animus-config-yaml

A v0.6 Animus config_source plugin: the reference implementation that lets the Animus kernel stop owning YAML acquisition. It sources the workflow/agent config from a project's .animus/ YAML files and emits the canonical config model over the config_source plugin protocol (animus-config-protocol).

It is the YAML-reading twin of animus-config-postgres: where that plugin reads team config from Postgres, this one reads .animus/workflows.yaml + .animus/workflows/*.yaml, interpolates ${VAR} / ${secret.X}, and parses the documents into the kernel's WorkflowConfig (schema animus.workflow-config.v2).

What it does

On config/load (the one required method of the role) it:

1. Installs the repo-scope-aware keychain/device secret resolver (orchestrator_core::build_secret_store), so ${secret.X} and keychain-backed ${VAR} resolve exactly like the kernel does — the plugin host spawns plugins with a clean env, so this wiring is mandatory.
2. Calls orchestrator_config::compile_yaml_workflow_files(project_root) — the same public entry point the in-tree YAML path uses — to read, interpolate, and parse the .animus YAML into a WorkflowConfig.
3. Returns it as ConfigModel { schema, version, config } plus a CacheToken whose version is the newest mtime across the sourced YAML files and whose external_inputs is true when any source references ${...} or system_prompt_file: (the kernel then bypasses its disk cache for that load, matching today's sources_have_external_inputs behavior).

The kernel still owns the heavy compiler — pack-overlay merge, agent-runtime derivation, state-machine compilation, validation, and caching. This plugin's output is the parsed canonical base, exactly where the in-tree YAML parser hands off to merge_yaml_into_config today.

config/validate runs a source-side compile pre-check (preserving YAML file-locality in the error message); the kernel still runs the authoritative validator. config_watch is intentionally not advertised, so the host degrades to its interval / manual reload path with no behavioral regression.

config/write is intentionally unsupported: this is a read-only source. .animus/workflows.yaml and .animus/workflows/*.yaml are the hand-edit surface, so the plugin does not advertise the config_write capability — the kernel refuses to call config/write against it up front. As defense in depth, a config/write request received anyway is answered with a clean METHOD_NOT_SUPPORTED (-32001) error directing the caller to edit the YAML files directly; it never returns success and never panics.

Build

cargo build --release
cargo test --release
./target/release/animus-config-yaml --manifest

Status

Path-deped to the in-flight v0.6 worktree crates. Repin to the published launchapp-dev/animus-protocol tags (matching animus-config-protocol's release) once those crates ship. Until this plugin is published, the kernel's config_source RequiredRole stays inert and the in-tree YAML path remains the default acquisition.