Configuration | Ghostable CLI 3.x

Project manifest

.ghostable/ghostable.yaml identifies the project and its stable operational defaults:

schema: ghostable.project.v1
id: project_01example
name: Acme API
language: php
framework: laravel
packageManager: composer
deployTarget: laravel-forge
activity:
  mode: minimal
  auditEnvironments:
    - production
    - staging
environments:
  default:
    type: local
  staging:
    type: staging
  production:
    type: production
scan:
  level: standard
  ignores:
    - .git/**
    - node_modules/**
    - vendor/**
    - .ghostable/environments/**/values/**
    - .ghostable/environments/**/keys/**

Manifest fields

schema: Manifest format identifier; v3 currently writes ghostable.project.v1.
id: Stable cryptographic project identifier. Do not copy it to create a separate project.
name: Human-readable project name.
language / framework / packageManager: Optional project hints captured during setup.
deployTarget: Optional default target: local, laravel-forge, laravel-vapor, or laravel-cloud.
activity.mode: Records the requested activity detail level: off, minimal, or full. Required signed security and mutation events are still written in v3; do not use off as an audit-disable control.
activity.auditEnvironments: Default environment scope used by review and hygiene when --env is omitted; defaults to production and staging when those environments exist.
environments: Map of environment names to intent-bearing type labels.
scan.level: Default hard-coded secret scan level: relaxed, standard, or strict.
scan.ignores: Glob patterns excluded from local review and related reference scans.

Scan defaults

New manifests ignore Git internals, node_modules, vendor, dist, build, encrypted value records, and environment key records. Add project-specific generated or fixture paths only after confirming they do not need scanning.

Per-run review --level and --ignore flags override or extend the manifest behavior without changing the committed default.

Schema and hygiene files

.ghostable/schema.yaml declares project-wide validation rules.
.ghostable/schemas/<env>.yaml adds environment-specific rules.
.ghostable/hygiene.yaml declares project and environment-specific variable rotation intervals.

These files are plaintext policy and must not contain credentials or confidential operational notes.

Runtime environment

GHOSTABLE_CI_TOKEN: Scoped non-interactive automation credential loaded instead of a local device identity.
GHOSTABLE_KEYSTORE: Overrides the local file-backed identity-store directory.
XDG_CONFIG_HOME: Controls the default Linux/Unix configuration root when GHOSTABLE_KEYSTORE is unset.
NO_COLOR: Disables ANSI color output when set to any non-empty value.

Editing configuration

Use env create, env rename, env delete, schema, and hygiene rotation commands where possible so related signed state stays consistent. If a manifest hint or scan pattern must be edited manually, review the diff and run ghostable status, validation, and review afterward.