config

type AutoFix struct {
	Lint     int
	Test     int
	Review   int
	Document int
	CI       int
	Rebase   int
}

type AutoFixRaw struct {
	Lint     *int `yaml:"lint"`
	Test     *int `yaml:"test"`
	Review   *int `yaml:"review"`
	Document *int `yaml:"document"`
	CI       *int `yaml:"ci"`
	Babysit  *int `yaml:"babysit"`
	Rebase   *int `yaml:"rebase"`
}

type CI struct {
	// RerunTransient is how many times the CI step may re-run a single check
	// the provider reported as cancelled - the one terminal outcome it
	// attributes to itself rather than to the job - before that check reaches
	// an approval gate. 0 disables reruns and restores the behavior of
	// escalating every failure on sight.
	RerunTransient int
}

type CIRaw struct {
	RerunTransient *int `yaml:"rerun_transient"`
}

type Commands struct {
	Lint   string `yaml:"lint"`
	Test   string `yaml:"test"`
	Format string `yaml:"format"`
}

type Commit struct {
	FixMessage string
}

type CommitRaw struct {
	FixMessage *string `yaml:"fix_message"`
}

type Concurrency struct {
	Reviews int `yaml:"reviews"`
	Suites  int `yaml:"suites"`
}

type Config struct {
	Concurrency           Concurrency
	ReplayGlobalYAML      []byte
	ReplayRepoYAML        []byte
	TrustedConfigSHA      string
	CaptureEvalProvenance bool
	Agent                 types.AgentName
	Agents                []types.AgentName
	ACPXPath              string
	ACPRegistryOverrides  map[string]string
	AgentPathOverride     map[string]string
	AgentArgsOverride     map[string][]string
	CITimeout             time.Duration
	StepQuietWarning      time.Duration
	LogLevel              string
	SessionReuse          bool
	Eval                  Eval
	Commands              Commands
	IgnorePatterns        []string
	BlockingSeverity      string
	AutoFix               AutoFix
	CI                    CI
	Commit                Commit
	Intent                Intent
	Test                  Test
	Quartermaster         Quartermaster
	Document              Document
	Review                Review
	Slop                  Slop
	// DisableProjectSettings is the resolved, trusted-only opt-out (see the
	// RepoConfig field). When true, gate agents are launched with their
	// project-level settings/instructions suppressed; the daemon fails the run
	// closed if the resolved harness has no verified suppression knob.
	DisableProjectSettings bool
	// NoCI is the resolved, trusted-only declaration that this repository
	// intentionally has no CI (see the RepoConfig field). When true and the
	// forge reports zero checks, the CI monitor treats that as all-checks-passed.
	NoCI bool
}

type Convergence struct {
	// NonDecreasingRounds trips the guard when the review findings count has
	// not decreased across this many trailing consecutive rounds.
	NonDecreasingRounds int
	// RecurringRounds trips the guard when one finding class recurs in this
	// many distinct review rounds.
	RecurringRounds int
	// BudgetMinutes trips the guard when cumulative review execution time
	// reaches this budget.
	BudgetMinutes int
}

type ConvergenceRaw struct {
	NonDecreasingRounds *int `yaml:"non_decreasing_rounds"`
	RecurringRounds     *int `yaml:"recurring_rounds"`
	BudgetMinutes       *int `yaml:"budget_minutes"`
}

type Document struct {
	Instructions string
}

type DocumentRaw struct {
	// Instructions augment (never replace) the built-in documentation
	// placement policy with the repository's ownership map or extra
	// placement rules.
	Instructions string `yaml:"instructions"`
}

type Eval struct {
	CaptureProvenance bool
	AutoCapture       bool
	// MaxCases caps the auto-captured corpus. 0 keeps every case. Pruning is
	// oldest-first and never removes a case that already has recorded
	// candidate replays, so a corpus you have spent tokens on is never
	// silently reclaimed underneath a comparison.
	MaxCases int
	// DiversifiedSize caps the official gold-only eval set. 0 means one gold
	// case per stratum (no Hamilton bound). Unlabeled cases never fill it.
	DiversifiedSize int
}

type EvalRaw struct {
	CaptureProvenance *bool `yaml:"capture_provenance"`
	AutoCapture       *bool `yaml:"auto_capture"`
	MaxCases          *int  `yaml:"max_cases"`
	DiversifiedSize   *int  `yaml:"diversified_size"`
}

type Evidence struct {
	StoreInRepo bool
	Dir         string
	Branch      string
	// LocalRoot overrides the app-root default for on-disk evidence; empty
	// means paths.EvidenceDir(). Retention and MaxRuns bound how much of it
	// survives: no-mistakes reaps its own evidence rather than leaving that to
	// an OS temp-directory timer. Zero disables the corresponding bound.
	LocalRoot string
	Retention time.Duration
	MaxRuns   int
}

type EvidenceRaw struct {
	StoreInRepo *bool   `yaml:"store_in_repo"`
	Dir         *string `yaml:"dir"`
	// Branch selects the orphan evidence branch. It names a git ref the
	// daemon pushes to with the maintainer's credentials, so it is honored
	// ONLY from the trusted default-branch copy of .no-mistakes.yaml (see
	// EffectiveRepoConfig): a contributor's pushed branch must not be able to
	// aim evidence commits at another branch of the repository.
	Branch *string `yaml:"branch"`
	// LocalRoot, Retention, and MaxRuns describe this MACHINE's evidence
	// storage: where the daemon writes artifacts on local disk and how long it
	// keeps them. They are global-only - Merge resolves them straight from
	// GlobalConfig and never from a repository, trusted copy included. A
	// repository does not get to name a filesystem path the daemon writes to,
	// nor to set the retention budget for a resource every other repository on
	// the machine shares. (Contrast Branch, which is trusted-repo-settable
	// because a branch genuinely is per-repository state.)
	//
	// LocalRoot must be absolute; see validateTestRaw.
	LocalRoot *string `yaml:"local_root"`
	Retention *string `yaml:"retention"`
	MaxRuns   *int    `yaml:"max_runs"`
}

type GlobalConfig struct {
	Concurrency          Concurrency         `yaml:"concurrency"`
	SourceYAML           []byte              `yaml:"-"`
	Agent                types.AgentName     `yaml:"agent"`
	Agents               []types.AgentName   `yaml:"-"`
	ACPXPath             string              `yaml:"acpx_path"`
	ACPRegistryOverrides map[string]string   `yaml:"acp_registry_overrides"`
	AgentPathOverride    map[string]string   `yaml:"agent_path_override"`
	AgentArgsOverride    map[string][]string `yaml:"agent_args_override"`
	CITimeout            time.Duration       `yaml:"-"`
	StepQuietWarning     time.Duration       `yaml:"-"`
	DaemonConnectTimeout time.Duration       `yaml:"-"`
	LogLevel             string              `yaml:"log_level"`
	// SessionReuse controls per-run agent session reuse in the review loop:
	// one durable fixer session across review-fix turns. Review turns always
	// run session-free so the rereview never resumes the session whose
	// findings prescribed the fixes it certifies. Default true; set
	// session_reuse: false to force every invocation cold.
	SessionReuse bool `yaml:"-"`
	AutoFix      AutoFixRaw
	// CI is the operator's own CI-step floor. It is the only place the rerun
	// budget can be set for a repository whose default branch this machine's
	// user does not control (the common case when contributing to someone
	// else's project), and a trusted repo value still wins over it.
	CI            CIRaw
	Commit        CommitRaw
	Intent        IntentRaw
	Test          TestRaw
	Quartermaster Quartermaster
	// Eval is resolved at load time because it is global-only: it describes
	// this machine's local eval corpus (disk, retention, whether review rounds
	// record replay provenance), never a repository policy. Keeping it out of
	// RepoConfig means no pushed branch can enable, disable, or resize it.
	Eval Eval
}

type Intent struct {
	Enabled         bool
	Threshold       float64
	SlackDays       int
	DisabledReaders map[string]bool
}

type IntentRaw struct {
	Enabled         *bool    `yaml:"enabled"`
	Threshold       *float64 `yaml:"threshold"`
	SlackDays       *int     `yaml:"slack_days"`
	DisabledReaders []string `yaml:"disabled_readers"`
}

type PathInstruction struct {
	Path         string `yaml:"path"`
	Instructions string `yaml:"instructions"`
}

type Quartermaster struct {
	Enabled bool
	Bin     string
	TTL     time.Duration
	Weight  int
}

type QuartermasterRaw struct {
	Enabled *bool  `yaml:"enabled"`
	Bin     string `yaml:"bin"`
	TTL     string `yaml:"ttl"`
	Weight  int    `yaml:"weight"`
}

type RepoConfig struct {
	Agent          types.AgentName   `yaml:"agent"`
	Agents         []types.AgentName `yaml:"-"`
	Commands       Commands          `yaml:"commands"`
	IgnorePatterns []string          `yaml:"ignore_patterns"`
	// BlockingSeverity is the minimum recognized severity that parks a gate.
	// It is trusted-only so a pushed branch cannot make its own warnings advisory.
	BlockingSeverity string `yaml:"blocking_severity"`
	// AllowRepoCommands opts in to honoring the code-executing selection
	// fields (commands.{test,lint,format} and agent) from a contributor's
	// pushed branch instead of the trusted default-branch copy. It is read
	// ONLY from the trusted default-branch copy of .no-slop.yaml (never
	// the pushed SHA), so a contributor cannot self-enable. Default false:
	// the pushed branch controls nothing that executes.
	AllowRepoCommands bool       `yaml:"allow_repo_commands"`
	AutoFix           AutoFixRaw `yaml:"auto_fix"`
	CI                CIRaw      `yaml:"ci"`
	Commit            CommitRaw  `yaml:"commit"`
	Intent            IntentRaw  `yaml:"intent"`
	Test              TestRaw    `yaml:"test"`
	// Document carries the repository's documentation placement policy. It
	// steers the document step's gate prompt, so it is honored ONLY from the
	// trusted default-branch copy of .no-slop.yaml (see
	// EffectiveRepoConfig): a contributor's pushed branch must not be able to
	// weaken documentation rules for its own review.
	Document DocumentRaw `yaml:"document"`
	// Review carries the repository's review-step settings. Its
	// path_instructions steer the review gate prompt, so they are honored
	// ONLY from the trusted default-branch copy of .no-slop.yaml (see
	// EffectiveRepoConfig), regardless of allow_repo_commands: a contributor's
	// pushed branch must not be able to inject or weaken the guidance that
	// reviews it.
	Review ReviewRaw `yaml:"review"`
	// DisableProjectSettings opts the repository out of loading project-level
	// agent settings/instructions (AGENTS.md/CLAUDE.md and the equivalent
	// per-harness project settings) into gate agents. It exists for
	// agent-orchestration repos (e.g. firstmate) whose project instructions
	// would otherwise install a fleet-captain identity on a gate agent. It is a
	// SECURITY boundary honored ONLY from the trusted default-branch copy of
	// .no-slop.yaml (see EffectiveRepoConfig and the daemon's
	// assertGateTrustedConfigReadable): a contributor's pushed branch must not be
	// able to turn it off (or on). Default false; a plain bool so a missing key
	// or a YAML/JSON null is falsy and preserves current loading.
	DisableProjectSettings bool `yaml:"disable_project_settings"`
	// NoCI declares that this repository intentionally has no CI. When true and
	// the forge reports zero checks, the CI monitor treats that empty result as
	// all-checks-passed. It is a readiness boundary honored ONLY from the trusted
	// default-branch copy of .no-slop.yaml (see EffectiveRepoConfig): a
	// contributor's pushed branch must not self-declare no-CI and bypass checks.
	// Default false - absence means CI is expected, and an unproven empty check
	// list remains not-ready regardless of elapsed time. If checks still appear,
	// their actual states are processed normally; the declaration never waives a
	// registered pending or failing check. No inference from workflow files,
	// prior history, branch names, or grace-period expiry.
	NoCI bool `yaml:"no_ci"`
	// Slop configures the NoSlop front-stage classifier and artifact oracles.
	// It controls validation depth, so EffectiveRepoConfig treats it as
	// trusted-only when the daemon evaluates a pushed branch.
	Slop SlopRaw `yaml:"slop"`
}

type Review struct {
	PathInstructions []PathInstruction
	Convergence      Convergence
}

type ReviewRaw struct {
	// PathInstructions scope extra review guidance to the paths a change
	// actually touches. The review step appends the blocks whose glob matches
	// at least one changed file; a run that touches nothing matching leaves
	// the review prompt exactly as it is without this setting.
	PathInstructions []PathInstruction `yaml:"path_instructions"`
	// Convergence configures the review-loop ladder guard thresholds. It
	// rides the Review section's trust boundary: honored only from the
	// trusted default-branch copy, so a pushed branch cannot widen or
	// disable the guard on its own run.
	Convergence ConvergenceRaw `yaml:"convergence"`
}

type Slop struct {
	DataDir        string
	Risk           SlopRisk
	LeakScan       SlopLeakScan
	Prose          SlopProse
	TestCountFloor bool
	TestCommand    string
}

type SlopLeakScan struct {
	BlocklistFile   string
	AllowExemptions bool
}

type SlopLeakScanRaw struct {
	BlocklistFile   string `yaml:"blocklist_file"`
	AllowExemptions *bool  `yaml:"allow_exemptions"`
}

type SlopProse struct {
	OutboundPaths []string
	AITellWords   []string
}

type SlopProseRaw struct {
	OutboundPaths []string `yaml:"outbound_paths"`
	AITellWords   []string `yaml:"ai_tell_words"`
}

type SlopRaw struct {
	DataDir        string          `yaml:"data_dir"`
	Risk           SlopRiskRaw     `yaml:"risk"`
	LeakScan       SlopLeakScanRaw `yaml:"leak_scan"`
	Prose          SlopProseRaw    `yaml:"prose"`
	TestCountFloor *bool           `yaml:"test_count_floor"`
	TestCommand    string          `yaml:"test_command"`
}

type SlopRisk struct {
	SingleReviewThreshold    int
	FullAdversarialThreshold int
	HighRiskPaths            []string
}

type SlopRiskRaw struct {
	SingleReviewThreshold    int      `yaml:"single_review_threshold"`
	FullAdversarialThreshold int      `yaml:"full_adversarial_threshold"`
	HighRiskPaths            []string `yaml:"high_risk_paths"`
}

type Test struct {
	Evidence Evidence
}

type TestRaw struct {
	Evidence EvidenceRaw `yaml:"evidence"`
}