spec: configuration -> Scope table (format-walkthrough #12/#22)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Agent IX

spec/functional/core/FR-011-per-plugin-file-isolation.md

@@ -2,7 +2,6 @@
 id: FR-011
 title: "Per-Plugin File Isolation and Scoped Failure"
 artifact_type: FR
-object: configuration
 relationships:
   - target: "ix://agent-ix/ix-cli/spec/stakeholder/StR-005"
     type: "implements"

spec/functional/core/FR-012-layered-resolution.md

@@ -2,7 +2,6 @@
 id: FR-012
 title: "Layered Config Resolution: Env → Plugin File → Defaults"
 artifact_type: FR
-object: configuration
 relationships:
   - target: "ix://agent-ix/ix-cli/spec/stakeholder/StR-005"
     type: "implements"

spec/functional/core/FR-015-keyring-backend.md

@@ -2,7 +2,6 @@
 id: FR-015
 title: "OS Keyring Backend (@napi-rs/keyring)"
 artifact_type: FR
-object: configuration
 relationships:
   - target: "ix://agent-ix/ix-cli/spec/stakeholder/StR-006"
     type: "implements"

spec/functional/core/FR-016-encrypted-file-fallback.md

@@ -2,7 +2,6 @@
 id: FR-016
 title: "Encrypted-File Fallback for Headless Environments"
 artifact_type: FR
-object: configuration
 relationships:
   - target: "ix://agent-ix/ix-cli/spec/stakeholder/StR-006"
     type: "implements"

spec/functional/core/FR-020-core-plugin-schema.md

@@ -79,6 +79,19 @@ Cluster-targeting state (which cluster, kubeconfig context) lives in the `local`
 
 Other deferred core fields: proxy settings, default editor, default output format. These can be added as additive non-breaking schema changes in later versions.
 
+## Configuration
+
+| Name | Scope | Type | Default | Description |
+|---|---|---|---|---|
+| `logLevel` | runtime | enum (debug, info, warn, error) | `info` | Core log level; env binding `IX_LOG_LEVEL`. |
+| `secretsBackend` | runtime | enum (auto, keyring, age-file) | `auto` | Secrets backend selection; `auto` picks keyring when the FR-015 probe succeeds, age-file otherwise; env binding `IX_SECRETS_BACKEND`. |
+| `auth.serviceUrl` | runtime | string (URL) | `https://auth.ix` | IX auth-service URL; env binding `IX_AUTH_URL`. |
+| `auth.expiresAt` | runtime | string (ISO-8601 datetime), optional | (unset) | Token expiry written by `ix login`, read by token-refresh logic; the only core key with no env binding. |
+| `telemetry.enabled` | runtime | boolean | `false` | Telemetry opt-in (default off); env binding `IX_TELEMETRY`. |
+| `theme` | runtime | enum (auto, light, dark) | `auto` | UI theme; env binding `IX_THEME`. |
+| `updateCheck.enabled` | runtime | boolean | `true` | Update-check toggle; env binding `IX_UPDATE_CHECK`. |
+| `updateCheck.intervalHours` | runtime | integer (1–168) | `24` | Hours between update checks; env binding `IX_UPDATE_CHECK_INTERVAL_HOURS`. |
+
 ## Acceptance
 
 - **FR-020-AC-1**: `ConfigService.forPlugin('core', CoreConfigSchema).get()` against an empty environment and absent `~/.config/ix/config.yaml` returns the full default object: `logLevel: 'info'`, `secretsBackend: 'auto'`, `auth: { serviceUrl: 'https://auth.ix' }`, `telemetry: { enabled: false }`, `theme: 'auto'`, `updateCheck: { enabled: true, intervalHours: 24 }`.

spec/functional/local/FR-009-cluster-default-configuration.md

@@ -34,6 +34,14 @@ interface ClusterConfig {
 - Any field present but not a string array → throw `ConfigValidationError` with the field name.
 - Valid sub-fields are merged with defaults for any fields not specified.
 
+## Configuration
+
+| Name | Scope | Type | Default | Description |
+|---|---|---|---|---|
+| `cluster.defaultTags` | creation | string[] | `["ix-core"]` | Tags selecting the default service set deployed at cluster bring-up. |
+| `cluster.extraApps` | creation | string[] | `[]` | Additional apps to deploy beyond the tag-selected default set. |
+| `cluster.skipApps` | creation | string[] | `[]` | Apps to exclude from the default set. |
+
 ## Acceptance
 
 - **FR-009-AC-1**: Absent config file returns `{ defaultTags: ["ix-core"], extraApps: [], skipApps: [] }`.

spec/functional/local/FR-037-multi-host-ingress-config.md

@@ -111,6 +111,18 @@ The post-`init-cluster` operator hint emits one
 `address=/.<host>/<clusterIp>` directive per entry in `config.hosts`,
 joined into a single line.
 
+## Configuration
+
+| Name | Scope | Type | Default | Description |
+|---|---|---|---|---|
+| `domain.hosts` | runtime | string[] (length >= 1) | `["dev.ix"]` | Ingress base domains; each entry must have >= 2 non-empty dot-separated labels and no whitespace. `hosts[0]` is aliased as `IxConfig.internalBaseDomain`. Edits trigger the wildcard-TLS refresh paths. |
+| `domain.enableExternal` | runtime | boolean | `false` | Enables the external host; setting it without `domain.external` fails loudly at `loadConfig()` time (FR-037-CON-3). |
+| `domain.external` | runtime | string or null | `null` | External base domain. |
+| `domain.publicBaseUrl` | runtime | string or null | `null` | Canonical public URL for user-facing emails; must start with `http://` or `https://`; single-valued by design and NOT derived from `hosts[0]`. |
+| `IX_INTERNAL_BASE_DOMAIN` | session | string (env var) | (unset) | Legacy singular override; when set and non-empty, replaces `hosts` with a one-entry list. Highest precedence. |
+| `IX_INTERNAL_BASE_DOMAINS` | session | string (env var, comma-separated) | (unset) | Plural override of `hosts`; below the legacy singular env var, above the persisted file. |
+| `ingress.exposeExtraHosts` | creation | boolean (chart value) | `false` | Per-service `ix-service` chart default; when `true`, fans out one ingress host per `(fullname, baseDomain)` pair. Deliberate security boundary (see Security). |
+
 ## Acceptance
 
 - **FR-037-AC-1**: A missing `domain` group in the persisted YAML

spec/functional/local/FR-039-auth-client-audience-allowlist.md

@@ -12,9 +12,9 @@ The local plugin **SHALL** own product-to-auth audience mappings used by local d
 
 ## Configuration
 
-| Path | Default | Description |
-|---|---|---|
-| `local.auth.clientAudienceAllowlist` | `{ "filament-ui": ["filament"] }` | Public client id to allowed JWT audiences |
+| Name | Scope | Type | Default | Description |
+|---|---|---|---|---|
+| `local.auth.clientAudienceAllowlist` | runtime | object (client id to string[] audiences) | `{ "filament-ui": ["filament"] }` | Public client id to allowed JWT audiences; rendered into auth-service Helm values as `AUTH_CLIENT_AUDIENCE_ALLOWLIST` during `ix up`. |
 
 ## Behavior