config

type Config ¶

type Config struct {
	Autonomy   string     `toml:"autonomy"`
	Models     Models     `toml:"models"`
	Gates      Gates      `toml:"gates"`
	Critic     Critic     `toml:"critic"`
	Proof      Proof      `toml:"proof"`
	Evaluation Evaluation `toml:"evaluation"`
	Identity   Identity   `toml:"identity"`
}

Config is the resolved harness configuration (SPEC §3.1).

func Defaults() Config

func Load(getenv func(string) string) (Config, error)

func (c *Config) AutonomyLevel() authority.Level

func (c *Config) BaselineModels() map[string]string

func (c *Config) CriticUnconfirmed() string

func (c *Config) DeniedInputs() []adh.CriticInput

func (c *Config) JudgmentRoles() authority.JudgmentRoles

func (c *Config) MaxReworks() int

func (c *Config) ProofContract(res adh.Resolution) string

type Critic ¶

type Critic struct {
	GroundFrom  []string `toml:"ground_from"`
	Deny        []string `toml:"deny"`
	Unconfirmed string   `toml:"unconfirmed"`
}

Critic is the cold-critic policy (SPEC-ADDITIONS §19.4).

**Deny is enforced and GroundFrom describes.** The difference used to be invisible and both were read by nothing, which is worse in Deny than in an ordinary unused field: a deny-list naming `transcript` beside GroundFrom reads as *the* mechanism excluding the builder's history, and as configurable. Neither was true, so anyone hardening the critic would have edited it and believed they had succeeded.

Deny is now checked by the renderer against the view it built, so removing an entry weakens something real and adding one adh cannot honour is a load error rather than a decoration. The structural omission in prompt.Render remains the guarantee — an after-the-fact assertion cannot stop a field being populated — and the check is belt and braces on top of it.

GroundFrom is descriptive: adh assembles the critic's grounding whole and does not filter it, so this list records what the critic is grounded in and selects nothing. The set it must match is built in critic.Ground. Both lists are validated against adh.CriticInputs, so a typo in either is named at load.

Unconfirmed is the disposition of a finding no artifact confirmed and is acted on by the eval command.

type Evaluation ¶

type Evaluation struct {
	MaxReworks int `toml:"max_reworks"`
}

Evaluation is the Evaluation-stage policy (SPEC §4.1). MaxReworks bounds the rework loop: the times a confirmed finding may return an arc to Execution before it fails terminally. Zero means unset — MaxReworks() then falls back to the evaluation package's default, so that default keeps a single owner.

type Gates ¶

type Gates struct {
	ApprovalPhraseRequired bool `toml:"approval_phrase_required"`
}

Gates holds the human-gate policy.

type Identity ¶

type Identity struct {
	// Actor is the full actor id including its class, e.g. "human:steve" or
	// "ci:nightly". The class is declared rather than inferred: a bare name would have
	// to be guessed into a class, and guessing "human" is exactly the guess that lets a
	// CI runner mint sign-offs. Unset means the harness has no identity and cannot
	// record a verification.
	Actor string `toml:"actor"`
}

Identity is who this harness records as the actor on a verification event (SPEC-ADDITIONS §10.4).

**Config-derived, and attributable rather than authenticated.** It establishes who the harness was configured as, not who was at the keyboard, and adh states that limit rather than implying more. A flag would let any caller mint a `human:` event, which makes the tier fold worth defeating.

type ModelGateConf ¶

type ModelGateConf struct {
	JudgmentRoles []string `toml:"judgment_roles"`
}

ModelGateConf lists the roles that must run on a reasoning-class model.

type Models ¶

type Models struct {
	Reasoning string        `toml:"reasoning"`
	Fast      string        `toml:"fast"`
	Gate      ModelGateConf `toml:"gate"`
}

Models is the per-class model binding and the model-gate's judgment set.

type Proof ¶

type Proof struct {
	Contract map[string]string `toml:"contract"`
}

Proof is the proof policy (SPEC §3.1, §5.4). Contract maps each resolution to the acceptance bar its proof must satisfy to close (§12); a deployment tailors it per key, and any key it omits falls back to the generic built-in default.