Profiles

A pack declares what it needs; a profile decides which provider satisfies each capability. Credentials and endpoints come from the deployment’s own configuration — run cairn doctor to see what’s set and reachable.

Profile format

A profile is a TOML file with a single closed [profile] table — unknown keys are a hard error, so typos fail loudly:

[profile]
extends = "secure.toml"          # one-level inheritance, cycle-checked

[profile.bindings]               # capability -> operator (the dispatch seam)
"storage.put" = "s3/put"
"redact.text" = "redact/text"
"audit.sink"  = "audit/store"

[profile.backends]               # cross-cutting toggles / choosers
durable_runtime = "in_process"
memory = true

[profile.mcp_servers.github]     # MCP servers available to templates
transport = "http"
url = "https://..."

[profile.config."dataset/pii_scan"]   # per-operator config partials
backend = "presidio"

# policies / knowledge: attach-lists (omit = inherit all, [] = strict empty)
policies = ["high-risk-action-policy"]

On extends, bindings/backends/MCP shallow-merge child-over-parent; the per-operator config tables deep-merge; policies/knowledge attach-lists replace when present.

Shipped profiles

Profile	Extends	Purpose
local-dev	—	zero-config dev: everything bound to in-tree local operators
secure	local-dev	adds redaction + hash-chained audit at the LLM egress
production	secure	fail-closed gates: model/gate rejects stub results and requires a benchmark; PII scan pinned to the Presidio backend
prod	production	what a production box points at (adds the memory backend)
prod-infisical	secure	production with Infisical-backed secrets
e2e	secure	integration matrix: S3 artifacts + Slack notify

A deployment points at a profile by name or path; unset means no overrides. The console’s Environments view edits these same files — bindings, backends, policy and knowledge attach-lists — through the UI.

Secrets

Secrets follow a reference discipline everywhere: connections and stores hold references; the actual values live in the secret store (a local env-var backend by default, Infisical optional) and are never printed.