[taitelee]

Closes #834.

A program that writes settings directories (a control plane, a provisioning tool, a GitOps generator) can now check a directory with the server's own rules, at the server's own version, before anything reaches disk.

• internal/{policy,pipes,tenant,chsql} move to pkg/, and the pure half of internal/settings (document types, Finding, Files, the validator, Validate/Tree, Seed and the embedded seed) moves to pkg/settings. The runtime half (Registry, Store, Watch, WriteSeed) stays in internal/settings.
• New settings.ValidateFiles(map[string][]byte) runs the whole pass over the four files' bytes. ValidateDir is that pass after the checks only a directory can fail (it exists, each file is a regular file, config.json's permission bits). In memory, names read as directory entries do: dot-prefixed skipped, any other stray name unexpected, an absent or nil file missing. wavehouse validate, boot and reload keep going through the one path.
• Every directory-content fixture in the validator tests runs both paths and asserts identical findings and documents. That exposed a pre-existing nondeterminism: four required-key checks iterated Go maps, so finding order varied between runs. They now walk slices in document order.
• Seed() round-trips through the public types (pinned by a test); Finding keeps the JSON shape POST /v1/ops/settings/reload returns.
• A strict depguard allow list keeps pkg/ free of internal/ and of the server's runtime dependencies. go list -deps ./pkg/... shows only the standard library, go-humanize and yaml.v3.
• Docs: a "Validating from Go" section on the settings-directory page with the version rule (validate with the package from the same tag as the server), plus the architecture, development, AGENTS and contributing pages, the changelog, the labeler globs, the make dev watch list, the unit-test package list and the e2e coverage exclude that follows the validator.

Most of the diff is import-path rewrites; the substantive files are pkg/settings/{validate,tree,seed}.go, internal/settings/{registry,store,seed}.go, .golangci.yml and the docs.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 54ce2e48-d8db-45a7-ba95-26b150fd0701

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📚 Docs preview

✅ Live: https://pr-839-wavehouse-docs.wave-rf.workers.dev (follows this PR)
This commit (bafce88): https://5453c0e9-wavehouse-docs.wave-rf.workers.dev (exactly this commit; open it if the link above looks stale)

• Commit: bafce88 fix(settings): round-trip populated documents; bootstrap hint moves to the CLI
• Author: @taitelee
• Committed: 2026-10-14 09:39 EDT
• Uploaded: 2026-10-14 09:50 EDT (run)

Earlier commits (3)

Commit	Preview (that commit only)	Uploaded
16e24c9	https://448fcc9f-wavehouse-docs.wave-rf.workers.dev	2026-10-13 14:40 EDT
ef0fffd	https://3961bd27-wavehouse-docs.wave-rf.workers.dev	2026-10-13 13:18 EDT
bed636c	https://0930ebc3-wavehouse-docs.wave-rf.workers.dev	2026-10-13 12:24 EDT

[github-code-quality]

Code coverage overview

Languages: Go

Go

main 6857804	feat/settings-import... bafce88	+/-
93%	93%	0%

View coverage of the 10 most impacted files.

File	main 6857804	feat/settings-import... bafce88	+/-
pkg/pipes/pipes.go	0%	83%	+83%
pkg/policy/scalars.go	0%	87%	+87%
pkg/policy/canonical.go	0%	92%	+92%
pkg/policy/rowfilter.go	0%	92%	+92%
pkg/policy/numeric.go	0%	92%	+92%
pkg/settings/decode.go	0%	95%	+95%
pkg/settings/validate.go	0%	97%	+97%
pkg/policy/policy.go	0%	98%	+98%
pkg/settings/tree.go	0%	98%	+98%
pkg/policy/roles.go	0%	100%	+100%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 14, 2026 13:50 UTC}

[taitelee]

Review Deleted

[taitelee]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.