Struct SopConfig 

pub struct SopConfig {

    pub sops_dir: Option<String>,
    pub default_execution_mode: String,
    pub max_concurrent_total: usize,
    pub approval_timeout_secs: u64,
    pub max_finished_runs: usize,
    pub maintenance_interval_secs: u64,
    pub persist_runs: bool,
    pub run_store_backend: SopRunStoreBackend,
    pub run_state_dir: Option<String>,
    pub approval_mode: ApprovalMode,
    pub approval_timeout_action: ApprovalTimeoutAction,
    pub approval: SopApprovalConfig,
    pub step_scope_enforce: bool,
    pub step_mandatory_tools: Vec<String>,
    pub step_schema_enforce: bool,
    pub max_step_visits: u32,
    pub max_step_retries: u32,
    pub untrusted_payload_max_bytes: usize,
    pub untrusted_input_guard: String,
    pub untrusted_guard_sensitivity: f64,
    pub untrusted_frame_warning: bool,
    pub untrusted_outbound_redact: bool,
    pub procedural_memory_enabled: bool,
}

Standard Operating Procedures engine configuration ([sop]).

The default_execution_mode field uses the SopExecutionMode type from sop::types (re-exported via sop::SopExecutionMode). To avoid circular module references, config stores it using the same enum definition.

Fields

sops_dir: Option<String>

Directory containing SOP definitions (subdirs with SOP.toml + SOP.md). Optional override. When omitted, the runtime and CLI both resolve the default <workspace>/sops; SOPs load from there whenever it exists.

default_execution_mode: String

Default execution mode for SOPs that omit execution_mode. Values: auto, supervised (default), step_by_step, priority_based, deterministic.

max_concurrent_total: usize

Maximum total concurrent SOP runs across all SOPs.

approval_timeout_secs: u64

Approval timeout in seconds. When a run waits for approval longer than this, the configured approval_timeout_action is applied (default escalate: re-surface the gate to the out-of-band approver and never self-approve). Set to 0 to disable the timeout sweep.

max_finished_runs: usize

Maximum number of finished runs kept in memory for status queries. Oldest runs are evicted when over capacity. 0 = unlimited.

maintenance_interval_secs: u64

How often (seconds) the daemon runs the SOP maintenance tick: fire fail-closed approval timeouts (per approval_timeout_secs / approval_timeout_action), reap expired concurrency-claim leases, and prune terminal runs past max_finished_runs. Default 60; set to 0 to disable the tick entirely. The tick itself self-approves nothing - timeout handling is governed by approval_timeout_action (default escalate).

persist_runs: bool

Persist run state durably across restarts. Default true: build_sop_engine selects the configured backend (sqlite) and in-flight runs - including runs parked at a HITL approval - survive a restart. This is the durable substrate the HITL admission model relies on so a pending approval is not lost when the daemon restarts. Set to false to opt back into ephemeral in-memory state.

run_store_backend: SopRunStoreBackend

Durable run-state backend when persist_runs is true: sqlite (default, durable) or memory (explicitly non-durable, for tests/degraded).

run_state_dir: Option<String>

Directory for the durable run store (created mode-0700). When omitted, <data_dir>/sop. Never OS-temp.

approval_mode: ApprovalMode

WHO may clear a SOP approval gate. Layered with execution_mode / priority / requires_confirmation (those still apply). Default both keeps today’s behavior (the agent tool OR an out-of-band principal can clear a gate).

approval_timeout_action: ApprovalTimeoutAction

What happens to a SOP gate that times out (after approval_timeout_secs). Default escalate is fail-closed: re-surface to the out-of-band approver and keep waiting, never self-approve. (The SOP-gate analog of the channel approval-routing fail-closed default; reconcile with that model if both land.)

approval: SopApprovalConfig

Approval broker policy config ([sop.approval]): named approver groups and per-name approval policies (required group + quorum + escalation route) the approval broker consumes for group-membership and quorum checks. Members are channel-provided identities (a gateway user, a forge login), so this is a permanent identity source, not a stopgap; a future auth system adds another resolver alongside it rather than replacing it. An empty block means no broker policy applies (approval_mode alone governs a gate, unchanged behavior).

step_scope_enforce: bool

Enforce per-step tool scope. Default false keeps tools: advisory.

step_mandatory_tools: Vec<String>

Tool names that remain available while step scope is enforced.

step_schema_enforce: bool

Enforce per-step input/output schemas when a step declares them.

max_step_visits: u32

Maximum times a routed SOP run can visit one step.

max_step_retries: u32

Maximum retries allowed by a step failure policy.

untrusted_payload_max_bytes: usize

Maximum bytes accepted from untrusted SOP trigger payload/topic content before char-boundary truncation. 0 disables the cap.

untrusted_input_guard: String

Prompt-guard action for untrusted SOP trigger input: warn, block, or sanitize.

untrusted_guard_sensitivity: f64

Prompt-guard and outbound-redaction sensitivity for untrusted SOP content.

untrusted_frame_warning: bool

Include the explanatory warning text inside untrusted-content frames. Boundary framing itself is always on once wired.

untrusted_outbound_redact: bool

Redact outbound SOP content before persistence/audit consumers write it. Intended to converge with the shared B/F redaction switch once those consumers land.

procedural_memory_enabled: bool

Enable SOP procedural-memory proposal tooling. Default false keeps self-modifying SOP write-back opt-in while the SOP subsystem is Experimental.

Implementations

impl SopConfig

pub fn configurable_prefix() -> &'static str

Returns the #[prefix] value for this Configurable struct.

pub fn secret_fields(&self) -> Vec<SecretFieldInfo>

Returns metadata about all #[secret] fields on this struct and nested children.

pub fn secret_field_terminals() -> Vec<&'static str>

pub fn encrypt_secrets(&mut self, store: &SecretStore) -> Result<()>

Encrypt all secret fields in place using the provided store.

pub fn decrypt_secrets(&mut self, store: &SecretStore) -> Result<()>

Decrypt all secret fields in place using the provided store.

pub fn set_secret(&mut self, name: &str, value: String) -> Result<()>

Set a secret field by its full dotted name, dispatching to nested children.

pub fn prop_fields(&self) -> Vec<PropFieldInfo>

Returns metadata about all property fields on this struct and nested children.

pub fn get_prop(&self, name: &str) -> Result<String>

Get a property value by its full dotted name, returning it as a display string.

pub fn set_prop(&mut self, name: &str, value_str: &str) -> Result<()>

Set a property value by its full dotted name, parsing from string.

pub fn prop_is_secret(name: &str) -> bool

Check if a property name refers to a secret field (static, no instance needed).

pub fn init_defaults(&mut self, prefix: Option<&str>) -> Vec<&'static str>

Instantiate None nested sections whose prefix matches. Returns the prefixes that were initialized.

pub fn map_key_sections() -> Vec<MapKeySection>

Enumerate every map-keyed (HashMap<String, T>) and list-shaped (Vec<T>) section discoverable from this Configurable’s tree. The dashboard / CLI consume this to surface “+ Add” affordances without hardcoding the section list.

pub fn nested_section_help(name: &str) -> Option<&'static str>

Help blurb for a #[nested] field on this struct, sourced from the field-level /// docstring. Returns None for unknown names so callers can fall through to a different lookup.

pub fn nested_section_group(name: &str) -> Option<&'static str>

pub fn get_map_keys(&self, section_path: &str) -> Option<Vec<String>>

Return the current alias keys at section_path, or None if the path doesn’t resolve to a map-keyed section in this tree.

pub fn nested_option_entries(&self) -> Vec<NestedOptionEntry>

pub fn create_map_key( &mut self, section_path: &str, map_key: &str, ) -> Result<bool, String>

pub fn delete_map_key( &mut self, section_path: &str, map_key: &str, ) -> Result<bool, String>

pub fn rename_map_key( &mut self, section_path: &str, map_key: &str, new_key: &str, ) -> Result<bool, String>

Trait Implementations

impl Clone for SopConfig

fn clone(&self) -> SopConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SopConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SopConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SopConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for SopConfig

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl MaskSecrets for SopConfig

fn mask_secrets(&mut self)

fn restore_secrets_from(&mut self, current: &Self)

impl Serialize for SopConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.