config

type AWSFlowCfg struct {
	Region   string `yaml:"region"`    // AWS region (default: AWS_REGION / IMDS)
	LogGroup string `yaml:"log_group"` // CloudWatch Logs group that receives the VPC Flow Logs (required)

	// FlowFormat selects the VPC Flow Logs field layout. Default (empty / "v2")
	// uses the standard v2 default format (14 fields). Set to "custom" and
	// configure FlowFields when the log group was created with a custom field
	// list; custom-format log groups silently return no results under "v2" because
	// the positional field assumptions no longer hold.
	FlowFormat string `yaml:"flow_format"` // "" | "v2" (default) | "custom"

	// FlowFields maps flow field names to their 0-based column index in the
	// space-delimited log record. Only consulted when FlowFormat is "custom".
	// Required keys: srcaddr, dstaddr, srcport, dstport, protocol.
	// Example for a custom format omitting the first two standard fields:
	//   flow_fields: {srcaddr: 1, dstaddr: 2, srcport: 3, dstport: 4, protocol: 5}
	FlowFields map[string]int `yaml:"flow_fields"`
}

type ActionAllow struct {
	ReversibleOnly      bool     `yaml:"reversible_only"`      // never auto-apply irreversible actions
	Namespaces          []string `yaml:"namespaces"`           // allowlist of target namespaces; empty = no executable target permitted
	ProtectedNamespaces []string `yaml:"protected_namespaces"` // never an action target (added to the built-ins flux-system, kube-system)
	MaxBlastRadius      int      `yaml:"max_blast_radius"`     // cap on affected workloads
	Kinds               []string `yaml:"kinds"`                // resource kinds that may be acted on
}

type ActionMode string

type ActionPolicy struct {
	Mode             ActionMode  `yaml:"mode"`               // off | suggest | approve | auto (experimental, frozen)
	Allow            ActionAllow `yaml:"allow"`              // envelope, enforced even in approve/auto
	RequireApproval  bool        `yaml:"require_approval"`   // force a human click for gated actions
	ApprovalTokenEnv string      `yaml:"approval_token_env"` // env var with a shared secret for the approval endpoints
	AuditLogPath     string      `yaml:"audit_log_path"`     // append-only, hash-chained action audit log (required for auto)
	Auto             AutoPolicy  `yaml:"auto"`               // rung-3 unattended-execution safety controls
}

type AutoPolicy struct {
	DryRun        bool     `yaml:"dry_run"`        // log "would execute" without executing
	MinConfidence float64  `yaml:"min_confidence"` // only auto-execute when the investigation is at least this confident
	MaxPerWindow  int      `yaml:"max_per_window"` // rate limit; 0 = unlimited (not recommended)
	Window        Duration `yaml:"window"`         // rate-limit window (default 1h)
}

type Catalog struct {
	Dir           string        `yaml:"dir"` // OKF bundle path (mounted ConfigMap, or the git-sync mirror)
	Git           CatalogGit    `yaml:"git"`
	InstantRecall InstantRecall `yaml:"instant_recall"`
}

type CatalogGit struct {
	URL      string   `yaml:"url"`       // repo to clone/pull; empty disables git-sync
	Branch   string   `yaml:"branch"`    // default "main"
	Interval Duration `yaml:"interval"`  // re-sync period (default 5m)
	TokenEnv string   `yaml:"token_env"` // env var with a read token (empty = anonymous/public)
}

type Cloud struct {
	Provider    string `yaml:"provider"`     // "" (disabled) | "aws"
	Region      string `yaml:"region"`       // e.g. eu-west-3 (default: AWS_REGION / IMDS)
	ClusterName string `yaml:"cluster_name"` // EKS cluster name, scopes nodegroup/ASG queries
}

type Coalesce struct {
	Enabled           bool     `yaml:"enabled"`
	Debounce          Duration `yaml:"debounce"`
	MaxWait           Duration `yaml:"max_wait"`
	MaxBatch          int      `yaml:"max_batch"`
	Cooldown          Duration `yaml:"cooldown"`
	CorrelationLabels []string `yaml:"correlation_labels"` // empty ⇒ AM groupKey, else namespace+label values
}

type Config struct {
	GitOps   GitOps        `yaml:"gitops"` // engine selection (flux default | argocd)
	Triggers TriggerPolicy `yaml:"triggers"`

	// Sources is the per-source enablement map: a key under `sources.<name>`
	// enables that source adapter, and its value is the adapter's own raw config
	// (decoded lazily by each adapter's Build). Presence is enablement — e.g.
	// `sources.alertmanager: {}` turns on the Alertmanager webhook source. This
	// keeps adding a source from requiring a central-struct edit. The webhook
	// auth token stays server-level (server.webhook_token_env).
	Sources map[string]yaml.Node `yaml:"sources"`

	Actions ActionPolicy `yaml:"actions"` // read-only by default; the upper rungs of the autonomy ladder
	Forge   Forge        `yaml:"forge"`   // git-forge auth (GitHub App) for diff access + curation
	Curate  Curate       `yaml:"curate"`  // Phase-2 backlog groomer settings
	Model   Model        `yaml:"model"`   // optional; when BaseURL is set, serve uses the LLM investigator
	Notify  Notify       `yaml:"notify"`  // chat delivery for findings
	Catalog Catalog      `yaml:"catalog"` // OKF knowledge catalog
	Outcome Outcome      `yaml:"outcome"` // learning-loop outcome ledger

	LeaderElection LeaderElection `yaml:"leader_election"` // HA: only the leader investigates

	Metrics MetricsConfig `yaml:"metrics"` // PromQL backend (VictoriaMetrics/Prometheus) for query_metrics
	Logs    LogsConfig    `yaml:"logs"`    // LogsQL backend (VictoriaLogs) for query_logs
	Network Network       `yaml:"network"` // network-flow data source (pluggable, CNI-agnostic); empty Provider disables it
	Cloud   Cloud         `yaml:"cloud"`   // cloud-side context (AWS); empty Provider disables it
	MCP     MCP           `yaml:"mcp"`     // external MCP servers whose tools the agent may call (opt-in)

	Server ServerConfig `yaml:"server"` // HTTP ingress (webhook authentication)

	Investigation Investigation `yaml:"investigation"` // coalescing + rate-limit + per-investigation token controls
	Telemetry     Telemetry     `yaml:"telemetry"`     // OpenTelemetry metrics
	Logging       Logging       `yaml:"logging"`       // structured-logging format + verbosity
}

type Curate struct {
	StaleAfter          Duration `yaml:"stale_after"`          // close unprotected KB PRs idle longer than this; 0 disables (default 720h)
	RecurrenceThreshold int      `yaml:"recurrence_threshold"` // open a knowledge-gap issue after this many unresolved occurrences of a pattern; 0 ⇒ default 3
}

type Dedup struct {
	Window Duration `yaml:"window"`
}

type Duration time.Duration

type Embeddings struct {
	BaseURL   string `yaml:"base_url"`
	Model     string `yaml:"model"`
	APIKeyEnv string `yaml:"api_key_env"`
}

type Endpoint struct {
	URL string `yaml:"url"`

	// TokenEnv names an env var holding a bearer token for the backend. When set
	// and the var is non-empty, requests carry "Authorization: Bearer <token>".
	// Empty (default) ⇒ no Authorization header (unchanged, keyless behaviour).
	TokenEnv string `yaml:"token_env"`

	// Headers are static request headers added to every backend request — e.g. a
	// tenant header for a multi-tenant VictoriaMetrics/VictoriaLogs instance
	// ("X-Scope-OrgID: <tenant>"). Empty (default) ⇒ no extra headers.
	Headers map[string]string `yaml:"headers"`
}

type Forge struct {
	GitHubApp     GitHubApp `yaml:"github_app"`
	KBRepo        string    `yaml:"kb_repo"`        // "owner/name" — the catalog repo for curation
	BaseBranch    string    `yaml:"base_branch"`    // PR target branch (default "main")
	GitHubAPIURL  string    `yaml:"github_api_url"` // override for GHES/tests (default https://api.github.com)
	DupScore      float64   `yaml:"dup_score"`      // file-time catalog BM25 dedup threshold (default 5.0)
	MinConfidence float64   `yaml:"min_confidence"` // file-time quality gate: min overall confidence (default 0.75)
	// SkipVerdicts lists investigation verdicts that must NOT draft a KB PR — the
	// finding is still delivered to chat, but no repo artifact is created. Values are
	// validated against the verdict enum (no_action|action_suggested|action_required|
	// inconclusive). Empty (default) draws no distinction: every verdict is eligible,
	// preserving pre-gate behaviour. Recommended production value: ["no_action"].
	SkipVerdicts []string `yaml:"skip_verdicts"`
}

type GCPFlowCfg struct {
	Project string `yaml:"project"` // GCP project ID (default: ADC / metadata server)
}

type GitHubApp struct {
	AppID          int64  `yaml:"app_id"`
	InstallationID int64  `yaml:"installation_id"`
	PrivateKeyRef  string `yaml:"private_key_ref"` // Secret name/key (e.g. via External Secrets)
	PrivateKeyEnv  string `yaml:"private_key_env"` // v1: env var holding the PEM private key
}

type GitOps struct {
	Engine string `yaml:"engine"` // "flux" (default) | "argocd"
}

type GitOpsFailureTrigger struct {
	// Debounce is a pointer so an unset key (nil ⇒ 60s default, applied in
	// applyDefaults) is distinguishable from an explicit `debounce: 0` (fire
	// immediately). A plain Duration can't tell the two apart — both are the zero
	// value — which is why `debounce: 0` used to be silently clobbered to 60s.
	Debounce *Duration `yaml:"debounce"`
}

type HubbleCfg struct {
	URL string `yaml:"url"` // Hubble Relay gRPC address (host:port), e.g. hubble-relay.kube-system:80

	// TLS enables encrypted transport to the Hubble Relay endpoint. Default
	// (false) keeps the existing plaintext/insecure behaviour so the maintainer's
	// test cluster (Cilium/Hubble Relay, currently plaintext) keeps connecting
	// without any config change.
	TLS bool `yaml:"tls"` // false (default) = insecure/plaintext; true = TLS (credentials.NewTLS)
}

type IncidentMatch struct {
	Severity    []string          `yaml:"severity"`    // e.g. [critical]
	Environment []string          `yaml:"environment"` // e.g. [prod]
	Namespaces  []string          `yaml:"namespaces"`  // glob patterns
	AlertNames  []string          `yaml:"alertnames"`  // glob patterns
	Labels      map[string]string `yaml:"labels"`      // arbitrary label matchers
}

type IncidentTrigger struct {
	Match  IncidentMatch `yaml:"match"`  // must match to investigate
	Ignore IncidentMatch `yaml:"ignore"` // excludes even if Match passes
	Dedup  Dedup         `yaml:"dedup"`
	// Debounce is the pre-investigation hold for a firing alert: after admission
	// (match + dedup) RunLore waits this long and investigates only if the alert
	// is still active — i.e. no matching Alertmanager `resolved` webhook arrived
	// within the window. It filters self-resolving alerts (e.g. a
	// KubeDaemonSetRolloutStuck during a Karpenter node-churn cycle) that would
	// otherwise burn a full investigation on noise. A zero window (the default)
	// disables the hold and investigates immediately, preserving today's behavior;
	// it is opt-in per deployment. It composes with `coalesce` (which batches the
	// survivors afterwards) and `dedup` (which still suppresses re-fires before the
	// hold begins).
	Debounce Duration `yaml:"debounce"`
	// CancelQueuedOnResolve drops a QUEUED — accepted but not yet started —
	// investigation when the matching Alertmanager `resolved` webhook arrives
	// first. It extends Debounce past the hold window: without it, a fire→resolve
	// sequence whose firing already passed into the investigation queue still burns
	// a full paid investigation. Opt-in (default false, preserving today's
	// behavior) because some teams deliberately want the post-hoc answer to "why
	// did it fire?" even after self-resolution — mirroring Debounce being opt-in.
	// Boundaries: an IN-FLIGHT investigation is never cancelled, and a coalesced
	// multi-alert batch is not cancelled on one member's resolve (see
	// investigate.Queue.CancelByFingerprint).
	CancelQueuedOnResolve bool `yaml:"cancel_queued_on_resolve"`
}

type InstantRecall struct {
	Enabled              bool    `yaml:"enabled"`
	MinScore             float64 `yaml:"min_score"`              // similarity floor for the top hit
	MarginGap            float64 `yaml:"margin_gap"`             // top hit must beat the runner-up by at least this
	SoloFloor            float64 `yaml:"solo_floor"`             // confident bar when there is only one hit (higher than MinScore)
	RequireWorkloadMatch bool    `yaml:"require_workload_match"` // true = exact namespace+workload (also disables scopeless matching); false = namespace-level agreement is enough
	OutcomePrior         float64 `yaml:"outcome_prior"`          // Beta prior strength for outcome decay
	OutcomeFloor         float64 `yaml:"outcome_floor"`          // reject a recall when the outcome factor drops below this

	// Rerank adds an LLM reranking stage to the recall short-circuit: it ranks the
	// top-K structurally-agreeing candidates against the incident with ONE cheap
	// model call and gates the fire on the reranker's CALIBRATED match confidence
	// (RerankThreshold) instead of the corpus-dependent BM25 magnitude
	// (SoloFloor/MarginGap). This is the principled gate: an enriched real-corpus
	// BM25 score is ~0.1–1.2 (an order of magnitude below the default SoloFloor 4.0),
	// so the magnitude gate only fires where the operator hand-tuned solo_floor to
	// their corpus, whereas a calibrated confidence needs no per-corpus tuning —
	// measured 0/11 → 11/11 fire at default thresholds with perfect precision.
	//
	// Three-state (*bool): **nil (unset) ⇒ ON** whenever instant_recall is enabled,
	// so it works out of the box; explicit `false` disables it (the BM25-magnitude
	// gate is then used, byte-for-byte unchanged); explicit `true` is the same as
	// unset. Use RerankEnabled(). Routes to model.verify (cheaper/faster) when
	// configured, else the main model.
	Rerank          *bool   `yaml:"rerank"`           // nil/true ⇒ reranker ON (default); false ⇒ off (legacy BM25-magnitude gate)
	RerankThreshold float64 `yaml:"rerank_threshold"` // calibrated match-confidence bar to short-circuit (default 0.7; corpus-independent)
	RerankK         int     `yaml:"rerank_k"`         // max structurally-agreeing candidates ranked in one call (default 5; bounded for cost)
	RerankMinScore  float64 `yaml:"rerank_min_score"` // trivial retrieval-score floor below which retrieval found nothing plausible → skip the paid call (cost guard; default 0.1)

	// Hybrid switches recall to fused BM25 + embedding retrieval, gated on COSINE
	// similarity instead of the BM25 score above. Requires model.embeddings to be
	// configured (else recall stays BM25). EXPERIMENTAL — tune the cosine thresholds
	// against the instant-recall eval before relying on it; the defaults are
	// conservative placeholders, not measured values.
	Hybrid          bool    `yaml:"hybrid"`            // enable hybrid (cosine-gated) recall
	HybridMinScore  float64 `yaml:"hybrid_min_score"`  // cosine floor for the top hit (default 0.80)
	HybridMarginGap float64 `yaml:"hybrid_margin_gap"` // cosine margin over the runner-up (default 0.05)
}

type Investigation struct {
	Coalesce                  Coalesce  `yaml:"coalesce"`
	RateLimit                 RateLimit `yaml:"rate_limit"`
	MaxSteps                  int       `yaml:"max_steps"`                    // 0 ⇒ loop default (20)
	MaxToolOutputBytes        int       `yaml:"max_tool_output_bytes"`        // unset/0 ⇒ bounded default (32768); -1 ⇒ unlimited
	MaxTokensPerInvestigation int       `yaml:"max_tokens_per_investigation"` // unset/0 ⇒ bounded default (100000); -1 ⇒ unlimited
	Timeout                   Duration  `yaml:"timeout"`                      // per-investigation deadline; 0 ⇒ default (10m) via applyDefaults
	ToolTimeout               Duration  `yaml:"tool_timeout"`                 // per-TOOL-call timeout so one hung tool can't eat the budget; 0 ⇒ default (60s) at construction

	// RecurrenceCooldown (opt-in, 0 = off) suppresses re-investigating a trigger
	// whose previous investigation completed less than this long ago, concluded
	// (verdict ≠ inconclusive), and has no standing 👎 feedback. Without it a
	// still-firing alert re-investigates on every Alertmanager repeat_interval and
	// a persistently-failing GitOps resource on every informer resync (~10m).
	// Requires outcome.ledger_path (the gate reads the ledger's trigger index).
	RecurrenceCooldown Duration `yaml:"recurrence_cooldown"`

	// Compaction selects how mid-loop history compaction treats the tool outputs it
	// elides once the estimate crosses the compaction target. "" / "elide" is the
	// default: drop their bodies for short markers (lossy). "summarize" first asks a
	// model (the verify-tier model when configured, else the main model) for one
	// compact factual digest of the batch and keeps that in place of the markers,
	// falling back to plain elision on any summarizer error/refusal/truncation.
	Compaction string `yaml:"compaction"` // "" | "elide" (default) | "summarize"

	// PodLogNamespaces lists extra namespaces (beyond the incident's own) that
	// pod_logs may read controller/crash logs from. pod_logs streams raw pod logs
	// (which carry secrets/PII) to the external LLM, so the model is constrained to
	// the incident namespace plus this allowlist at the application layer — not just
	// by Kubernetes RBAC. Set this to match the Helm rbac.controllerLogNamespaces
	// (e.g. [flux-system]); empty means the incident namespace only.
	PodLogNamespaces []string `yaml:"pod_log_namespaces"`

	// ProgressUpdates opts into interim progress notifications during a long
	// investigation. Off by default (zero behaviour change, zero extra model calls).
	ProgressUpdates ProgressUpdates `yaml:"progress_updates"`
}

type LeaderElection struct {
	Enabled bool   `yaml:"enabled"`
	Name    string `yaml:"name"` // Lease name (default "runlore-leader")
}

type LogFields struct {
	// ContainerField / NamespaceField / PodField are the STREAM label names used to
	// build a `{k=v}` selector (query_logs) and to derive the compact pod/container
	// identity in the renderer. Defaults: kubernetes.container_name /
	// kubernetes.pod_namespace / kubernetes.pod_name.
	ContainerField string `yaml:"container_field"`
	NamespaceField string `yaml:"namespace_field"`
	PodField       string `yaml:"pod_field"`

	// LevelField is the severity field query_logs filters on (after unpack_json) and
	// that the error-summary histogram splits by. Defaults: log.level.
	LevelField string `yaml:"level_field"`

	// UnpackPipe is the LogsQL pipe that promotes JSON body fields to top-level
	// fields so LevelField becomes filterable. Default: unpack_json. Set to a
	// different pipe (or leave empty to disable) if your logs are already flat.
	UnpackPipe string `yaml:"unpack_pipe"`
}

type Logging struct {
	Format string `yaml:"format"` // "text" (default) | "json"
	Level  string `yaml:"level"`  // "debug" | "info" (default) | "warn" | "error"
}

type LogsConfig struct {
	Endpoint `yaml:",inline"`

	Fields LogFields `yaml:"fields"`
}

type MCP struct {
	Servers []MCPServer `yaml:"servers"`
}

type MCPServer struct {
	Name     string `yaml:"name"` // identifier; namespaces its tools as name__tool
	Endpoint `yaml:",inline"`
}

type MatrixNotify struct {
	Homeserver     string `yaml:"homeserver"`
	RoomID         string `yaml:"room_id"`
	AccessTokenEnv string `yaml:"access_token_env"` // env var holding the access token
	// FeedbackReactions (opt-in, default off) records 👍/👎 reactions on RunLore's
	// investigation messages into the outcome ledger, where they weigh recalled-
	// entry trust exactly like Slack's feedback buttons. Unlike Slack, nothing is
	// exposed: reactions arrive over the client-server /sync long-poll — an
	// OUTBOUND request authenticated by the access token above. Requires the three
	// notifier fields and outcome.ledger_path; Validate fails loud otherwise.
	FeedbackReactions bool `yaml:"feedback_reactions"`
}

type MetricsConfig struct {
	Endpoint `yaml:",inline"`

	// Flavor optionally pins the backend flavor instead of auto-detecting it:
	// "victoriametrics" enables MetricsQL query guidance; "prometheus" (or an unknown
	// value) keeps generic behaviour. Empty ⇒ probe at startup.
	Flavor string `yaml:"flavor"`
}

type Model struct {
	Provider  string `yaml:"provider"`    // "openai" (default) | "anthropic" | "gemini"
	BaseURL   string `yaml:"base_url"`    // OpenAI: required; Anthropic/Gemini: optional (built-in default endpoint). Must be https when api_key_env is set on a public host (validated).
	Model     string `yaml:"model"`       // model name
	APIKeyEnv string `yaml:"api_key_env"` // env var holding the API key (empty = keyless)
	// MaxTokens caps the model's output (generated) tokens per request. 0 = use the
	// 8192 default. Streaming providers send it (Anthropic max_tokens, OpenAI
	// max_tokens, Gemini generationConfig.maxOutputTokens); a too-low value truncates.
	MaxTokens int `yaml:"max_tokens"`
	// Effort opts into deeper model reasoning per request. Provider-specific
	// vocabulary, validated at startup: anthropic low|medium|high|max (sent as
	// output_config.effort), openai minimal|low|medium|high (sent as
	// reasoning_effort). Empty = omitted from requests (today's behavior). Not
	// supported for provider gemini (its thinkingConfig has replay semantics —
	// thought signatures — the provider-agnostic history can't carry). Models that
	// don't support the knob return a 400, which is classified permanent.
	Effort string `yaml:"effort"`
	// Thinking opts into adaptive extended thinking, sent as thinking:{type:"adaptive"}.
	// Only value is "adaptive"; only supported for provider anthropic (the client
	// replays the signed thinking blocks across the tool loop). Empty = omitted from
	// requests (today's behavior, byte-for-byte). Validated at startup; any other value
	// or any non-anthropic provider is a clear config error. Interacts with effort:
	// both may be set (effort is soft guidance for how much thinking Claude does).
	// Give max_tokens headroom — thinking consumes output tokens.
	Thinking string `yaml:"thinking"`
	// Verify optionally routes the adversarial verify pass to a cheaper/faster model;
	// unset fields inherit from the parent above (so `verify: {model: <cheap>}` reuses
	// the same provider/endpoint/key). Absent ⇒ verify runs on the main model.
	Verify *ModelOverride `yaml:"verify"`
	// Embeddings optionally configures an OpenAI-compatible /embeddings endpoint used
	// for hybrid recall (instant_recall.hybrid). Unset ⇒ BM25-only recall.
	Embeddings *Embeddings `yaml:"embeddings"`
	// Pricing optionally sets token rates so RunLore can estimate and report a
	// per-investigation cost. Unset ⇒ token totals are reported without a dollar
	// figure. Rates are validated non-negative.
	Pricing *Pricing `yaml:"pricing"`
}

type ModelOverride struct {
	Provider  string `yaml:"provider"`
	BaseURL   string `yaml:"base_url"`
	Model     string `yaml:"model"`
	APIKeyEnv string `yaml:"api_key_env"`
	// MaxTokens overrides the parent's effective output-token cap for the verify pass;
	// 0 inherits the parent's effective value.
	MaxTokens int `yaml:"max_tokens"`
	// Effort overrides the parent's effort for the verify pass; empty inherits the
	// parent's value (same vocabulary and validation as model.effort).
	Effort string `yaml:"effort"`
	// Thinking overrides the parent's thinking mode for the verify pass; empty inherits
	// the parent's value (same vocabulary and validation as model.thinking). Note the
	// verify pass always forces a tool_choice, so the Anthropic client drops thinking
	// for that request anyway — this knob only affects any non-forced verify calls.
	Thinking string `yaml:"thinking"`
	// Pricing overrides the parent's token rates for the verify pass (a cheaper
	// verify model has its own cost); nil inherits model.pricing.
	Pricing *Pricing `yaml:"pricing"`
}

type Network struct {
	Provider string     `yaml:"provider"` // "" (disabled) | hubble | aws-vpc-flow-logs | gcp-firewall-logs
	Hubble   HubbleCfg  `yaml:"hubble"`   // when provider=hubble
	AWS      AWSFlowCfg `yaml:"aws"`      // when provider=aws-vpc-flow-logs
	GCP      GCPFlowCfg `yaml:"gcp"`      // when provider=gcp-firewall-logs

	// URL keeps the pre-pluggable `network: {url: ...}` shape working: a bare url with
	// no provider is treated as Hubble (with a deprecation warning at wiring time).
	URL string `yaml:"url"`
}

type Notify struct {
	Slack  SlackNotify          `yaml:"slack"`
	Matrix MatrixNotify         `yaml:"matrix"`
	Extra  map[string]yaml.Node `yaml:",inline"` // notify.<name> blocks for registered (non-built-in) notifiers
}

type Outcome struct {
	LedgerPath string `yaml:"ledger_path"` // append-only JSONL path (e.g. the git-sync mirror PV); empty disables
	// MaxEvents bounds the JSONL before it is compacted on load (startup / leadership
	// Reload): older paired events are folded into a checkpoint record so the file stops
	// growing forever. A pointer for a three-state knob: nil (key absent) ⇒ a generous
	// default (outcome.DefaultMaxEvents); an explicit 0 ⇒ compaction disabled.
	MaxEvents *int `yaml:"max_events"`
}

type Pricing struct {
	InputUSDPerMTok       float64 `yaml:"input_usd_per_mtok"`
	OutputUSDPerMTok      float64 `yaml:"output_usd_per_mtok"`
	CachedInputUSDPerMTok float64 `yaml:"cached_input_usd_per_mtok"`
}

type ProgressUpdates struct {
	Enabled    bool `yaml:"enabled"`
	EverySteps int  `yaml:"every_steps"` // emit a ping every N steps; 0 ⇒ default 5 (applyDefaults). Must be > 0 when enabled.
}

type RateLimit struct {
	MaxPerWindow int      `yaml:"max_per_window"` // 0 ⇒ unlimited
	Window       Duration `yaml:"window"`
	MaxRequeues  int      `yaml:"max_requeues"` // drop a key after this many backoff requeues
}

type ServerConfig struct {
	// WebhookTokenEnv names an env var holding a shared secret required on
	// POST /webhook/alertmanager as "Authorization: Bearer <token>". Empty leaves
	// the webhook unauthenticated (rejected by Validate when actions.mode=auto).
	WebhookTokenEnv string `yaml:"webhook_token_env"`
}

type SlackNotify struct {
	WebhookURLEnv    string   `yaml:"webhook_url_env"`    // env var holding the incoming-webhook URL
	BotTokenEnv      string   `yaml:"bot_token_env"`      // env var holding a bot token (xoxb-…) for chat.postMessage
	Channel          string   `yaml:"channel"`            // channel ID or name to post to (required with bot_token_env)
	SigningSecretEnv string   `yaml:"signing_secret_env"` // env var with the Slack signing secret (verifies button clicks)
	ApproverIDs      []string `yaml:"approver_ids"`       // Slack user IDs allowed to approve actions (empty = no Slack approvals)
	// FeedbackButtons (opt-in, default off) renders 👍/👎 buttons on investigation
	// messages; clicks are recorded in the outcome ledger and weigh the recalled
	// entry's trust like resolve signals do. Requires exposing POST
	// /slack/interactions to Slack (an interactivity Request URL — the same
	// endpoint approve-mode buttons use) plus signing_secret_env and
	// outcome.ledger_path; Validate fails loud when either is missing.
	FeedbackButtons bool `yaml:"feedback_buttons"`
}

type Telemetry struct {
	MetricsEnabled bool   `yaml:"metrics_enabled"` // serve OTel metrics on GET /metrics (Prometheus exposition)
	OTLPEndpoint   string `yaml:"otlp_endpoint"`   // optional OTLP push (phase-2); empty ⇒ scrape-only
}

type TriggerPolicy struct {
	Incidents      IncidentTrigger      `yaml:"incidents"`       // primary trigger
	GitOpsFailures GitOpsFailureTrigger `yaml:"gitops_failures"` // secondary trigger
}