How a namespace works

An Enclavr namespace has one authoritative assets document and a vault of supporting documents. The assets document declares hosts, placement, and feature flags. Runtime scalar values live in secrets.<namespace>; user declarations live in users.<namespace>. Optional service documents are read only when authoritative assets reference them.

The Go control plane validates the complete configuration, resolves only required protected values, and prepares ordered host actions. Shell adapters apply complete action inputs to the operating system. Host deployment selects exactly one record by the current hostname.

Web directory

When web_directory.enabled is true, the Caddy mask on the authoritative DNS host serves the namespace apex. The page includes enabled Forgejo, Malcolm, and Landscape interfaces, explicit web_directory.links, and browser-facing HTTPS site addresses from the selected Caddyfile. Exact URL duplicates collapse into one entry. An apex and its www alias share one bordered card.

The page is static and restricted by the namespace's existing private access policy. A status dot labels entries as configured, with no live availability claim. The public docs site is a separate container and requires an explicit public Caddy route.

Public content boundary

The documentation image copies only reviewed files from docs/public/. It does not contain namespace vault documents, generated Caddyfiles, .env, private sync snapshots, or the rest of the repository. Check each Markdown change for sensitive values before publishing.