# internal/adapters/config

Package config loads and merges scafld workspace configuration files.

## DefaultCodexModel

```go
const (
	// DefaultCodexModel is empty by design: scafld omits -m for the "latest"
	// Codex model path so Codex CLI can use its own current default.
	DefaultCodexModel = ""
	// DefaultCodexModelReasoningEffort keeps governed review/harden runs from
	// inheriting a medium-effort CLI default after user config is isolated.
	DefaultCodexModelReasoningEffort = "xhigh"
	// DefaultClaudeModel is empty by design: scafld omits --model so Claude Code
	// can use its own current default unless the workspace explicitly pins one.
	DefaultClaudeModel = ""
	// DefaultClaudeEffort uses Claude Code's native effort control for governed
	// review/harden runs.
	DefaultClaudeEffort = "xhigh"
)
```

## DefaultCodexModelReasoningEffort

```go
const (
	// DefaultCodexModel is empty by design: scafld omits -m for the "latest"
	// Codex model path so Codex CLI can use its own current default.
	DefaultCodexModel = ""
	// DefaultCodexModelReasoningEffort keeps governed review/harden runs from
	// inheriting a medium-effort CLI default after user config is isolated.
	DefaultCodexModelReasoningEffort = "xhigh"
	// DefaultClaudeModel is empty by design: scafld omits --model so Claude Code
	// can use its own current default unless the workspace explicitly pins one.
	DefaultClaudeModel = ""
	// DefaultClaudeEffort uses Claude Code's native effort control for governed
	// review/harden runs.
	DefaultClaudeEffort = "xhigh"
)
```

## DefaultClaudeModel

```go
const (
	// DefaultCodexModel is empty by design: scafld omits -m for the "latest"
	// Codex model path so Codex CLI can use its own current default.
	DefaultCodexModel = ""
	// DefaultCodexModelReasoningEffort keeps governed review/harden runs from
	// inheriting a medium-effort CLI default after user config is isolated.
	DefaultCodexModelReasoningEffort = "xhigh"
	// DefaultClaudeModel is empty by design: scafld omits --model so Claude Code
	// can use its own current default unless the workspace explicitly pins one.
	DefaultClaudeModel = ""
	// DefaultClaudeEffort uses Claude Code's native effort control for governed
	// review/harden runs.
	DefaultClaudeEffort = "xhigh"
)
```

## DefaultClaudeEffort

```go
const (
	// DefaultCodexModel is empty by design: scafld omits -m for the "latest"
	// Codex model path so Codex CLI can use its own current default.
	DefaultCodexModel = ""
	// DefaultCodexModelReasoningEffort keeps governed review/harden runs from
	// inheriting a medium-effort CLI default after user config is isolated.
	DefaultCodexModelReasoningEffort = "xhigh"
	// DefaultClaudeModel is empty by design: scafld omits --model so Claude Code
	// can use its own current default unless the workspace explicitly pins one.
	DefaultClaudeModel = ""
	// DefaultClaudeEffort uses Claude Code's native effort control for governed
	// review/harden runs.
	DefaultClaudeEffort = "xhigh"
)
```

## Default

```go
func Default() Config
```

Default returns the built-in workspace configuration.

## DetectExecution

```go
func DetectExecution(root string) ExecutionDetection
```

DetectExecution infers safe PATH additions from checked-in toolchain files.

Detection is intentionally limited to version-manager shim directories. It does not run shell startup files or infer per-command state. Project config remains the place for explicit environment variables and policy.

## EffectiveEvidenceRoots

```go
func EffectiveEvidenceRoots(root string, cfg WorkspaceConfig) []string
```

EffectiveEvidenceRoots returns the absolute roots under which harden/review evidence may be read or cited. The primary scafld root is always first.

## EffectiveExecution

```go
func EffectiveExecution(root string, explicit ExecutionConfig) ExecutionConfig
```

EffectiveExecution merges auto-detected toolchain shims behind explicit config. Explicit config paths appear first in PATH and explicit environment keys override detected values.

## Load

```go
func Load(ctx context.Context, root string) (Config, error)
```

Load reads base config and local overrides from root.

## LoadBase

```go
func LoadBase(ctx context.Context, root string) (Config, error)
```

LoadBase reads only the committed base config, ignoring config.local overrides. The gate and verify paths use this so a host-committed config.local.yaml cannot repoint the trust anchor, relax the independence policy, or redirect reviewer endpoints. config.local stays an authoring convenience for the human lifecycle, never an input to the accountability gate.

## ValidVerifyPolicy

```go
func ValidVerifyPolicy(policy string) bool
```

ValidVerifyPolicy reports whether policy is a supported verify enforcement tier.

## ClaudeProviderConfig

```go
type ClaudeProviderConfig struct {
	ProviderConfig `yaml:",inline"`

	Effort string `yaml:"effort"`
}
```

ClaudeProviderConfig configures the Claude Code adapter.

- `ProviderConfig: ProviderConfig` (yaml:",inline"): 
- `Effort: string` (yaml:"effort"): 

## CodexProviderConfig

```go
type CodexProviderConfig struct {
	ProviderConfig `yaml:",inline"`

	ModelReasoningEffort string `yaml:"model_reasoning_effort"`
}
```

CodexProviderConfig configures the Codex CLI adapter. ModelReasoningEffort is intentionally Codex-specific; other provider thinking controls need their own verified adapter fields before scafld exposes them.

- `ProviderConfig: ProviderConfig` (yaml:",inline"): 
- `ModelReasoningEffort: string` (yaml:"model_reasoning_effort"): 

## Config

```go
type Config struct {
	Version    string          `yaml:"version"`
	Workspace  WorkspaceConfig `yaml:"workspace"`
	Invariants InvariantConfig `yaml:"invariants"`
	LLM        LLMConfig       `yaml:"llm"`
	Execution  ExecutionConfig `yaml:"execution"`
	Verify     VerifyConfig    `yaml:"verify"`
	Harden     HardenConfig    `yaml:"harden"`
	Review     ReviewConfig    `yaml:"review"`
}
```

Config is the merged runtime configuration for a scafld workspace.

- `Version: string` (yaml:"version"): 
- `Workspace: WorkspaceConfig` (yaml:"workspace"): 
- `Invariants: InvariantConfig` (yaml:"invariants"): 
- `LLM: LLMConfig` (yaml:"llm"): 
- `Execution: ExecutionConfig` (yaml:"execution"): 
- `Verify: VerifyConfig` (yaml:"verify"): 
- `Harden: HardenConfig` (yaml:"harden"): 
- `Review: ReviewConfig` (yaml:"review"): 

## ExecutionConfig

```go
type ExecutionConfig struct {
	PathPrepend            []string          `yaml:"path_prepend"`
	Env                    map[string]string `yaml:"env"`
	AbsoluteTimeoutSeconds int               `yaml:"absolute_timeout_seconds"`
	IdleTimeoutSeconds     int               `yaml:"idle_timeout_seconds"`
}
```

ExecutionConfig controls the deterministic environment for acceptance commands.

- `PathPrepend: []string` (yaml:"path_prepend"): 
- `Env: map[string]string` (yaml:"env"): 
- `AbsoluteTimeoutSeconds: int` (yaml:"absolute_timeout_seconds"): 
- `IdleTimeoutSeconds: int` (yaml:"idle_timeout_seconds"): 

## AbsoluteTimeout

```go
func (cfg ExecutionConfig) AbsoluteTimeout() time.Duration
```

AbsoluteTimeout returns the configured per-acceptance-command wall clock cap.

## IdleTimeout

```go
func (cfg ExecutionConfig) IdleTimeout() time.Duration
```

IdleTimeout returns the configured idle-output watchdog duration.

## ProcessEnv

```go
func (cfg ExecutionConfig) ProcessEnv() []string
```

ProcessEnv returns stable process environment overrides for acceptance commands.

## ExecutionDetection

```go
type ExecutionDetection struct {
	Execution ExecutionConfig
	Sources   []string
}
```

ExecutionDetection records repo-declared toolchain hints that can make non-login acceptance shells behave like the checked-in project expects.

- `Execution: ExecutionConfig`: 
- `Sources: []string`: 

## ExternalReviewConfig

```go
type ExternalReviewConfig struct {
	Provider           string               `yaml:"provider"`
	Command            string               `yaml:"command"`
	ProviderBinary     string               `yaml:"provider_binary"`
	IdleTimeoutSeconds int                  `yaml:"idle_timeout_seconds"`
	AbsoluteMaxSeconds int                  `yaml:"absolute_max_seconds"`
	FallbackPolicy     string               `yaml:"fallback_policy"`
	Codex              CodexProviderConfig  `yaml:"codex"`
	Claude             ClaudeProviderConfig `yaml:"claude"`
	Gemini             ProviderConfig       `yaml:"gemini"`
}
```

ExternalReviewConfig configures external model-provider review execution.

- `Provider: string` (yaml:"provider"): 
- `Command: string` (yaml:"command"): 
- `ProviderBinary: string` (yaml:"provider_binary"): 
- `IdleTimeoutSeconds: int` (yaml:"idle_timeout_seconds"): 
- `AbsoluteMaxSeconds: int` (yaml:"absolute_max_seconds"): 
- `FallbackPolicy: string` (yaml:"fallback_policy"): 
- `Codex: CodexProviderConfig` (yaml:"codex"): 
- `Claude: ClaudeProviderConfig` (yaml:"claude"): 
- `Gemini: ProviderConfig` (yaml:"gemini"): 

## HardenConfig

```go
type HardenConfig struct {
	MaxIssuesPerRound       int                  `yaml:"max_issues_per_round"`
	ContextMaxBytes         int                  `yaml:"context_max_bytes"`
	RequiredContextMaxBytes int                  `yaml:"required_context_max_bytes"`
	External                ExternalReviewConfig `yaml:"external"`
}
```

HardenConfig controls hardening prompt behavior.

- `MaxIssuesPerRound: int` (yaml:"max_issues_per_round"): 
- `ContextMaxBytes: int` (yaml:"context_max_bytes"): 
- `RequiredContextMaxBytes: int` (yaml:"required_context_max_bytes"): 
- `External: ExternalReviewConfig` (yaml:"external"): 

## InvariantConfig

```go
type InvariantConfig struct {
	Canonical map[string]string `yaml:"canonical"`
}
```

InvariantConfig names project-level invariant IDs available to specs.

- `Canonical: map[string]string` (yaml:"canonical"): 

## LLMConfig

```go
type LLMConfig struct {
	ModelProfile string `yaml:"model_profile"`
}
```

LLMConfig contains shared model-profile settings.

- `ModelProfile: string` (yaml:"model_profile"): 

## ProviderConfig

```go
type ProviderConfig struct {
	Model        string `yaml:"model"`
	Binary       string `yaml:"binary"`
	EndpointURL  string `yaml:"endpoint_url"`
	EndpointHost string `yaml:"endpoint_host"`
}
```

ProviderConfig configures a named external provider implementation.

- `Model: string` (yaml:"model"): 
- `Binary: string` (yaml:"binary"): 
- `EndpointURL: string` (yaml:"endpoint_url"): 
- `EndpointHost: string` (yaml:"endpoint_host"): 

## ReviewConfig

```go
type ReviewConfig struct {
	External          ExternalReviewConfig        `yaml:"external"`
	Context           ReviewContextConfig         `yaml:"context"`
	Dossier           ReviewDossierConfig         `yaml:"dossier"`
	AutomatedPasses   map[string]ReviewPassConfig `yaml:"automated_passes"`
	AdversarialPasses map[string]ReviewPassConfig `yaml:"adversarial_passes"`
}
```

ReviewConfig controls automated and adversarial review behavior.

- `External: ExternalReviewConfig` (yaml:"external"): 
- `Context: ReviewContextConfig` (yaml:"context"): 
- `Dossier: ReviewDossierConfig` (yaml:"dossier"): 
- `AutomatedPasses: map[string]ReviewPassConfig` (yaml:"automated_passes"): 
- `AdversarialPasses: map[string]ReviewPassConfig` (yaml:"adversarial_passes"): 

## ReviewContextConfig

```go
type ReviewContextConfig struct {
	MaxBytes         int      `yaml:"max_bytes"`
	RequiredMaxBytes int      `yaml:"required_max_bytes"`
	Files            []string `yaml:"files"`
}
```

ReviewContextConfig controls bounded project context sent to reviewers.

- `MaxBytes: int` (yaml:"max_bytes"): 
- `RequiredMaxBytes: int` (yaml:"required_max_bytes"): 
- `Files: []string` (yaml:"files"): 

## ReviewDossierConfig

```go
type ReviewDossierConfig struct {
	MaxFindings     int    `yaml:"max_findings"`
	MinAttackAngles int    `yaml:"min_attack_angles"`
	ReviewDepth     string `yaml:"review_depth"`
	RerunPolicy     string `yaml:"rerun_policy"`
}
```

ReviewDossierConfig controls default review dossier budget and rerun behavior.

- `MaxFindings: int` (yaml:"max_findings"): 
- `MinAttackAngles: int` (yaml:"min_attack_angles"): 
- `ReviewDepth: string` (yaml:"review_depth"): 
- `RerunPolicy: string` (yaml:"rerun_policy"): 

## ReviewPassConfig

```go
type ReviewPassConfig struct {
	Order       int    `yaml:"order"`
	Title       string `yaml:"title"`
	Description string `yaml:"description"`
}
```

ReviewPassConfig describes one review pass in the review agenda.

- `Order: int` (yaml:"order"): 
- `Title: string` (yaml:"title"): 
- `Description: string` (yaml:"description"): 

## VerifyConfig

```go
type VerifyConfig struct {
	MinIndependence string `yaml:"min_independence"`
	TrustedKeysPath string `yaml:"trusted_keys_path"`
	ReceiptPath     string `yaml:"receipt_path"`
	// Policy declares the operator's intended enforcement tier (local, advisory,
	// required). It is reporting-only metadata: it is read by `scafld verify
	// --self-check` and the docs framing, never by the receipt-verification
	// verdict path, so a tier can never bypass a real check.
	Policy string `yaml:"policy"`
}
```

VerifyConfig controls CI receipt verification defaults.

- `MinIndependence: string` (yaml:"min_independence"): 
- `TrustedKeysPath: string` (yaml:"trusted_keys_path"): 
- `ReceiptPath: string` (yaml:"receipt_path"): 
- `Policy: string` (yaml:"policy"): Policy declares the operator's intended enforcement tier (local, advisory, required). It is reporting-only metadata: it is read by `scafld verify --self-check` and the docs framing, never by the receipt-verification verdict path, so a tier can never bypass a real check.

## WorkspaceConfig

```go
type WorkspaceConfig struct {
	// EvidenceRoots are additional roots, relative to the scafld root unless
	// absolute, whose files may be cited by harden/review evidence. The scafld
	// root is always included.
	EvidenceRoots []string `yaml:"evidence_roots"`
}
```

WorkspaceConfig describes the local filesystem boundary scafld should treat as part of the project evidence surface.

- `EvidenceRoots: []string` (yaml:"evidence_roots"): EvidenceRoots are additional roots, relative to the scafld root unless absolute, whose files may be cited by harden/review evidence. The scafld root is always included.