A tick that pushed is a host reporting its own write, a tick that found nothing has no news, and a sha already announced on this host is silent — the last announced sha per repository is kept in runtime/announce/<corpus>.json.

The close_reminder sub-block tunes the reminder; who runs it is schedules instead.

The reminder is owned by the session model.

The dispatch sub-block tunes the ingest Worker's daemon-first path (Discord API). window_ms (default 5000) is the receipt-relative acceptance window and must stay 1500 ms under the Worker's DAEMON_DISPATCH_TIMEOUT_MS, so an accepted dispatch is one the edge still waits on; near_deadline_ms (3000) additionally bounds a report, which two enactments would turn into two merge requests; skew_alert_ms (2000) is the clock-skew warning threshold; max_attempts (3) bounds retries of one queued interaction; max_per_tick (1) and tick_budget_ms (2000) bound how long one drain may hold the single serve thread away from /health. An out-of-range value falls back to the default rather than refusing the boot.

integrations.logs¶

A .failed marker records the consecutive attempt count and the last error. Attempts one to three wait failed_ttl_hours; every attempt past the third doubles the wait, to a ceiling of eight times the TTL. On the default the curve runs 24, 24, 24, 48, 96, 192 hours and holds at 192. Once the same error has come back failed_max_attempts times running, the marker's state reads PermanentlyFailed and automatic retries stop for that URL. Only an explicit refresh (-RetryFailed or -Force on a fetch) picks it up again. A different error restarts the identical-failure run and the URL stays in the automatic rotation; the attempt count behind the wait keeps climbing, so the interval never drops back to the base TTL.

The fetch and parse pipeline is owned by Logs.

integrations.margonem¶

Endpoints and TTLs for the Margonem auth flow, whose mechanics are owned by Permissions.

integrations.margonem.map_checkup¶

The CDN version sweep over Mapa @url values — Locations owns its contract, the schedules Sync and Set up pipelines.

Behavior notes: a 404 is the normal "no update" answer and never counts against the budget; scattered throttle hits only flag their maps. batch_size and tick_budget_ms both end a chunk, whichever is hit first. The budget is read between maps and before each probe step. A tick therefore holds the single dispatch thread for at most tick_budget_ms plus the one probe already in flight: its request_delay_ms pause and its timeout_ms ceiling. A retry cool-down on a tick is clamped to what the budget has left, and once nothing is left the network error stands and the map lands in failed for the next sweep to re-probe. The explicit route runs unbounded and takes the cool-down whole; it is sized to ride out the CDN's sliding rate-limit window. A Mapa @url on a host outside hosts is skipped, mirroring the log-fetch SSRF rule; an explicitly empty list probes nothing (only a missing key falls back to the default host). Probes never follow redirects: a redirecting CDN front reads as errors that spend the budget, never as freshly published versions.

sessions¶

Staged sessions and the landing transaction (session model). Only staged appears in the default table; every key beneath it resolves in its own consumer, so a sessions block holding just staged is complete rather than truncated.

gate.taxonomy is an object mapping a finding kind to refuse (a hard 4xx) or escalate (an auto-merge-request to the Rada), so the Rada tunes close-time noise one kind at a time. Any other value, and any kind not listed here, resolves to escalate.

{ "sessions": { "gate": { "taxonomy": { "name-miss": "refuse", "integrity": "refuse" } } } }

The gate's checks and what a refuse and an escalate each do to the close are owned by the session model, which also owns the nag the staging_nag keys pace.

fleet.auto_failover¶

Both the health worker's automatic flip and a daemon's mesh-requested takeover read these two thresholds. Fleet owns the flip, Run a failover the procedure.

The daemon resolves both at boot, so a retune lands on the next restart. The environment is read first: NERTHUS_AUTO_FAILOVER_AFTER_SWEEPS and NERTHUS_AUTO_FAILOVER_COOLDOWN_HOURS, which the fleet agent renders from the host descriptor. An unset or empty variable falls through to the committed config.json, and an absent key there to the built-in default. Whichever tier supplies the value, a non-numeric or non-positive one resolves to the default — a truncated config cannot disarm the guard by omission.

Tunable PU constants (pu block)¶

Rada policy for the monthly PU batch and election eligibility; the full algorithm is owned by PU model.

The normalization worklist (normalization block)¶

The score is the resolver's fuzzy reading, 1.0 - edit_distance / query_length, and the key is a floor on it: below the value the bliska-forma sieve stays quiet and the signature gets the plain "reaches no block" row instead (the worklist). It is a judgement about a corpus rather than a constant, which is why it is here — at 0.85 on the campaign corpus the sieve keeps five one-keystroke misspellings and refuses Rote against Velrose, which are two different people. Lowering it to 0.80 admits a sixth that nobody has ruled on; raising it to 0.90 removes the sieve's whole population.

The default lives in the module's built-in table and this block overrides it, exactly as the pu block does. The measurement behind the number — what each candidate scored, and what moving the floor would cost — is recorded in the project directory that set it, which nothing reads at runtime.

Rada data tables (.nerthus/data-tables/)¶

Three committed lore tables the Rada edits directly: currency.json (denominations), roles.json (role → capability bundles), and towns.json (reputation settlements). The seeded shapes, row semantics, and the shared lifecycle rules (read on use, seed only when absent, fallback to baked-in defaults) are in Data tables.

The public schema route serves the effective contents — statuses, tags, entity types, denominations, towns, role names, and the capability catalog derived from the route table and role bundles. The PU constants and the full role bundles stay off that route.

Precedence¶

Three tiers, highest wins — deliberately flat:

explicit request parameter  >  committed config.json / data-tables  >  daemon defaults

1. Request parameter — a value passed on the call overrides the file for that operation: Set-NerthusMode -ReadOnly flips the running daemon without touching server.read_only; the daemon boot script's -Port beats server.port, its -Staged beats sessions.staged, and its -ReaderThreads beats every lower tier for one boot. Runtime overrides are never written back to config.json.
2. Committed config — config.json and data-tables/ as checked in.
3. Daemon defaults — the built-in values shown above, used for any omitted key. A fresh scaffold writes config.json only when absent, carrying the seed block.

schedules takes the normal three tiers: it is committed, unlike git-sync enablement, because both the fleet daemon and an ephemeral CI clone have to read the same answer out of the same artefact.

server.reader_threads takes a fourth source between the first two tiers, because a thread count describes the machine rather than the lore: a bound -ReaderThreads wins, then the gitignored local/server.json, then the committed key, then 0. The committed key still participates, unlike sync enablement — a thread count every clone shares is a poor default, not a broken deployment.

fleet.auto_failover reads the environment above the committed file: the two NERTHUS_AUTO_FAILOVER_* variables the fleet agent renders per host (above). There is no user-profile tier, and host-specific secrets stay outside the committed files, resolved by reference, not by precedence.

Secrets, runtime & host-local files¶

Secrets never live in tracked files. Discord delivery keeps its secret out of git: the bot resolves channels by name (@discord on the committed contributor store; Logs owns resolution and delivery), so the only committed Discord data is channel names — lore, not secrets. The bot token is a new out-of-band secret a per-channel webhook never needed, and it is broader — one token can post to every channel the bot can see, where a webhook reached exactly one channel. That is a deliberate scope tradeoff: a single host-local secret buys operator simplicity and a read-privacy win — the bot holds only View Channel + Send Messages (no Read Message History, no Message Content intent), so players' channels are written, never read. The token lives host-local (.nerthus/local/discord.json), or in the CI vars DISCORD_BOT_TOKEN (masked) + DISCORD_GUILD_ID, never in config.json. Everything else sits in the gitignored .nerthus/runtime/ (machine-managed) and .nerthus/local/ (operator-managed):

local/sync.json is not a secret but is deliberately un-committed. Its shape: { "intervalMinutes": 5, "publishMode": "push" } — every boot path reads it, the client auto-spawn included, and the daemon is a syncing instance exactly when the resolved interval is at least 1. publishMode is push (the primary writes onto the default branch), mr (the primary publishes reviewed merge requests instead), or none (a converge-only replica). On a fleet host the container entrypoint renders this file rather than an operator: the role settles none, and NERTHUS_SYNC_PUBLISH_MODE chooses between push and mr for a primary. Enablement can never travel through the committed config.json: a committed interval would turn every clone of the repo — every home and CI daemon — into a syncing instance whose writes freeze behind failing fetches. Behavior is owned by Sync; the setup procedure by Bootstrap a fleet host.

The Margonem signing key cached at cache/signing-key.pem is a public verification key, not a secret — it lives under gitignored cache/ only because it is refetchable machine state. A missing channel (@discord: BRAK, or no tag) disables the affected delivery with a SKIP recorded in the delivery log, never a daemon crash.

Container environment (fleet hosts)¶

A fleet host runs the daemon in a container, and the entrypoint renders the host-local config files — local/sync.json, local/server.json, and local/corpora.json — from environment variables rather than from a hand-edited config.json. The compose stack sets the variables below from the host's rendered descriptor (Fleet, Bootstrap a fleet host):

Four more reach the daemon without the descriptor supplying them. Each falls back to a working value, which is why a rendered .env names none of them:

Five further variables carry the fleet mesh's credential and its actuation coordinates, and nothing in the fleet provisioning renders any of them: neither the converge agent's .env nor the compose environment block names one, so a host holds them only where somebody set them on that host by hand.

POST /fleet/takeover answers 503 unless NERTHUS_GL_FLEET_TOKEN and NERTHUS_FLEET_PROJECT_PATH are both set. A fleet missing the credential degrades visibly rather than proposing flips it cannot land. The peer token's own set stops at reading and announcing: requesting a takeover needs fleet.takeover, which that record deliberately omits (Capabilities).

Beyond these, the daemon reads only DISCORD_BOT_TOKEN, DISCORD_GUILD_ID and NERTHUS_GITLAB_TOKEN, and the compose stack sets none of them. A fleet primary takes its token from local/discord.json inside the lore volume instead; a replica boots -NoDiscord and needs none.

The container relies on .NET's default in-container heap limit — 75% of the cgroup cap — and the idle tick runs a periodic garbage collection because pwsh on Linux does not return idle memory on its own; restart: unless-stopped is the backstop. Do not set DOTNET_GCHeapHardLimitPercent: its value is parsed as hexadecimal, so 75 would not mean 75 percent.

Test-runner gates¶

The comprehensive and live-drill suites are opt-in through environment variables, not config. They are test-runner gates, never product runtime config, and a CI run leaves them unset so the suites no-op. The suite map, and the one other env-gated suite — the adoption rehearsal behind NERTHUS_REHEARSAL_REPO, with the rule never to point it at a checkout you care about — are in Run and write tests. The gates below are documented here:

Each takes knobs beside its gate. The burn-in reads NERTHUS_BURNIN_IMAGE (default nerthus-core:burnin), NERTHUS_BURNIN_ENTITIES (4000) and NERTHUS_BURNIN_ROUNDS (25); the WSL2 drill reads NERTHUS_WSL2_PHASE (arm, then verify), NERTHUS_WSL2_HEALTH_URL and NERTHUS_WSL2_STATE for the snapshot it carries between phases.

Two more shape what the burn-in measures rather than whether it runs. NERTHUS_BURNIN_ARCHIVE points at a throwaway lore checkout used as the repo; without it the fixture carries no nerthus.entities.md, so the memory gates report inconclusive rather than passing on two entities. NERTHUS_BURNIN_SEARCH (default off) is the tier the burned-in host builds an index for, and NERTHUS_BURNIN_READERS (2) its reader-thread count.

The two knobs that move the burn-in's own pass condition¶

NERTHUS_BURNIN_MEMORY_MB sets the container limit the peak is measured against, and NERTHUS_BURNIN_HEADROOM sets the ratio it must stay under — the denominator and the threshold of the gate's own arithmetic. Raising either buys a pass. The peak grows more slowly than the limit does, so the ratio falls at every step and passes for good somewhere above 3 GiB while absolute demand keeps climbing; moving the threshold does the same thing at the committed limit, where nothing else in the output would say so. Only a run at the committed limit and the committed threshold is evidence about the fleet.

So a run that moves either must set NERTHUS_BURNIN_EXPLORATORY=1, or the suite throws and names the knob that was moved. With the acknowledgement set, the two memory gates report inconclusive with the knob named and the measurement card still prints — the number is the point of such a run. That distinction has to be explicit because Pester reports Result=Passed and exit 0 for a run whose every gate was inconclusive, so to CI, and to anything typing &&, an exploration and a licensing run are otherwise the same status.

NERTHUS_EVAL_REPO, NERTHUS_EVAL_CORPUS and NERTHUS_EVAL_REQUIRED gate the retrieval-eval suite the same way: the first two name the corpus, and the third turns a missing one from a skip into a failure.

schema.json pointer¶

.nerthus/schema.json ({ "version": "0.11.0" }) is a pointer-only file: the single index-format version the on-disk data satisfies. It is a separate file from config.json and unrelated to it. Two writers touch it, and the write gate reads it; the lifecycle is owned by Adoption.

Every boot scaffolds the file at { "version": "0.0.0" } when it is absent, so an unadopted clone holds a file reading 0.0.0 rather than no file at all. The one-pass import then stamps 0.11.0 over it. A SchemaTooOld refusal on a clone nobody has imported is therefore the scaffold's value, not a missing pointer.

Cmdlet surface¶

Configuration is read-mostly; there is no "set arbitrary config" route — the Rada edits files. The runtime-facing cmdlets are Start-Nerthus, Stop-Nerthus, Get-NerthusStatus, Get-NerthusSchemaVersion, Set-NerthusMode, and Initialize-NerthusRepo; routes, parameters, envelopes, and capabilities are in API. config.json is read once at daemon boot — apply an edit with Stop-Nerthus + respawn. The data-tables/*.json files are read on each use, so a table edit (a new denomination, a rebound role) takes effect on the next request with no restart.

See also¶

• Architecture — the .nerthus/ layout, data-owner contract.
• API — the cmdlet ⇄ route mapping, envelopes, capabilities, the write gate.
• Data tables — the seeded shapes of currency.json, roles.json, towns.json.
• Capabilities — the capability catalog the role bundles grant.
• PU model — how the tunable PU constants are applied.
• Currency model — the denomination table in use.
• Permissions — roles, capabilities, tokens.
• Logs model — log streams, game-log fetch, Discord delivery.
• Adoption — the schema.json lifecycle and the one-pass import.
• Sync — the git-sync subsystem the sync_* keys and local/sync.json configure.
• Fleet — the container environment and the roster the host env vars come from.