Module config 

Harness configuration (TOML surface, versioned).

Structs

AuthzenConfig

External AuthZEN policy decision point (Authorization API 1.0).

BackendConfig

Per-backend routing configuration (pillar 4).

HarnessConfig

Top-level harness configuration.

IntrospectionTokenConfig

Backend credential for introspection, separate from upstream credentials.

MissionConfig

Mission configuration: narrows the static policy for a time window.

OperatorTokenConfig

Operator credential for administrative revocation.

ResolvedBackends

All four backend selections resolved into their typed forms.

WorkloadIdentityConfig

[workload_identity] settings.

WorkloadMapping

One [[workload_identities]] entry.

Enums

BackendAuth

Authentication mode for a backend.

BackendTransport

Wire protocol spoken to a tool backend.

BridgeBackend

Typed bridge backend selection, resolved from the flat TOML fields.

ConfigSource

Where the effective configuration came from.

EmbedderBackend

Typed embedding backend selection. See BridgeBackend.

StateBackend

Typed state backend selection. See BridgeBackend for why the TOML surface stays flat while the resolved form is an enum.

TenantContent

Content exported to the tenant OTEL endpoint.

VectorBackend

Typed vector persistence backend selection. See BridgeBackend.

Constants

CONFIG_SEARCH_PATHS

Well-known config locations probed in order when AV_CONFIG is unset. Project-local files (current directory) beat the per-user file the avctl setup wizard writes (see user_config_path).

CONFIG_VERSION

Config format version (evolution surface).

DEFAULT_MCP_REQUEST_TIMEOUT_S

Total deadline for an outbound MCP request, including its response body.

DEFAULT_UPSTREAM_READ_TIMEOUT_S

Default upstream read-idle timeout. Successful reads restart this timer; it is not a total deadline for streamed chat responses.

MAX_MCP_CONCURRENCY

Upper bound on mcp_concurrency (R71). Each admitted MCP call can buffer up to MAX_TOOL_RESPONSE_BYTES = 16 MiB in read_limited_tool_response (routes.rs), so the cap × 16 MiB bounds worst-case MCP resident memory. 4 096 × 16 MiB = 64 GiB worst case — a soft ceiling: operators typically want much less, and a fat-finger config like mcp_concurrency = 100_000 would otherwise silently commit the runtime to a memory pressure model no real host survives. Defence-in-depth like MAX_WORKER_CHANNEL_CAPACITY.

MAX_ONNX_DIMENSION

Upper bound on onnx_dimension. Most sentence-transformer models have <= 4096 dims (Nomic Embed v1.5 = 768, MiniLM = 384, e5-mistral = 4096, Ada-002 = 1536). 16k is a comfortable ceiling.

MAX_REQUEST_BYTES_CAP

Upper bound on max_request_bytes (512 MiB). A single request body should never legitimately need more; lifting this defeats the sandbox payload guard and lets one request pin half a GB of RAM.

MAX_SECONDS_INTERVAL

Upper bound on any _s seconds interval. 1 day is already far beyond any reasonable value; anything larger is almost certainly a unit-conversion error (someone thought the field was in ms).

MAX_WORKER_CHANNEL_CAPACITY

Upper bound on worker_channel_capacity. tokio::sync::mpsc::channel does not preallocate slots (it links chunks lazily under a Semaphore), but an oversized value still lets the per-shard buffers grow unboundedly under overload and hides real backpressure signals. 1M is orders of magnitude above realistic capacity — this bound is defence-in-depth against a fat-finger, not a hard OOM prevention.

OTEL_FLUSH_SECS

Deadline the OpenTelemetry provider gets to flush pending spans on shutdown when the otel feature is enabled. Same “single source of truth” purpose as WORKER_FINALIZE_PHASE_SECS.

WORKER_FINALIZE_PHASE_SECS

Per-phase timeout applied to both the worker wait_idle drain and the finalize_sessions sweep in finish_shutdown. Exposed on the public surface so the deployment-manifest pin tests below can compute the total shutdown budget from the SAME source of truth main.rs uses — a bump here that isn’t matched by a bump in the K8s / compose grace periods trips CI at build time.

Functions

load_config

Load, apply environment overrides, and validate the effective config.

load_config_with_override

load_config with an explicit config path (e.g. from --config) taking precedence over $AV_CONFIG and the search paths. The explicit path must exist — a dangling operator-supplied path is a hard error, never a silent fallback to a different config.

resolve_config_source

Resolve the configuration source without reading it.

user_config_path

Per-user config file (~/.agentvisor/agentvisor.toml), if the home directory is known.

user_config_path_from

Per-user config file inside home, as written by the avctl wizard.