ADMINISTRATOR GUIDE

Configuration

Strict YAML with explicit required paths, mandatory dry-run and narrowly scoped collector settings.

Safe example

node_id: "node-example-01"
poll_interval_seconds: 60
audit_jsonl_path: "/var/log/pantaw/audit.jsonl"
audit_sqlite_path: "/var/lib/pantaw/audit.db"
maintenance_state_path: "/var/lib/pantaw/maintenance.json"
circuit_breaker_state_path: "/var/lib/pantaw/circuit-breaker.json"
sop_directory: "/etc/pantaw/sops"
dry_run: true
max_attempts: 3
window_minutes: 15
collectors:
  cpu:
    enabled: true
  memory:
    enabled: true
  filesystem:
    enabled: true
  nvidia:
    enabled: true
    timeout: 5

Required fields

node_id: Stable non-secret node identifier
poll_interval_seconds: Integer greater than zero
audit_jsonl_path: Append-only JSONL destination
audit_sqlite_path: SQLite audit database
maintenance_state_path: Maintenance-state file
circuit_breaker_state_path: Circuit-breaker state file
sop_directory: Readable directory of validated SOP YAML files
dry_run: Must be true in this release

Optional fields

max_attempts defaults to 3, window_minutes defaults to 15, and collectors defaults to an empty mapping. Omitting the collector map preserves the v0.0.1 synthetic compatibility path; it does not enable Linux collectors implicitly.

Collector options

Every registered collector accepts enabled. Only systemd accepts units, timeout and required; process and nvidia accept timeout; smart accepts devices and timeout.

Unknown collector names, unknown fields, incorrect types, unsafe unit/device names and invalid timeouts are rejected.

Validation behavior

Missing files, unknown top-level fields, duplicate/invalid YAML, incorrect types, conflicting paths and dry_run: false must fail before an operational cycle. PANTAW does not silently invent a production configuration.