core/core/config.py

from __future__ import annotations

from dataclasses import dataclass


@dataclass(frozen=True, slots=True)
class RuntimeConfig:
    # ADR-0063 — ``en_core_relations_v1`` (kinship starter pack) joins the
    # default mount once the cross-pack surface resolver lands.  Pack
    # composers in :mod:`chat.pack_grounding` now consult
    # :mod:`chat.pack_resolver`, so kinship lemmas ground deterministically
    # without a separate composer module.
    input_packs: tuple[str, ...] = (
        "en_minimal_v1",
        "en_core_cognition_v1",
        "en_core_meta_v1",
        "en_core_attitude_v1",
        "en_core_temporal_v1",
        "en_core_action_v1",
        "en_core_quantitative_v1",
        "en_core_spatial_v1",
        "en_core_causation_v1",
        "en_core_polarity_v1",
        "en_core_relations_v1",
        "en_core_relations_v2",
        "he_logos_micro_v1",
        "grc_logos_micro_v1",
    )
    output_language: str = "en"
    frame_pack: str = "en"
    max_tokens: int = 32
    allow_cross_language_recall: bool = True
    allow_cross_language_generation: bool = False
    vault_reproject_interval: int = 20
    use_salience: bool = True
    salience_top_k: int = 16
    inhibition_threshold: float = 0.3
    inner_loop_admissibility: bool = False
    admissibility_threshold: float = 0.0
    # ADR-0026 / Phase 3 — margin-based admissibility.  ``mode``
    # selects between ADR-0024's per-candidate threshold check and
    # the ranked-with-margin check.  Default "threshold" preserves
    # ADR-0024 acceptance evidence; opt-in "margin" replaces the
    # static-threshold gate with a scale-invariant margin.
    admissibility_mode: str = "threshold"
    admissibility_margin: float = 0.4
    # ADR-0027 — Identity pack id loaded at runtime startup.  Empty string
    # resolves to ``DEFAULT_IDENTITY_PACK``.  CLI override on chat:
    # ``core chat --identity <pack_id>``.  See docs/identity_packs.md.
    identity_pack: str = ""
    # ADR-0033 — Ethics pack id loaded at runtime startup.  Empty string
    # resolves to ``DEFAULT_ETHICS_PACK``.  See docs/ethics_packs.md.
    ethics_pack: str = ""
    # ADR-0046 / ADR-0047 — forward graph constraint.  When True, the
    # PropositionGraph built from the classified intent + articulation
    # plan is converted into an AdmissibilityRegion BEFORE generate()
    # runs (Pillar 1→2→3 coupling closes on the live path).  Default
    # False preserves existing behavior during the transition window —
    # ADR-0024's honest-refusal exhaustion is the correct response when
    # the constraint geometry and the walk candidate pool do not
    # intersect, but operators must opt in to observing that behavior
    # on their workloads.  Enable to live the forward constraint;
    # disable to retain the pre-ADR-0046 unconstrained walk.
    forward_graph_constraint: bool = False

    # ADR-0062 — composed teaching-grounded surface.  When enabled,
    # the teaching-grounded composer extends a single-chain surface
    # with a follow-up chain whose subject equals the initial chain's
    # object — producing surfaces like "light reveals truth, which
    # grounds knowledge" instead of just "light reveals truth".
    # Default False preserves all pre-ADR-0062 behaviour.  Cycle-safe
    # (won't follow if the next subject has been visited), bounded
    # depth (max one follow-up chain in v1).
    composed_surface: bool = False

    # ADR-0083 — transitive (multi-hop) teaching-grounded surface.
    # Strict superset of ADR-0062's depth-1 composer: iterates the
    # per-hop follow-up resolution under a visited-set guard, so the
    # surface can extend beyond a single follow-up chain.
    # ``transitive_max_depth`` is the maximum number of follow-up hops
    # to append beyond the initial chain.  At ``max_depth=0``
    # byte-identical to the single-chain surface; at ``max_depth=1``
    # byte-identical to ADR-0062's composed surface; at
    # ``max_depth=2`` byte-identical to ADR-0062 when no second hop
    # exists, strict superset when one does.  When True, this
    # supersedes ``composed_surface``.  Cycle-safe across every depth
    # (visited-set covers ADR-0062's 1-step cycle guard).  Single-
    # corpus traversal in v1; cross-corpus transitive is deferred to
    # a follow-up ADR.
    transitive_surface: bool = False
    transitive_max_depth: int = 2

    # ADR-0085 — gloss-aware CAUSE surface.  When True, IntentTag.CAUSE
    # consults the subject lemma's gloss first and emits an explanation-
    # shaped sentence drawn from the gloss text, falling through to
    # the chain-walk ``teaching_grounded_surface*`` only when no gloss
    # exists for the lemma.  Default False preserves the pre-ADR-0085
    # chain-walk surface byte-identically (null-drop invariant).
    gloss_aware_cause: bool = False

    # ADR-0087 — rhetorical-style selection axis (substrate phase).
    # ``None`` resolves to ``DEFAULT_RHETORICAL_STYLE_PACK`` per the
    # mounting discipline, which is the null-lift baseline.  No
    # composer or realizer reads this field yet — that wiring is the
    # consumer ADR's job.  The field is declared here so the runtime
    # interface is stable when the consumer lands.
    rhetorical_style_id: str | None = None

    # ADR-0066 / P3.2 — opt-in thread anaphora.  When enabled, the
    # runtime prepends a deterministic backreference to a recent
    # grounded turn when the current turn's subject lemma matches
    # one in the bounded session-thread context.  Engages only on
    # pack/teaching-tier turns (both prior and current); weaker
    # tiers do not anchor.  Default False preserves every pre-P3.2
    # surface byte-identically.
    thread_anaphora: bool = False

    # Discourse planner (step 5 of the discourse-planner sequencing).
    # When True, the runtime builds a deterministic DiscoursePlan via
    # ``generate.discourse_planner.plan_discourse`` from a
    # ``GroundingBundle`` assembled by ``generate.grounding_accessors``
    # and renders it as multi-clause output.  Mode selection comes from
    # ``generate.intent.classify_response_mode``; BRIEF mode is
    # byte-identical to today's single-sentence pack-grounded surface
    # because the runtime hook (``_maybe_apply_discourse_planner``)
    # returns ``None`` when the rendered plan has <= 1 move — single-
    # fact prompts get exactly the same surface and trace_hash as
    # the planner-off path.
    #
    # Default flipped to True 2026-05-21: cognition eval (45 cases)
    # was verified byte-identical across both projections (surface
    # AND trace_hash) flag-OFF vs flag-ON, so single-fact prompts are
    # not perturbed.  The flag's value shows up on NARRATIVE / EXAMPLE
    # / PARAGRAPH / EXPLAIN modes and compound prompts that the flat
    # classifier currently misclassifies as OOV — those turns become
    # multi-clause grounded articulations rather than single-fragment
    # disclosures or OOV refusals.
    discourse_planner: bool = True

    # Phase 3 — plan-level contemplation pre-flight.  When True, after
    # the discourse planner produces a plan (and before the renderer
    # fires) the runtime runs ``core.contemplation.plan_preflight.
    # contemplate_plan`` over the plan and stores any SPECULATIVE
    # findings on the runtime for downstream consumption.  Per
    # ADR-0080: contemplation is read-only and SPECULATIVE-only — no
    # plan mutation, no autonomous memory promotion.  Findings flow
    # into the offline contemplation miner (Phase 5) for review-gated
    # pack-mutation candidates.  Default False keeps the contemplation
    # opt-in until the operator wires the downstream sink.
    discourse_contemplation: bool = False

    # ADR-0068 / ADR-0069 — register pack id loaded at runtime startup.
    # ``None`` resolves to ``RegisterPack.unregistered()`` (the in-memory
    # null-register sentinel; structurally identical to
    # ``default_neutral_v1``).  At R2 the register is loaded, stored, and
    # threaded through every realizer call site, but no composer consumes
    # it — the three byte-identity invariants (None ≡ default_neutral_v1
    # ≡ pre-R2 output) are CI-pinned by ``test_register_null_lift.py``.
    # R3 widens composers to dispatch on ``register.realizer_overrides``.
    register_pack_id: str | None = None
    # ADR-0073b — anchor-lens pack id loaded at runtime startup.
    # ``None`` resolves to ``AnchorLens.unanchored()`` (the in-memory
    # null-lens sentinel; structurally identical to
    # ``default_unanchored_v1``).  At L1.2 the lens is loaded and
    # stored on the runtime, but no composer consumes it — the
    # ``anchor_lens_byte_identity_null_lift`` invariant (None ≡
    # default_unanchored_v1) is CI-pinned by
    # ``test_anchor_lens_null_lift.py``.  L1.3 will widen composers
    # to dispatch on ``anchor_lens.semantic_domain_preferences``.
    anchor_lens_id: str | None = None

    # Finding 6 (audit 2026-05-20) — generation stop tokens.
    #
    # ``None`` resolves to ``generate.stream._STOP_TOKENS`` (the
    # historical ``frozenset({"it", "to", "word"})``) so every
    # pre-Finding-6 caller preserves byte-identity.  Operators that
    # mount a pack where one of the historical stop tokens carries
    # meaningful content (e.g. a philosophy pack where ``word`` maps
    # to λόγος, a syntax pack where ``to`` is a content node) can
    # override the set here to free them.  Manifest-driven
    # per-pack override (``generation_stop_tokens`` field in the pack
    # manifest) is the natural next step; that requires a pack-
    # schema ADR and re-ratification so the wiring lands first.
    stop_tokens: tuple[str, ...] | None = None

    # ADR-0088 Phase B (audit Finding 2, 2026-05-20) — realizer becomes
    # a real surface authority by grounding the proposition graph from
    # the recall step's walk tokens before invoking
    # ``realize_semantic``.  Default ``False`` preserves byte-identity
    # for every existing pack and test — the pipeline's
    # ``realize_semantic`` call continues to fire on the ungrounded
    # graph, which produces ``<pending>`` / ``...`` surfaces that the
    # ``_is_useful_surface`` gate rejects, leaving the runtime path's
    # ADR-0085-polished pack-grounded surface as the user-visible
    # answer (same as today).
    #
    # When True the pipeline reorders ``realize_semantic`` to run
    # AFTER ``runtime.chat``, calls ``ground_graph(graph,
    # response.recalled_words)`` to fill the ``<pending>`` slots, then
    # re-invokes ``realize_semantic`` on the grounded graph.  The
    # surface resolver (PR #76) then picks the realizer's grounded
    # output when it clears ``_is_useful_surface`` and the unknown-
    # domain gate did not fire.
    #
    # NOTE — Phase A (realizer fluency parity: gloss-aware templates,
    # 3sg verb agreement, pack-provenance tag) is the prerequisite
    # for enabling this flag in production.  The known fluency gap
    # (e.g. ``"Light is a visible medium that reveal truth"``,
    # subject-verb disagreement) is documented in ADR-0088 §Phase A.
    # The wiring lands first so the runtime contract is stable when
    # Phase A's realizer fluency upgrade ships.
    realizer_grounded_authority: bool = False

    # ADR-0090 (audit Findings 6 + 7, 2026-05-21) — unified-ingest path.
    # Default ``False`` preserves bit-identical behavior with the
    # historical probe-then-commit path:
    #
    #   1. ``chat()`` calls ``probe_ingest(filtered)`` first.
    #   2. The gate observes ``probe_state.F``.
    #   3. If the gate fires, ``commit_ingest`` runs and a stub
    #      response returns.  If not, ``commit_ingest`` runs and
    #      drive bias is applied, producing a different field
    #      from the one the gate saw.
    #
    # The probe/commit distinction means the gate decides on one
    # manifold position and the walk navigates a slightly different
    # one — a coherence gap the second-opinion audit named.
    #
    # When ``True``:
    #
    #   1. ``chat()`` calls ``commit_ingest(filtered)`` first.
    #   2. Drive bias is applied immediately.
    #   3. The gate observes ``committed.F`` (the same field the walk
    #      will navigate on the non-stub path).
    #   4. ``probe_ingest`` is skipped entirely on this path.
    #
    # **Semantic change when True:** stub-path turns commit before
    # the stub response is generated.  Under ``False`` stub turns do
    # not commit at the time of the gate check (today's behavior).
    # Operators opt into the cleaner coherence by flipping the flag;
    # the unified path is not the default until validated against a
    # live workload.
    unified_ingest: bool = False


    # ADR-0144 — recognition-grounded articulation graph.  When True and a
    # DerivedRecognizer is attached to CognitiveTurnPipeline, the articulation
    # graph is derived from the admitted EpistemicNode via the connector rather
    # than from intent classification.  Default False preserves byte-identity
    # for every existing surface and trace_hash.
    recognition_grounded_graph: bool = False

    # W-016 — wire session vault (T1) into discovery contemplation.
    # When True, ChatRuntime builds a vault probe from the live session
    # vault and passes it to contemplate() in _emit_discovery_candidates.
    # The probe queries the vault at EpistemicStatus.COHERENT so only
    # reviewed-coherent session entries contribute evidence; SPECULATIVE /
    # CONTESTED / FALSIFIED entries are filtered by the vault layer per
    # ADR-0021 §3.  Default False preserves all pre-W-016 discovery
    # output byte-identically (null-drop invariant on discovery lanes).
    vault_probe_discoveries: bool = False
    # ADR-0148 — wire VaultPromotionPolicy into turn boundary.
    # When True, ChatRuntime calls vault.promote_eligible_entries() after each
    # finalize_turn(), scanning SPECULATIVE entries for crystallization to
    # COHERENT based on their energy profile (EnergyClass E0/E1, coherence_residual
    # ≤ 0.05).  Fresh entries written in the current turn are E2+ and will not
    # promote yet — the policy fires on entries that have cooled across turns.
    # Default False: zero behavior change when disabled (null-drop invariant).
    # Unlocks W-007 (DerivedRecognizer derivation from promoted COHERENT entries).
    vault_promotion_enabled: bool = False

    # ADR-0150 — run contemplation on pending discovery candidates at checkpoint.
    # Activates ADR-0056 Phase C1. Null-drop when False.
    auto_contemplate: bool = False

    # ADR-0151 — generate TeachingChainProposals from enriched candidates on load.
    auto_proposal_enabled: bool = False

    # Shape B+ (L10 resume-as-same-life) — persist and restore the FULL lived
    # session state (field, vault, anchor, graph, referents, dialogue) across
    # reboot, not just recognizers/candidates (Shape B). OFF by default: it is a
    # deliberate always-on-runtime mode, and per-turn snapshotting has an O(turns)
    # cost, so demos/evals/one-shot runtimes must not pay for resume they don't
    # use. Enabled by the L10 continuity lane and the production L10 process.
    persist_session_state: bool = False

    # L11 — on reboot, if the stamped checkpoint identity != the recomputed
    # engine identity (the ratified substrate changed during downtime), REFUSE to
    # start (raise IdentityContinuityError) rather than the default warn-and-flag.
    # OFF by default: reboot is recovery, not control flow (ADR-0157), and the
    # operator must not be bricked by a benign ratified pack swap. Deployments
    # wanting a hard identity-continuity guarantee opt in.
    strict_identity_continuity: bool = False

    # ADR-0244 §2.2 / §4a — operator-preservation identity gate. When on, the
    # per-turn identity check runs the metric-exact wave-field gate on the live
    # versor (final_state.F): subspace-leakage + signed self-alignment via
    # F aᵢ F̃, plus the boundary_ids intersection with the turn's safety/ethics
    # violations, and a fail-closed IdentityGateRefusal folded into the typed
    # refusal surface. OFF by default: the leakage threshold is provisional
    # (reuses alignment_threshold) until calibrated to γ_id in D4 Phase 3, and
    # the flag-off path is byte-identical to the pre-ADR-0244 advisory behavior
    # (legacy scalar-L2 identity score, no geometric refusal).
    identity_wave_gate: bool = False

    # ADR-0246 §3.7 — the fuller induced-action admit surface (d_orth, d_stab vs
    # locked H_id={I}, typed residual channels) layered on the wave gate. OFF by
    # default and NOT authorized for live activation: its thresholds are
    # UNCERTIFIED placeholders (only γ_id is certified) and the §6.3 discrimination
    # report shows it refuses benign and adversarial traffic alike on the declared
    # placeholder frame. Requires identity_wave_gate to also be on (it acts on the
    # live versor F). Flag-off is byte-identical to the D4 wave path.
    identity_action_surface: bool = False

    # Step B (inline realization) — when on, each turn ACCRUES knowledge into the
    # held self: a comprehensible declarative turn is realized into the session vault
    # (SPECULATIVE, as-told), and a comprehensible question turn is determined over
    # realized knowledge. This is the "one continuous life" telos made real — a
    # conversation accumulates knowledge it can recall and reason over. OFF by default
    # (one-shot/eval runtimes don't accrue); the production L10 process enables it
    # alongside persist_session_state so accrued facts survive reboot. Realization is
    # SESSION memory (immediate), NOT ratified learning — it proposes nothing; the
    # teaching/review HITL path is untouched.
    accrue_realized_knowledge: bool = False

    # Step D (CLOSE) — when on, idle_tick consolidates soundly-derived determinations
    # back into the held self: one semi-naive layer of the member/subset deductive
    # closure (member∘subset, subset∘subset — NEVER member∘member) per tick, each
    # derived edge proof_chain-verified, written as a SPECULATIVE realized record with
    # derived-provenance. This is how the loop "learns from determined facts": derive
    # once, remember, reach one hop further next tick — the directly answerable set
    # climbs monotonically to the deductive-closure fixed point. OFF by default; the
    # production L10 process enables it alongside accrue_realized_knowledge +
    # persist_session_state. SESSION memory (immediate), NOT reviewed/corpus learning —
    # no proposal coupling, the teaching/review HITL path is untouched. Bounded by the
    # same _SUBSUMPTION_SUBSET_FACT_BUDGET; converges (a saturated tick is a no-op).
    consolidate_determinations: bool = False

    # IT (proposal-review surface) — when on, idle_tick runs a READ-ONLY sub-pass that scans
    # the comprehension-failure proposal sink and surfaces a summary in
    # IdleTickResult.proposal_review. It NEVER mutates an artifact, sets did_work, checkpoints,
    # ratifies, mounts, or modifies readers; a reporter failure is captured, not propagated.
    # OFF by default — idle ticks don't pay for the scan unless a deployment wants the surface.
    review_pending_proposals: bool = False

    # PR-2 derived CLOSE proposal bridge — when on, after consolidation in idle_tick, scan
    # realized derived facts (member/subset + TRANSITIVE_PREDICATES) that carry proof-gated
    # Derivation (verdict="entailed", SPECULATIVE). Emit reviewable proposal-only artifacts
    # (source="derived_close_fact") to teaching/proposals/derived_close_facts/. Default off;
    # review-gated, no corpus mutation, no ratification, no COHERENT, no serving change.
    # Deterministic dedupe by (predicate, args, derivation, structure_key). Best-effort;
    # failures captured.
    review_derived_close_proposals: bool = False

    # Autonomous frontier contemplation (ADR-0080 into the idle loop) — when on, idle_tick
    # autonomously MINES its frontier-compare reports into persisted SPECULATIVE reviewable
    # findings (core.contemplation), so the always-on life proposes its own frontier without
    # a user turn. Idempotent per frontier (a mined frontier converges → no churn); the
    # findings are SPECULATIVE-only (ADR-0080: never COHERENT, never self-ratify), persisted
    # under <engine_state>/contemplation_runs/ as a reviewable artifact for later review
    # tooling — NOT yet surfaced in the existing HITL queue (a follow-up). OFF by default —
    # a deliberate learning-daemon mode.
    contemplate_frontier_during_idle: bool = False

    # Step E (ESTIMATION) — when on, a converse query the engine would otherwise REFUSE
    # (told p(a,b), asked p(b,a)) may be answered with a DISCLOSED [approximate] estimate
    # IF the predicate-class has earned the SERVE license on the ratified, committed
    # reliability ledger (ADR-0175 license_for, θ_SERVE=0.99) — routed through the
    # ADR-0206 govern_response/shape_surface bridge. OFF by default; only meaningful with
    # accrue_realized_knowledge (the estimate is computed in the accrual path). wrong=0 is
    # preserved by construction: an estimate is ALWAYS disclosed ([approximate]), never
    # asserted as fact, and is offered only for a class whose committed track record
    # clears the Wilson floor. Absent a cleared license -> STRICT refuse (the safe
    # default); the engine never raises its own ceiling.
    estimation_enabled: bool = False

    # ASK serving gate enable flag. When True, ASK serving is allowed.
    # Default False (dark).
    ask_serving_enabled: bool = False

    # VERIFIED serving gate enable flag. When True, VERIFIED serving is allowed.
    # Default False (dark).
    verified_serving_enabled: bool = False



DEFAULT_IDENTITY_PACK: str = "default_general_v1"
DEFAULT_ETHICS_PACK: str = "default_general_ethics_v1"
DEFAULT_REGISTER_PACK: str = "default_neutral_v1"
DEFAULT_ANCHOR_LENS: str = "default_unanchored_v1"
DEFAULT_CONFIG = RuntimeConfig()