Struct AppConfig 

pub struct AppConfig {

    pub tier: Option<String>,
    pub db: Option<String>,
    pub ollama_url: Option<String>,
    pub embed_url: Option<String>,
    pub embedding_model: Option<String>,
    pub llm_model: Option<String>,
    pub auto_tag_model: Option<String>,
    pub cross_encoder: Option<bool>,
    pub default_namespace: Option<String>,
    pub max_memory_mb: Option<usize>,
    pub ttl: Option<TtlConfig>,
    pub archive_on_gc: Option<bool>,
    pub api_key: Option<String>,
    pub archive_max_days: Option<i64>,
    pub identity: Option<IdentityConfig>,
    pub scoring: Option<RecallScoringConfig>,
    pub autonomous_hooks: Option<bool>,
    pub logging: Option<LoggingConfig>,
    pub audit: Option<AuditConfig>,
    pub boot: Option<BootConfig>,
    pub mcp: Option<McpConfig>,
    pub permissions: Option<PermissionsConfig>,
    pub transcripts: Option<TranscriptsConfig>,
    pub hooks: Option<HooksConfig>,
    pub subscriptions: Option<SubscriptionsConfig>,
    pub verify: Option<VerifyConfig>,
    pub postgres_statement_timeout_secs: Option<u64>,
    pub postgres_pool_max_connections: Option<u32>,
    pub postgres_pool_min_connections: Option<u32>,
    pub postgres_acquire_timeout_secs: Option<u64>,
    pub request_timeout_secs: Option<u64>,
    pub llm_call_timeout_secs: Option<u64>,
    pub mcp_federation_forward_url: Option<String>,
    pub agents: Option<AgentsConfig>,
    pub governance: Option<GovernanceConfig>,
    pub confidence: Option<ConfidenceConfig>,
    pub admin: Option<AdminConfig>,
    pub schema_version: Option<u32>,
    pub llm: Option<LlmSection>,
    pub embeddings: Option<EmbeddingsSection>,
    pub reranker: Option<RerankerSection>,
    pub curator: Option<CuratorSection>,
    pub storage: Option<StorageSection>,
    pub limits: Option<LimitsSection>,
}

Persistent configuration loaded from ~/.config/ai-memory/config.toml.

All fields are optional — CLI flags override file values, which override compiled defaults.

Fields

tier: Option<String>

Feature tier: keyword, semantic, smart, autonomous

db: Option<String>

Path to the SQLite database file

ollama_url: Option<String>

👎Deprecated since 0.7.0:

use the sectioned [llm].base_url / [embeddings].url (#1146); slated for removal in v0.8.0

Ollama base URL for LLM generation (default: http://localhost:11434)

DOC-6 (FX-C4-batch2, 2026-05-26): legacy flat field, slated for removal in v0.8.0. Use the sectioned [llm].base_url / [embeddings].url shape from #1146 instead. Run ai-memory config migrate to rewrite legacy configs.

embed_url: Option<String>

👎Deprecated since 0.7.0:

use [embeddings].url (#1146); slated for removal in v0.8.0

Separate URL for embedding model (defaults to ollama_url if unset)

DOC-6: legacy; use [embeddings].url.

embedding_model: Option<String>

👎Deprecated since 0.7.0:

use [embeddings].model (#1146); slated for removal in v0.8.0

Embedding model override: mini_lm_l6_v2 or nomic_embed_v15

DOC-6: legacy; use [embeddings].model.

llm_model: Option<String>

👎Deprecated since 0.7.0:

use [llm].model (#1146); slated for removal in v0.8.0

LLM model override (Ollama tag, e.g. “gemma4:e2b”)

DOC-6: legacy; use [llm].model.

auto_tag_model: Option<String>

👎Deprecated since 0.7.0:

use [llm.auto_tag].model (#1146); slated for removal in v0.8.0

Dedicated model for auto_tag (and other short-structured LLM calls). Defaults to gemma3:4b (fast, deterministic, ~0.7s p50 vs 15s for thinking-mode Gemma 4). Falls back to llm_model if unset. See L15 patch (2026-05-11) for rationale.

DOC-6: legacy; use [llm.auto_tag].model.

cross_encoder: Option<bool>

👎Deprecated since 0.7.0:

use [reranker].enabled (#1146); slated for removal in v0.8.0

Enable cross-encoder reranking (true/false)

DOC-6: legacy; use [reranker].enabled.

default_namespace: Option<String>

👎Deprecated since 0.7.0:

use [storage].default_namespace (#1146); slated for removal in v0.8.0

Default namespace for new memories

DOC-6: legacy; use [storage].default_namespace.

max_memory_mb: Option<usize>

👎Deprecated since 0.7.0:

auto-tier resolution now resolves via the sectioned [storage] block (#1146); slated for removal in v0.8.0

Maximum memory budget in MB (used for auto tier selection)

DOC-6: legacy; the auto-tier path now resolves via the sectioned [storage] block.

ttl: Option<TtlConfig>

Per-tier TTL overrides

archive_on_gc: Option<bool>

👎Deprecated since 0.7.0:

use [storage].archive_on_gc (#1146); slated for removal in v0.8.0

Archive memories before GC deletion (default: true)

DOC-6: legacy; use [storage].archive_on_gc.

api_key: Option<String>

Optional API key for HTTP API authentication.

#1262 — skip_serializing prevents the secret from being echoed back through any serde_json::to_string(&AppConfig) path (capabilities overlays, debug dumps, audit traces). #1454 — the manual Debug impl on AppConfig (just below the struct) renders this field as <redacted>, so a {:?} of the config never leaks the secret either (skip_serializing only guards the serde JSON path, not Debug). #1258 — AppConfig::zeroize_secrets (a free helper method, NOT a blanket Drop impl) zeroizes this buffer; callers invoke it immediately before scope-exit. A blanket Drop is deliberately avoided so the ..AppConfig::default() struct-update spread used across ~20 test sites still compiles.

archive_max_days: Option<i64>

👎Deprecated since 0.7.0:

archive purge resolution moves under the sectioned [storage] block (#1146); slated for removal in v0.8.0

Maximum archive age in days for automatic purge during GC (default: disabled)

DOC-6: legacy; the archive purge knob resolves via the sectioned [storage] block at v0.7.x.

identity: Option<IdentityConfig>

Identity-resolution overrides (Task 1.2 follow-up #198).

scoring: Option<RecallScoringConfig>

Recall scoring — per-tier half-life for time-decay, and legacy_scoring kill switch (v0.6.0.0).

autonomous_hooks: Option<bool>

v0.6.0.0: when true, fire LLM autonomy hooks (auto_tag + detect_contradiction) synchronously on every successful memory_store. Off by default — the hook blocks store latency behind an Ollama round-trip. AI_MEMORY_AUTONOMOUS_HOOKS=1 env var overrides the config file.

logging: Option<LoggingConfig>

v0.6.3.1 (PR-5 / issue #487) — operational logging facility. Default-OFF for privacy; opt-in turns on the rolling file appender that captures every tracing::* call site to disk.

audit: Option<AuditConfig>

v0.6.3.1 (PR-5 / issue #487) — security audit trail. Default-OFF for privacy; opt-in emits a hash-chained, tamper-evident JSON log of every memory mutation suitable for SIEM ingestion and SOC2 / HIPAA / GDPR / FedRAMP compliance evidence.

boot: Option<BootConfig>

v0.6.3.1 (PR-9h / issue #487 PR #497 req #73) — boot privacy kill-switch. Default-ON (existing users see no behavior change); [boot] enabled = false silences boot entirely (empty stdout + empty stderr, exit 0) for privacy-sensitive hosts where memory titles must not enter CI logs. [boot] redact_titles = true keeps the manifest header but replaces row titles with <redacted> for compliance contexts that need the audit-trail signal of “boot ran with N memories” without exposing subjects.

mcp: Option<McpConfig>

v0.6.4 — MCP server tunables. Today this only carries profile (the named tool surface). Future v0.6.4 phases add the [mcp.allowlist] per-agent capability table (Track D — v0.6.4-008).

permissions: Option<PermissionsConfig>

v0.7.0 K3 — [permissions] block. Drives the gate’s enforcement posture (enforce / advisory / off). When unset, the compiled default in PermissionsConfig::default applies (advisory — preserves the v0.6.x honest-disclosure posture where governance metadata was recorded but not blocked at the gate). New installs that want the strict gate set [permissions] mode = "enforce" explicitly.

transcripts: Option<TranscriptsConfig>

v0.7.0 I3 — [transcripts] block. Per-namespace TTL and archive-grace overrides for the transcript lifecycle sweeper. Unset → compiled defaults apply globally (DEFAULT_TRANSCRIPT_TTL_SECS / DEFAULT_TRANSCRIPT_ARCHIVE_GRACE_SECS).

hooks: Option<HooksConfig>

v0.7.0 K7 — [hooks] block. Currently carries the [hooks.subscription] hmac_secret server-wide override that signs every outgoing webhook payload regardless of whether the individual subscription supplied a per-subscription secret. When unset, only per-subscription secrets are used (legacy pre-K7 behaviour).

subscriptions: Option<SubscriptionsConfig>

v0.7.0 H11 (#628 blocker) — [subscriptions] block. Carries the allow_loopback_webhooks opt-in that re-enables loopback webhook URLs (127.0.0.1, localhost, [::1]). Default-OFF closes an authenticated SSRF gadget against local services (Postgres on 5432, the hooks daemon, etc.). Operators who need loopback for testing must set this explicitly.

verify: Option<VerifyConfig>

v0.7.0 H5 (round-2) — [verify] block. Today exposes one knob: require_nonce (default false). When true, every POST /api/v1/links/verify request MUST include a verification_nonce (UUID v4 expected); missing or replayed nonces are rejected with 409 Conflict. Default-OFF preserves the v0.6.x verify-anytime semantics for unmigrated clients.

postgres_statement_timeout_secs: Option<u64>

v0.7.0 M4 — connection-level statement_timeout (in seconds) applied via an after_connect hook to every postgres connection in the pool. Bounds runaway queries — a pathological pg_sleep(60) or an unbounded scan can otherwise wedge a connection forever. Defaults to 30s when unset; set to 0 to disable the limit (matches the postgres SET semantics). Operators only need to touch this when the workload requires long-running maintenance queries from the daemon itself.

postgres_pool_max_connections: Option<u32>

v0.7.0 (a) — connection-pool ceiling (sqlx max_connections) for the postgres backend. None selects the compiled DEFAULT_MAX_CONNECTIONS. Operators tune this per module/daemon without a recompile via AI_MEMORY_PG_POOL_MAX. Resolved by [AppConfig::resolve_pg_pool]; non-positive values fall through to the default.

postgres_pool_min_connections: Option<u32>

v0.7.0 (a) — connection-pool floor of always-open warm connections (sqlx min_connections). None selects the compiled DEFAULT_MIN_CONNECTIONS. Operator knob: AI_MEMORY_PG_POOL_MIN. Resolved by [AppConfig::resolve_pg_pool]; non-positive values fall through to the default.

postgres_acquire_timeout_secs: Option<u64>

v0.7.0 (a) — how long a pool acquire() waits for a free connection before erroring (sqlx acquire_timeout), in whole seconds. None selects the compiled default derived from DEFAULT_ACQUIRE_TIMEOUT. Operator knob: AI_MEMORY_PG_ACQUIRE_TIMEOUT_SECS. Resolved by [AppConfig::resolve_pg_pool]; non-positive values fall through to the default.

request_timeout_secs: Option<u64>

v0.7.0 H7 (round-2) — per-HTTP-request wall-clock timeout in seconds. Applied as a middleware to every axum route in crate::build_router so a slow-POST (slowloris-style) attacker cannot keep a handler scope alive indefinitely. None selects the compiled default of 60 seconds; operators who need a different ceiling set request_timeout_secs = <secs> in config.toml.

llm_call_timeout_secs: Option<u64>

v0.7.0 H8 (round-2) — per-LLM-call wall-clock timeout in seconds. Wraps every spawn_blocking invocation of an Ollama call (auto_tag, expand_query, summarize_memories, …) in tokio::time::timeout. None selects the compiled default of 30 seconds; on timeout the call falls back to the LLM-absent path (already exercised by L5/L7).

mcp_federation_forward_url: Option<String>

v0.7.0 (issue #318) — when set, the MCP stdio server forwards every write tool (memory_store, memory_link, memory_delete) to this HTTP endpoint (typically the local ai-memory serve daemon at http://localhost:9077) instead of writing to SQLite directly. The HTTP daemon then runs the existing broadcast_store_quorum / broadcast_link_quorum / etc. fanout, closing the gap surfaced by a2a-gate v0.6.0 r6 where MCP-stdio writes replicated locally but never reached the federation mesh.

Unset (the default) keeps the legacy direct-SQLite path so single-node MCP deployments without a federation daemon behave exactly as before. The forwarder uses reqwest::blocking and surfaces HTTP errors as MCP error strings; on transport failure the response carries the underlying error so operators can distinguish “fanout daemon not running” from “quorum not met”.

agents: Option<AgentsConfig>

v0.7.0 (issue #518) — [agents.defaults] block. Carries the recall_scope defaults spliced into memory_recall / GET /api/v1/recall / ai-memory recall requests that pass session_default=true (or --session-default on the CLI) and omit one or more filter fields. Closes the OpenClaw v0.6.3.1 “what were you working on?” recovery gap — agents picking up a new session no longer need to remember to splice the canonical namespace + recency filters on every cross-session recall.

None (the default) preserves single-tenant deployments and existing recall semantics exactly as-is. The splice happens in the handler before the storage call; explicit args always win over the defaults.

governance: Option<GovernanceConfig>

v0.7.0 SEC-2 (Cluster D, issue #767) — [governance] block. Today exposes one knob: require_operator_pubkey (default false). When true, daemon serve startup REFUSES to boot if the governance_rules table contains any enabled = 1 rows AND no operator pubkey is resolved (env var or ~/.config/ai-memory/operator.key.pub). Closes the fail-OPEN gap where a SQL-write gadget could install enabled = 1 rules that the pre-L1-6 loader would honour without signature check. Default false preserves the pre-cluster-D contract for the install-script deploy where no operator pubkey is yet on disk.

confidence: Option<ConfidenceConfig>

v0.7.0 Cluster G (#767) — [confidence] block. Carries the retention window for confidence_shadow_observations consumed by the periodic GC sweep (shadow_retention_days, default 30). Unset → the compiled default applies. Closes PERF-4: the v0.7.0 Form 5 closeout (#758) shipped the shadow-mode table but did NOT ship retention, so a long-running shadow-enabled deployment would see unbounded growth.

admin: Option<AdminConfig>

v0.7.0 SHIP cluster (#946 / #957 / #960 / #961, 2026-05-20) — [admin] top-level block. Carries the operator-configured allowlist of agent_ids whose authenticated HTTP requests are treated as admin-class callers (full cross-tenant visibility for endpoints that must observe corpus-scale metadata: GET /api/v1/export, GET /api/v1/agents, GET /api/v1/stats, the POST /api/v1/quota/status list path). None (the default) closes those endpoints to all non-admin callers — the safe-by-default posture per CLAUDE.md pm-v3. See AdminConfig for the full role-gate semantics.

schema_version: Option<u32>

v0.7.x (#1146) — explicit configuration schema version. None or 1 selects the v0.6.x flat-field parse path; 2 selects the sectioned parse path ([llm], [embeddings], [reranker], [storage]) and emits a WARN if any legacy flat field is also present. Future bumps (3, 4, …) introduce additional schema transitions and are gated through ai-memory config migrate.

llm: Option<LlmSection>

v0.7.x (#1146) — [llm] sectioned LLM configuration. Carries the canonical backend / model / base_url / api_key references consumed by every LLM-init surface (MCP stdio, HTTP daemon, ai-memory atomise, ai-memory curator, embed-client disambiguator, the boot banner). Resolved via AppConfig::resolve_llm; the resolver applies the uniform precedence ladder (CLI flag > AI_MEMORY_LLM_* env > [llm] section > legacy flat fields > compiled default).

Includes an optional [llm.auto_tag] sub-table for the fast structured-output sibling that handles auto_tag, query expansion, and contradiction detection — see LlmSection.

embeddings: Option<EmbeddingsSection>

v0.7.x (#1146) — [embeddings] sectioned embedding-model configuration. Consumed by the embedder bootstrap in daemon_runtime and the MCP embed-client fallback path. Resolved via AppConfig::resolve_embeddings.

reranker: Option<RerankerSection>

v0.7.x (#1146) — [reranker] sectioned cross-encoder configuration. Folds the legacy cross_encoder = bool knob into a { enabled, model } table with explicit model selection. Resolved via AppConfig::resolve_reranker.

curator: Option<CuratorSection>

#1671/n15 (v0.7.1) — [curator] per-namespace curator config. Carries the per-namespace reflection_pass.enabled gate that curator --reflect --all-namespaces consults (#1671 — without it --all-namespaces reflected nothing) and the per-namespace confidence_decay_half_life_days override the confidence-decay sweep consults (n15). Resolved via AppConfig::reflection_namespace_enabled and AppConfig::confidence_decay_half_life_for.

storage: Option<StorageSection>

v0.7.x (#1146) — [storage] sectioned storage configuration. Carries default_namespace, archive_on_gc, archive_max_days, max_memory_mb (folded from the previously-flat top-level fields). The db path stays top-level per the I4 carve-out in #1146 (path expansion semantics pinned by #507).

limits: Option<LimitsSection>

v0.7.x — [limits] sectioned operator-tunable capacity limits. Carries the per-(agent, namespace) daily memory-write quota, the lifetime storage cap, the daily link-creation quota, and the list/bulk request page-size cap. Resolved via AppConfig::resolve_limits; the resolver applies the uniform precedence ladder (AI_MEMORY_MAX_* env > [limits] section > compiled default). Defaults are deliberately generous so the substrate is invisible to small-scale operators; operators with high event-rate workloads raise them per-deployment without recompiling. See LimitsSection.

Implementations

impl AppConfig

pub fn zeroize_secrets(&mut self)

#1258 — manually zeroize the api_key buffer. Callers that hold the only owner of an AppConfig and are about to drop it invoke this immediately before scope-exit so the secret bytes do not linger on the heap. The free-standing helper (instead of a blanket Drop impl on AppConfig) preserves the ..AppConfig::default() struct-update syntax used by ~20 existing test sites; adding a blanket Drop would forbid the move-by-spread pattern Rust requires for Drop types.

impl AppConfig

pub fn effective_hooks_hmac_secret(&self) -> Option<String>

v0.7.0 K7 — resolved server-wide webhook HMAC secret. None means no server-wide override (per-subscription secrets still apply via the legacy code path).

pub fn effective_recall_scope(&self) -> Option<&RecallScope>

v0.7.0 (issue #518) — resolved [agents.defaults.recall_scope] block. Returns Some(&scope) when configured, None otherwise. Consumed by the recall handlers (sqlite + postgres SAL branches, MCP handle_recall, CLI cmd_recall) to splice defaults into requests that pass session_default=true and omit one or more filter fields.

pub fn effective_allow_loopback_webhooks(&self) -> bool

v0.7.0 H11 (#628 blocker) — resolved loopback-webhook opt-in flag. Defaults to false (loopback rejected — closes the authenticated SSRF gadget against local services). Operators who need loopback for testing set [subscriptions] allow_loopback_webhooks = true.

Resolution order (mirrors effective_permissions_mode):

1. AI_MEMORY_ALLOW_LOOPBACK_WEBHOOKS env var (1 / true — case-insensitive). Lets the integration suite — which sets AI_MEMORY_NO_CONFIG=1 and therefore cannot use [subscriptions] from config.toml — bind wiremock at 127.0.0.1:0 and drive webhooks through it without touching the production default.
2. [subscriptions].allow_loopback_webhooks from config.toml.
3. Compiled default (false — loopback rejected).

impl AppConfig

pub fn config_path() -> Option<PathBuf>

Returns the config file path: ~/.config/ai-memory/config.toml

pub fn load() -> Self

Load config from disk. Returns AppConfig::default() if file is missing. Set AI_MEMORY_NO_CONFIG=1 to skip config loading (used by integration tests).

pub fn load_from(path: &Path) -> Self

Load config from a specific path.

pub fn effective_permissions_mode(&self) -> PermissionsMode

v0.7.0 K3 — resolve the effective PermissionsMode consulted by crate::db::enforce_governance.

Resolution order:

1. AI_MEMORY_PERMISSIONS_MODE env var (enforce / advisory / off, case-insensitive). Lets the integration suite — which sets AI_MEMORY_NO_CONFIG=1 and therefore cannot use [permissions] from config.toml — flip the gate to Enforce per scenario.
2. [permissions].mode from config.toml.
3. v0.7.0 secure default (PermissionsMode::Enforce) when no explicit configuration is present. Round-2 F8 / Round-3 re-verify: prior to this round the unconfigured fallback was PermissionsMode::default (= advisory), which left an upgrading deployment with metadata.governance.write=owner bypassable. We now resolve via crate::permissions::resolve_v07_default_mode so every process-wide entry point (CLI, MCP, HTTP serve) shares the same secure-by-default posture; operators who want advisory set [permissions].mode = "advisory" explicitly.

pub fn effective_permission_rules(&self) -> Vec<PermissionRule>

v0.7.0 K9 — resolve the effective declarative rule set consulted by crate::permissions::Permissions::evaluate.

Returns the rules from [permissions] when configured; otherwise an empty vec (no declarative rules — mode + hooks resolve every decision).

pub fn effective_tier(&self, cli_tier: Option<&str>) -> FeatureTier

Resolve the effective feature tier from config (CLI flag overrides).

pub fn effective_db(&self, cli_db: &Path) -> PathBuf

Resolve the effective database path (CLI flag overrides config).

Expands a leading ~ / ~/ in the config-provided path to $HOME before returning (issue #507). Without this, db = "~/.claude/ai-memory.db" in config.toml would land on disk as the literal four-char dir ~/.claude/... relative to cwd and the daemon would report warn db unavailable against the real DB that lives at the expanded path.

pub fn effective_ollama_url(&self) -> &str

Resolve Ollama URL for LLM generation (config or default).

DOC-6: legacy resolver — kept for v0.7.x backward compat. New callers should use the sectioned [llm] resolver.

pub fn effective_ttl(&self) -> ResolvedTtl

Resolve TTL configuration from config file, falling back to compiled defaults.

pub fn effective_scoring(&self) -> ResolvedScoring

Resolve recall-scoring configuration (time-decay half-life) from the config file, falling back to compiled defaults. v0.6.0.0.

pub fn effective_archive_on_gc(&self) -> bool

Whether to archive memories before GC deletion (default: true).

DOC-6: legacy resolver — kept for v0.7.x backward compat.

pub fn effective_request_timeout_secs(&self) -> u64

v0.7.0 H7 (round-2) — resolved per-request HTTP timeout. Falls back to DEFAULT_REQUEST_TIMEOUT_SECS when the request_timeout_secs config field is unset.

pub fn effective_llm_call_timeout_secs(&self) -> u64

v0.7.0 H8 (round-2) — resolved per-LLM-call timeout. Falls back to DEFAULT_LLM_CALL_TIMEOUT_SECS when the llm_call_timeout_secs config field is unset.

pub fn effective_profile( &self, cli_or_env: Option<&str>, ) -> Result<Profile, ProfileParseError>

v0.6.4-001 — resolve the effective MCP tool profile.

Resolution order:

1. cli_or_env (already merged by clap’s #[arg(env="AI_MEMORY_PROFILE")])
2. [mcp].profile config field
3. compiled default "core"

Errors

Returns crate::profile::ProfileParseError if any layer’s value is malformed (unknown family or mixed-case token).

pub fn effective_autonomous_hooks(&self) -> bool

Whether post-store autonomy hooks (auto_tag + detect_contradiction) fire on every successful memory_store. v0.6.0.0. Precedence: AI_MEMORY_AUTONOMOUS_HOOKS=1 env var (truthy) > config file > default false. AI_MEMORY_AUTONOMOUS_HOOKS=0 also honored for explicit-off.

pub fn effective_anonymize_default(&self) -> bool

Whether to anonymize the default agent_id fallback (Task 1.2 #198). Precedence: AI_MEMORY_ANONYMIZE=1 env var (truthy) > config file > default false.

pub fn effective_logging(&self) -> LoggingConfig

Resolve the LoggingConfig block, returning a default (disabled) instance when the config file omits it.

pub fn effective_audit(&self) -> AuditConfig

Resolve the AuditConfig block, returning a default (disabled) instance when the config file omits it.

pub fn effective_transcripts(&self) -> TranscriptsConfig

v0.7.0 I3 — resolve the TranscriptsConfig block, returning a default (no namespace overrides → compiled global defaults) instance when the config file omits it.

pub fn effective_boot(&self) -> BootConfig

Resolve the BootConfig block, returning a default (enabled, no redaction) instance when the config file omits it. v0.6.3.1 (PR-9h / issue #487 PR #497 req #73).

pub fn effective_embed_url(&self) -> &str

Resolve URL for embedding model (falls back to ollama_url).

DOC-6: legacy resolver — kept for v0.7.x backward compat.

pub fn resolve_llm( &self, cli_backend: Option<&str>, cli_model: Option<&str>, cli_base_url: Option<&str>, ) -> ResolvedLlm

v0.7.x (#1146) — resolve the canonical LLM configuration.

cli_backend / cli_model / cli_base_url carry CLI-flag overrides (pass None for ai-memory mcp / ai-memory serve which currently expose no CLI override; the CLI plumbing lands in a follow-up commit).

DOC-6: this resolver intentionally reads the legacy flat fields as the lowest-precedence fallback layer (per the sectioned/v2 contract), so the #[allow(deprecated)] attribute is necessary here. External callers should pass CLI / env / [llm] section values and let this resolver reach for the legacy fields only when those are unset.

pub fn resolve_llm_auto_tag(&self) -> ResolvedLlm

v0.7.x (#1146) — resolve the [llm.auto_tag] fast-structured- output sibling. Fields fall back to Self::resolve_llm field- by-field; commonly only model is overridden (defaults to gemma3:4b per the L15 fast-structured-output policy).

DOC-6: reads the legacy auto_tag_model field as the lowest-precedence fallback layer (#[allow(deprecated)]).

pub fn resolve_embeddings(&self) -> ResolvedEmbeddings

v0.7.x (#1146) — resolve the canonical embedder configuration.

#1598 — extended per-field precedence ladder:

• backend: AI_MEMORY_EMBED_BACKEND env > [embeddings].backend

  compiled default (ollama).

• url: AI_MEMORY_EMBED_BASE_URL env > [embeddings].base_url

  [embeddings].url > legacy embed_url > legacy ollama_url the backend alias’s default base URL (API backends) > the localhost Ollama default.

• model: AI_MEMORY_EMBED_MODEL env > [embeddings].model

  legacy embedding_model > compiled default (nomic-embed-text-v1.5); legacy aliases canonicalised.

• api_key: [resolve_embed_api_key] ladder (AI_MEMORY_EMBED_API_KEY > per-vendor alias env > [embeddings].api_key_env > [embeddings].api_key_file).
• embedding_dim: [embeddings].dim override > canonical_embedding_dim table > None.

DOC-6: reads the legacy embed_url/embedding_model/ ollama_url fields as the lowest-precedence fallback layer.

pub fn resolve_reranker(&self) -> ResolvedReranker

v0.7.x (#1146) — resolve the canonical reranker configuration. Folds the legacy cross_encoder: Option<bool> flag into the enabled field; model defaults to ms-marco-MiniLM-L-6-v2.

DOC-6: reads the legacy cross_encoder field as the lowest-precedence fallback layer.

pub fn resolve_reranker_score_floor(&self) -> RerankerScoreFloor

#1691/n14 — resolve the recall-reranker score floor. Uniform ladder: AI_MEMORY_RERANK_SCORE_FLOOR env > [reranker].score_floor config > compiled default (crate::reranker::RerankerScoreFloor::Off). Unparseable values at any layer fall through to the next.

Kept as a dedicated resolver (rather than a field on ResolvedReranker) because crate::reranker::RerankerScoreFloor carries an f64 and is therefore PartialEq-only, while ResolvedReranker / ResolvedModels derive Eq. Fed to crate::reranker::BatchedReranker::with_score_floor at the serve and mcp reranker build sites so the score-floor capability is finally operator-reachable (it was dead config before #1691/n14).

pub fn reflection_namespace_enabled(&self, namespace: &str) -> bool

#1671 — whether curator --reflect --all-namespaces should reflect namespace. True ONLY when [curator.reflection_namespaces."<ns>"] exists with enabled = true. The conservative default is false (no config → no fan-out), matching the pre-#1671 inert-but-safe posture where --all-namespaces reflected nothing. A single --namespace <ns> invocation bypasses this gate at the call site.

pub fn confidence_decay_half_life_for(&self, namespace: &str) -> f64

n15 — resolve the confidence-decay half-life (days) for namespace: [curator.confidence_decay_half_life_days."<ns>"] when present, finite, and > 0, else the compiled crate::confidence::DEFAULT_HALF_LIFE_DAYS.

pub fn confidence_decay_half_life_overrides(&self) -> HashMap<String, f64>

n15 — snapshot the per-namespace confidence-decay half-life overrides for boot-time seeding into the process-global resolver (crate::confidence::decay::set_namespace_half_life_overrides), keeping only finite, positive values. Empty when no [curator] overrides are configured.

pub fn resolve_models(&self) -> ResolvedModels

v0.7.x (issue #1168) — bundle the three model-resolver outputs into a single ResolvedModels triple for the capabilities surface (MCP memory_capabilities, HTTP GET /api/v1/capabilities).

Routes through the canonical Self::resolve_llm, Self::resolve_embeddings, and Self::resolve_reranker resolvers so the capabilities models.* block reflects the same resolved configuration the live LLM client / embedder / reranker were built from, NEVER the compiled tier preset.

Pairs with ResolvedModels::from_tier_preset (back-compat constructor for tests that scaffold a TierConfig without an AppConfig).

pub fn resolve_storage(&self) -> ResolvedStorage

v0.7.x (#1146) — resolve the canonical storage configuration.

DOC-6: reads the legacy default_namespace/archive_on_gc/ archive_max_days/max_memory_mb fields as the lowest-precedence fallback layer.

pub fn resolve_limits(&self) -> ResolvedLimits

v0.7.x — resolve the operator-tunable capacity limits.

Precedence ladder per field (highest wins): AI_MEMORY_MAX_* env > [limits] section > compiled default. Non-positive values (≤ 0) at any layer are treated as “unset” so a stray 0 never silently disables writes — the next layer down is consulted instead. The compiled defaults are the named crate::quotas::DEFAULT_MAX_* constants and crate::handlers::MAX_BULK_SIZE; no numeric literals live in this resolver.

pub fn write_default_if_missing()

Write a default config file if one doesn’t exist yet.

Trait Implementations

impl Clone for AppConfig

fn clone(&self) -> AppConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AppConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AppConfig

fn default() -> AppConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AppConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for AppConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.