vstack.settings.toml

# Public vstack settings. Keep secrets in .env.local.
# vstack skill scripts read this [env] table after .env and before .env.local.

[env]
BOT_EMAIL = ""
BOT_NAME = ""
BOT_REMOTE_NAME = ""
CI_FIX_MAX_CYCLES = "6"
DECISIONS_DIR = "docs/decisions"
# Diff-scoped local validation mirroring skill-tests.yml's lanes; the merge
# queue runs the full suite once on the merged result.
DEV_VALIDATE_CMD = "tools/validate-changed"
GH_BOT_USERNAME = ""
GH_ISSUE_PATTERN = "vst-[0-9]+"
GH_VERIFY_CMD = ""
LINEAR_FORMAT = "safe"
LINEAR_TEAM = "vstack"
LINEAR_TEAM_PREFIX = "VST"
# Agent-routing set from docs/issue-label-taxonomy.md § Agent labels — keep the
# two in sync. `issues create` refuses a create carrying none of these
# (VST-147); `agent:iced` exists in the workspace but has no vstack surface,
# so it is deliberately not declared here.
LINEAR_AGENT_LABELS = "agent:generalist, agent:rust, agent:researcher, agent:multi, agent:human"
ORCH_STATE_DIR = "tmp"
# Reviewer gate: Copilot (copilot-pull-request-reviewer) auto-reviews every PR
# here but never APPROVES — it only COMMENTS — so the gate runs in "review"
# mode: a formal review of the current head plus zero unresolved threads, never
# an approval verdict. Devin does not review this repo, so no "@devin review"
# nudge is configured; an empty PR_REVIEW_NUDGE falls back to a GitHub-native
# re-review request, which re-triggers Copilot.
PR_REVIEW_GATE = "review"
PR_REVIEW_NUDGE_SECS = "600"
PR_REVIEW_NUDGE = ""
# Copilot publishes its analysis as the "copilot-pull-request-reviewer"
# check-run; a success of that exact name on the current head satisfies the
# review-received predicate when a clean re-analysis submits no review object
# (vstack #654). All publishers on this repo are trusted (match-by-name).
PR_REVIEW_CHECK = "copilot-pull-request-reviewer"
# Reviewer-down flexibility: when no review evidence arrives before the wait
# deadline AND zero threads are unresolved (open threads always block), proceed
# to CI/merge instead of stalling the fleet on a credit-exhausted reviewer.
# "block" (the default) keeps the prior prompt-on-timeout behavior.
PR_REVIEW_ON_TIMEOUT = "proceed"
CI_WAIT_NO_CHECKS_GRACE = "180"
REVIEWER_SLOT_BUDGET = "0"
SECOND_OPINION_MODELS = "claude codex"
SECOND_OPINION_COUNT = "1"
SECOND_OPINION_CLAUDE_CMD = "claude -p --no-session-persistence --model opus --effort xhigh --allowedTools Bash(read-only:true),Read,Glob,Grep"
SECOND_OPINION_CODEX_CMD = "codex exec -m gpt-5.6-sol -s read-only -c model_reasoning_effort=xhigh --ephemeral"
SECOND_OPINION_TIMEOUT = "3000"
SECOND_OPINION_ARTIFACT_DIR = "tmp/second-opinion"
# Three-tier file-size ruling: implementation 400 (the shipped default),
# test paths 800, nested READMEs 120. The test patterns cover every test
# layout tracked here — dir conventions (tests/, test/, __tests__/), Rust
# module tests (tests.rs) and cfg(test) helper modules (test_util.rs), and
# suffix-named suites (*.test.mjs and friends).
# `*/README.md` leads so no test pattern shadows it (first match wins); `*`
# crosses `/`, so it catches every README below the root while the
# repo-root README.md — no slash, the product landing page — keeps 400.
SIZE_RATCHET_CLASSES = "*/README.md=120;*/tests/*=800;*/test/*=800;*/__tests__/*=800;*/tests.rs=800;*test_util.rs=800;*.test.*=800"
SECOND_OPINION_REVIEW_INSTRUCTIONS = "AGENTS.md review-bots.md .github/instructions/*.instructions.md .github/copilot-instructions.md"
WORKTREE_BASE_DIR = "~/dev/.worktrees/vstack"
WORKTREE_COPIES = ".vstack-lock.json"
WORKTREE_DEFAULT_BRANCH = "main"
WORKTREE_MKDIRS = "tmp"
WORKTREE_RELATIVE_SYMLINKS = ".claude/CLAUDE.md=../AGENTS.md"
WORKTREE_SYMLINKS = ".env.local opencode.json .agents .cursor .codex .opencode .pi/agents .pi/APPEND_SYSTEM.md .claude/settings.json .claude/agents .claude/hooks .claude/skills .cache"

# REVIEW GATE — this repo's SELF-ADOPTION of its own shared engine (VST-10;
# skills/review-gate is the canonical source here, so the writer workflow
# references tracked script paths). One writer
# (.github/workflows/review-gate-writer.yml) evaluates the predicate and
# posts the gate status; PR-attached legs relay into it via
# workflow_dispatch (VST-210) rather than running the engine in the PR's
# own check rollup. It always runs the DEFAULT-branch engine, so a PR
# cannot influence its own gate evaluation. A PR that
# repairs the engine itself merges via the ruleset's bypass actor.
# Review-object trust is pinned to the reviewer bots + the owner
# (closes the any-collaborator-COMMENTED gap). qodo posts review objects
# as qodo-code-review[bot]; trusted early as a review source ahead of the
# trial decision (~2026-08-16).
# Evidence: CodeRabbit (status/check + review objects) and Copilot's
# clean-analysis check-run (it never APPROVES, so min_state stays "any" —
# the same review-mode semantics as the legacy PR_REVIEW_* gate above).
REVIEW_GATE_CONTEXT = "Review gate"
REVIEW_GATE_TRUSTED_STATUS_CONTEXTS = "CodeRabbit;copilot-pull-request-reviewer"
REVIEW_GATE_CHECKRUN_SKIP_PATTERNS = "rate limited;skipped;queued"
REVIEW_GATE_COMMENT_REVIEWERS = "chatgpt-codex-connector[bot]:Reviewed commit:;bmethod:REVIEWED-CLEAN"
REVIEW_GATE_SHA_PREFIX_FLOOR = "7"
REVIEW_GATE_OVERRIDE_CONTEXT = "vstack-reviewer-outage"
# chatgpt-codex-connector[bot] trusted per the owner decision 2026-08-08:
# any trusted AI bot's review satisfies the evidence term once threads are
# resolved. Codex reviews actively; leaving it untrusted made its reviews
# invisible as evidence while still counting as "engagement" that held off
# the proceed-on-timeout fallback — a deadlock, not a safeguard. Its
# reaction-emoji verdicts stay unparsed by design; trusting the login makes
# the emoji irrelevant.
REVIEW_GATE_REVIEW_OBJECT_TRUSTED_LOGINS = "coderabbitai[bot];copilot-pull-request-reviewer[bot];qodo-code-review[bot];chatgpt-codex-connector[bot];bmethod"
REVIEW_GATE_REVIEW_OBJECT_MIN_STATE = "any"
# PR-triggered workflows must not be able to mint trusted contexts or the
# operator override: statuses created by github-actions[bot] are never
# evidence. Safe here because the override is operator-PAT-posted under v2
# (the old Actions-posted sweep attestation is gone).
REVIEW_GATE_STATUS_PUBLISHER_REJECT = "github-actions[bot]"
# Docs-only deltas carry ancestor evidence forward (owner decision
# 2026-08-08, fleet-wide): a final docs-only push keeps its review evidence
# instead of forcing one more re-review round. "comments" is deliberately
# NOT enabled — its classifier is line-lexical and cannot see enclosing
# heredocs/multiline strings (see the example's caveat); "docs" has no such
# residual. Code changes always require fresh evidence.
REVIEW_GATE_CARRY_FORWARD = "docs"
# Policy-bearing markdown is "docs" by extension but is obeyed mechanically
# by agents and reviewers — a push editing it changes behavior and gets a
# fresh review instead of carrying ancestor evidence (vstack#1115 closes
# the residual accepted when the docs class was enabled). In THIS repo the
# product itself is instruction markdown, so the whole agents/skills/
# pi-extensions trees are excluded: carry-forward stays useful for genuine
# prose (README, CHANGELOG, docs/) and nothing mechanically consumed ever
# rides an ancestor's evidence.
REVIEW_GATE_CARRY_FORWARD_EXCLUDE = "*AGENTS.md;*CLAUDE.md;.github/*;*review-bots.md;agents/*;skills/*;pi-extensions/*;.pi/*;skill-templates/*"
# No tracked CLAUDE.md exists in this repo — the glob guards generated
# consumer-side copies and any future one here. Declared so the selftest's
# dead-glob gate (undeclared no-match globs FAIL) knows it is deliberate.
REVIEW_GATE_CARRY_FORWARD_EXCLUDE_PROPHYLACTIC = "*CLAUDE.md"

# The review-gate ENGINE's one-switch disable, consumed by orch even where
# the review-gate skill is not installed. Only the exact value "off"
# narrows; anything else leaves PR_REVIEW_GATE authoritative.
REVIEW_GATE_MODE = "enforce"

# Total review-wait budget in seconds before the on-timeout policy applies;
# an explicit max_wait argument always wins.
PR_REVIEW_WAIT_SECS = "900"

# Reviewer logins (comma/space separated, ONE line — the loader reads a
# value per line) that must EACH review the current head with zero open
# threads before the gate opens. Empty = off. On timeout, "proceed" needs
# EVERY listed reviewer silent — a partial quorum is engagement.
PR_REVIEW_QUORUM = ""

# "ask" presents workflow decision points; "auto-recommended" executes the
# recommended option and logs it. Findings disposition is by rule in every
# mode; some decisions always ask; merge is governed by ORCH_MERGE_AUTONOMY.
ORCH_DECISION_MODE = "ask"

# "ask" presents the merge decision; "auto" merges once every gate is green.
# MERGE_READY = false never auto-merges.
ORCH_MERGE_AUTONOMY = "ask"

# Seconds per brief-delivery verification pass on tmux handoff lanes.
ORCH_TMUX_VERIFY_SECS = "15"

# Rename auto-discovered launch lanes (`<config-dir>=<alias>` pairs); the
# inventory is always discovered — this only renames it. ORCH_LANE_DIRS
# covers layouts discovery cannot reach.
# ORCH_LANE_ALIASES = "eclaude=work,mclaude=overflow"

# Path globs that add the needs-perf-test QA signal to review routing.
# QA_PERF_PATHS = "src/hot/* engine/src/*"

# Max concurrent lanes the overseer keeps in flight.
ORCH_OVERSEER_LANES = "3"