version: "1.0"
mode: warn # "warn" or "strict"
dependency_sharing_mode: isolated # "isolated" or "shared-runtime-caches" or "shared-node-deps"
# change profile (recommended): npx workspai bootstrap --profile polyglot
# change mode/dependency manually: edit this file and rerun npx workspai init

rules:
  enforce_workspace_marker: true
  enforce_toolchain_lock: false
  disallow_untrusted_tool_sources: false
  enforce_compatibility_matrix: false
  require_mirror_lock_for_offline: true

# preferred policy management commands:
# npx workspai workspace policy show
# npx workspai workspace policy set mode strict
# npx workspai workspace policy set dependency_sharing_mode shared-runtime-caches
# npx workspai workspace policy set rules.enforce_toolchain_lock true

# dependency_sharing_mode options:
# - isolated               (default, safest)
# - shared-runtime-caches  (share Node/Python/Go caches at workspace level)
# - shared-node-deps       (compat alias for Node shared mode)