Struct SopConfig 

pub struct SopConfig {

    pub sops_dir: Option<String>,
    pub default_execution_mode: String,
    pub max_concurrent_total: usize,
    pub approval_timeout_secs: u64,
    pub max_finished_runs: usize,
    pub maintenance_interval_secs: u64,
    pub persist_runs: bool,
    pub run_store_backend: SopRunStoreBackend,
    pub run_state_dir: Option<String>,
    pub approval_mode: ApprovalMode,
    pub approval_timeout_action: ApprovalTimeoutAction,
    pub approval: SopApprovalConfig,
    pub step_scope_enforce: bool,
    pub step_mandatory_tools: Vec<String>,
    pub step_schema_enforce: bool,
    pub max_step_visits: u32,
    pub max_step_retries: u32,
    pub untrusted_payload_max_bytes: usize,
    pub untrusted_input_guard: String,
    pub untrusted_guard_sensitivity: f64,
    pub untrusted_frame_warning: bool,
    pub untrusted_outbound_redact: bool,
    pub procedural_memory_enabled: bool,
}

Standard Operating Procedures engine configuration ([sop]).

The default_execution_mode field uses the SopExecutionMode type from sop::types (re-exported via sop::SopExecutionMode). To avoid circular module references, config stores it using the same enum definition.

Fields

sops_dir: Option<String>

Directory containing SOP definitions (subdirs with SOP.toml + SOP.md). A relative value resolves against the install root (matching the skill-bundles convention), so the documented shared/sops loads from <install>/shared/sops — the same directory the web/RPC SOP author writes to. An absolute or ~-prefixed value is used as-is. Unset by default; SOP runtime behavior activates only when this is set to a non-empty value, so leaving it unset (or an explicit empty value) keeps SOP loading disabled (unset/empty still falls back to <install>/shared/sops for offline CLI inspection).

default_execution_mode: String

Default execution mode for SOPs that omit execution_mode. Values: auto, supervised (default), step_by_step, priority_based, deterministic.

max_concurrent_total: usize

Maximum total concurrent SOP runs across all SOPs.

approval_timeout_secs: u64

Approval timeout in seconds. When a run waits for approval longer than this, the configured approval_timeout_action is applied (default escalate: re-surface the gate to the out-of-band approver and never self-approve). Set to 0 to disable the timeout sweep.

max_finished_runs: usize

Maximum number of finished runs kept in memory for status queries. Oldest runs are evicted when over capacity. 0 = unlimited.

maintenance_interval_secs: u64

How often (seconds) the daemon runs the SOP maintenance tick: fire fail-closed approval timeouts (per approval_timeout_secs / approval_timeout_action), reap expired concurrency-claim leases, and prune terminal runs past max_finished_runs. Default 60; set to 0 to disable the tick entirely. The tick itself self-approves nothing - timeout handling is governed by approval_timeout_action (default escalate).

persist_runs: bool

Persist run state durably across restarts. Default true: build_sop_engine selects the configured backend (sqlite) and in-flight runs - including runs parked at a HITL approval - survive a restart. This is the durable substrate the HITL admission model relies on so a pending approval is not lost when the daemon restarts. Set to false to opt back into ephemeral in-memory state.

run_store_backend: SopRunStoreBackend

Durable run-state backend when persist_runs is true: sqlite (default, durable) or memory (explicitly non-durable, for tests/degraded).

run_state_dir: Option<String>

Directory for the durable run store (created mode-0700). When omitted, <data_dir>/sop. Never OS-temp.

approval_mode: ApprovalMode

WHO may clear a SOP approval gate. Layered with execution_mode / priority / requires_confirmation (those still apply). Default both keeps today’s behavior (the agent tool OR an out-of-band principal can clear a gate).

approval_timeout_action: ApprovalTimeoutAction

What happens to a SOP gate that times out (after approval_timeout_secs). Default escalate is fail-closed: re-surface to the out-of-band approver and keep waiting, never self-approve. (The SOP-gate analog of the channel approval-routing fail-closed default; reconcile with that model if both land.)

approval: SopApprovalConfig

Approval broker policy config ([sop.approval]): named approver groups and per-name approval policies (required group + quorum + escalation route) the approval broker consumes for group-membership and quorum checks. Members are channel-provided identities (a gateway user, a forge login), so this is a permanent identity source, not a stopgap; a future auth system adds another resolver alongside it rather than replacing it. An empty block means no broker policy applies (approval_mode alone governs a gate, unchanged behavior).

step_scope_enforce: bool

Enforce per-step tool scope. Default false keeps tools: advisory.

step_mandatory_tools: Vec<String>

Tool names that remain available while step scope is enforced.

step_schema_enforce: bool

Enforce per-step input/output schemas when a step declares them.

max_step_visits: u32

Maximum times a routed SOP run can visit one step.

max_step_retries: u32

Maximum retries allowed by a step failure policy.

untrusted_payload_max_bytes: usize

Maximum bytes accepted from untrusted SOP trigger payload/topic content before char-boundary truncation. 0 disables the cap.

untrusted_input_guard: String

Prompt-guard action for untrusted SOP trigger input: warn, block, or sanitize.

untrusted_guard_sensitivity: f64

Prompt-guard and outbound-redaction sensitivity for untrusted SOP content.

untrusted_frame_warning: bool

Include the explanatory warning text inside untrusted-content frames. Boundary framing itself is always on once wired.

untrusted_outbound_redact: bool

Redact outbound SOP content before persistence/audit consumers write it. Intended to converge with the shared B/F redaction switch once those consumers land.

procedural_memory_enabled: bool

Enable SOP procedural-memory proposal tooling. Default false keeps self-modifying SOP write-back opt-in while the SOP subsystem is Experimental.

Implementations

impl SopConfig

pub fn configurable_prefix() -> &'static str

Returns the #[prefix] value for this Configurable struct.

pub fn init_requires_explicit_config() -> bool

True when this struct has a required leaf field that a bare/ancestor-prefix init_defaults scaffold must not materialize (it would fill the field with its Rust Default, which prune_empty_leaves then strips on save, leaving a partial sub-table that fails strict reload). Explicitly targeting this section (or a descendant of it) still scaffolds regardless of this flag, so the section can be materialized for the operator to fill in.

pub fn secret_fields(&self) -> Vec<SecretFieldInfo>

Returns metadata about all #[secret] fields on this struct and nested children.

pub fn secret_field_terminals() -> Vec<&'static str>

pub fn encrypt_secrets(&mut self, store: &SecretStore) -> Result<(), Error>

Encrypt all secret fields in place using the provided store.

pub fn decrypt_secrets(&mut self, store: &SecretStore) -> Result<(), Error>

Decrypt all secret fields in place using the provided store.

pub fn set_secret(&mut self, name: &str, value: String) -> Result<(), Error>

Set a secret field by its full dotted name, dispatching to nested children.

pub fn prop_fields(&self) -> Vec<PropFieldInfo>

Returns metadata about all property fields on this struct and nested children.

pub fn get_prop(&self, name: &str) -> Result<String, Error>

Get a property value by its full dotted name, returning it as a display string.

pub fn set_prop(&mut self, name: &str, value_str: &str) -> Result<(), Error>

Set a property value by its full dotted name, parsing from string.

pub fn prop_is_secret(name: &str) -> bool

Check if a property name refers to a secret field (static, no instance needed).

pub fn init_defaults(&mut self, prefix: Option<&str>) -> Vec<&'static str>

Instantiate None nested sections whose prefix matches. Returns the prefixes that were initialized.

pub fn map_key_sections() -> Vec<MapKeySection>

Enumerate every map-keyed (HashMap<String, T>) and list-shaped (Vec<T>) section discoverable from this Configurable’s tree. The dashboard / CLI consume this to surface “+ Add” affordances without hardcoding the section list.

pub fn nested_section_help(name: &str) -> Option<&'static str>

Help blurb for a #[nested] field on this struct, sourced from the field-level /// docstring. Returns None for unknown names so callers can fall through to a different lookup.

pub fn nested_section_group(name: &str) -> Option<&'static str>

pub fn get_map_keys(&self, section_path: &str) -> Option<Vec<String>>

Return the current alias keys at section_path, or None if the path doesn’t resolve to a map-keyed section in this tree.

pub fn nested_option_entries(&self) -> Vec<NestedOptionEntry>

pub fn create_map_key( &mut self, section_path: &str, map_key: &str, ) -> Result<bool, String>

pub fn delete_map_key( &mut self, section_path: &str, map_key: &str, ) -> Result<bool, String>

pub fn rename_map_key( &mut self, section_path: &str, map_key: &str, new_key: &str, ) -> Result<bool, String>

impl SopConfig

pub fn runtime_enabled(&self) -> bool

Whether the SOP runtime (engine, tools, maintenance tick, run store) is active for this config. SOP loading is gated on a concrete definitions directory: a non-empty sops_dir enables it; an unset or explicit empty string keeps it disabled (the default is unset, so SOP runtime is off until an operator opts in). This is the single source of truth for activation, so callers must not re-derive it from sops_dir.is_some() — that treats an empty string as enabled and would break the disable path.

Trait Implementations

impl Clone for SopConfig

fn clone(&self) -> SopConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SopConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for SopConfig

fn default() -> SopConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SopConfig

fn deserialize<__D>( __deserializer: __D, ) -> Result<SopConfig, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for SopConfig

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl MaskSecrets for SopConfig

fn mask_secrets(&mut self)

fn restore_secrets_from(&mut self, current: &SopConfig)

impl Serialize for SopConfig

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.