The checked-in presets are operator-profile starting points for the current typed monotone-DAG runtime. Each is validated by the same configuration constructor used at startup.
| Preset | Intended use |
|---|---|
quickstart-dev.toml | Loopback onboarding and local smoke evidence. |
default-recommended.toml | Conservative standalone OSS baseline. |
hardened.toml | Tighter local limits and fail-closed operator defaults. |
container-prod.toml | Container server wiring with explicit auth/TLS assumptions. |
ci-release-gate.toml | Deterministic release-gate test profile. |
Permanent limit law
The [value_limits] profile may only narrow immutable DgValueFormatV1
ceilings. A scenario may narrow the validated operator profile again. Neither
configuration nor a scenario can make a structurally invalid value valid.
Live operation budgets, overload, and timeouts are separate operational
failures and mint no evidence.
Local acquisition
The current configuration admits only:
[local_acquisition]
maximum_operations = 32
maximum_concurrency = 1
[[local_acquisition.time_authorities]]
authority_id = "operator-clock"
authority_revision = "0000000000000000000000000000000000000000000000000000000000000000"
resolution_nanoseconds = 1000000
uncertainty_nanoseconds = 1000000
[[local_acquisition.environment_snapshots]]
authority_id = "startup-env"
authority_revision = "0000000000000000000000000000000000000000000000000000000000000000"
allowlisted_keys = ["DEPLOY_ENV"]
[[local_acquisition.document_roots]]
root_id = "release-evidence"
root_revision = "0000000000000000000000000000000000000000000000000000000000000000"
absolute_root = "/var/lib/decision-gate/evidence"
Authority lists are empty by default. Add only exact sources required by admitted scenario bindings. Environment values are captured once at startup; document access is capability-rooted and rejects traversal, symlinks, special files, unsafe YAML, and unbounded input.
There is no [providers], [provider_discovery], trust-lane, anchor, network,
subprocess, remote-MCP, native-plugin, or remote-evaluator configuration seam.
MCP server HTTP/SSE transport is only the caller-to-DG tool boundary.
Validate
cargo run -p decision-gate-cli -- config validate \
--config configs/presets/default-recommended.toml
Use Docs/configuration/decision-gate.toml.md and the generated configuration
schema as the exact field authority. A preset is not evidence that PF-03/PF-04,
deployment, or release qualification is complete.