mcpserver

type Options struct {
	PolicyDir   string
	AllowWrites bool
	// ClickHouse, when non-nil, enables analyze_experiment and lets
	// propose_promotion check the verdict before opening a PR.
	ClickHouse *promote.ClickHouse
	// SchemaDir holds *.schema.json; auto-detected near PolicyDir when empty.
	SchemaDir string
	Version   string
	// Upgrade, when set, supplies upgrade_candidates' Registry, Models and
	// Verifier (tests); nil = npm and the vendors' release metadata.
	Upgrade *upgrade.Watcher
	// Onboard, when set, is the machine the onboarding tools probe (tests);
	// nil = the real one.
	Onboard *onboard.Env
	// Server is halo-server's base URL for the fleet tools (kill switch,
	// audit, devices); empty = HALO_SERVER. The admin session is always
	// read from HALO_SESSION, never a flag or a tool argument.
	Server string
	// PROpener opens review PRs (propose_promotion, open_pr on the rollout
	// tools); nil = gh via promote.GHOpener; halo mcp serve sets a promote.ForgeOpener (--forge). Tests inject a fake.
	PROpener promote.PROpener
	// AdminRead lets admin_plan read the live vendor consoles, with
	// credentials from HALO_MCP_ADMIN_<VENDOR>_TOKEN (`halo mcp serve
	// --admin-read`). Off: admin_plan renders from policy only.
	AdminRead bool
	// AdminBaseURLs overrides admin_plan's vendor API base URLs (tests);
	// empty = the vendors' public APIs. Never a tool argument.
	AdminBaseURLs map[string]string
	// ROIIdentities is the identity roster CSV for roi_report and for the
	// delivery-ROI section of propose_promotion PRs (`halo mcp serve
	// --roi-identities`); ROIStore a local JSONL store of PR outcomes, else
	// they come from ClickHouse. Never tool arguments.
	ROIIdentities string
	ROIStore      string
}