Module config 

Runtime configuration loading and validation. Runtime configuration loading and validation for aion-server.

The config surface is split across cohesive submodules and re-exported here in full, so every crate::config::X path resolves identically to the old single-file layout:

• assistant — the optional [assistant] section: harness accounts.
• [defaults] — default values and operator-facing validation messages.
• [sections] — the typed [section] sub-configurations and their defaults.
• [runtime] — the [RuntimeConfig] runtime view and [CliOverrides].
• [load] — ServerConfig, its load/merge/validate pipeline, and the workflow-package discovery helpers.
• [heal] — the boot-side config self-heal: the standard pass that checks every required field and inserts its declared default when absent.
• env / file — the environment-variable and TOML-file loaders.
• [home] — the single typed Aion-home resolver.

Modules

env

Environment variable configuration loader. Environment variable overlays for AION_ prefixed server configuration.

file

File-based configuration loader. TOML config file discovery, reading, and parsing.

Structs

AionHome

A resolved Aion home together with the provenance of that resolution.

AssistantAccountConfig

One named login account, from [[assistant.harness.account]].

AssistantConfig

The [assistant] section — entirely optional.

AssistantHarnessConfig

The accounts declared on ONE catalogue harness, from [[assistant.harness]].

AuthConfig

Authentication configuration applied at adapter boundaries.

AuthoringConfig

Server-side authoring settings from [authoring].

CliOverrides

Command-line configuration overrides applied after file and environment values.

ClusterConfig

Distributed-cluster membership for the haematite backend, from [store.cluster].

ClusterPeer

One dialable cluster peer: its distribution name and replication address.

DeployConfig

Operator deploy API settings from [deploy].

DevConfig

Local dev-server surface settings from [dev].

DrainConfig

Graceful drain settings from [drain].

ListenConfig

Public transport listener addresses retained for existing adapter code.

McpConfig

Model Context Protocol surface settings from [mcp].

MetricsConfig

Metrics endpoint settings from [metrics].

NamespaceConfig

Namespace resolver construction mode.

NamespacesConfig

Namespace defaults from [namespaces].

ObservabilityConfig

Agent-observability transcript settings from [observability]: retention bounds, and the transcript drain’s flush policy.

OpsConsoleConfig

Static ops-console asset configuration.

OutboxConfig

Durable-outbox fan-out dispatcher settings from [outbox].

ResolvedAssistantAccount

One named login account, validated.

ResolvedAssistantConfig

The [assistant] section, validated.

ResolvedAssistantHarness

One catalogue harness’s declared accounts, validated.

ResolvedMcpConfig

The [mcp] section with every omitted knob resolved.

RuntimeConfig

Runtime settings retained in shared server state for transport adapters.

RuntimeSection

Engine runtime settings from [runtime].

ServerConfig

Complete merged server configuration.

ServerSection

Public transport listener addresses from [server].

StoreConfig

Event-store backend configuration from [store].

TlsConfig

TLS certificate and private-key material.

WebSocketConfig

WebSocket stream configuration.

WorkerConfig

Remote worker heartbeat configuration.

WorkerSupervisionConfig

Managed-worker supervision settings from [worker_supervision].

Enums

AutoCreate

Minted-on-use namespace policy (Control-Plane Phase 1).

HomeSource

Where a resolved Aion home came from.

NamespaceMode

Supported namespace mapping modes.

OpsConsoleAssetSource

Static ops-console bundle source.

OutboxTransport

Wire transport selected for outbox dispatch.

StoreBackend

Supported event-store backend names.

Constants

DEFAULT_AUTHORING_WORKSPACE_DIR

Child directory below Aion home used by the out-of-box AWL studio.

DEFAULT_CLUSTER_BROADCAST_CAPACITY

Default cluster_broadcast_capacity applied when omitted. Cluster topology events are low-rate, so a small lag buffer is ample.

DEFAULT_DEPLOY_MAX_ARCHIVE_BYTES

Default deploy.max_archive_bytes applied when omitted and deploy is enabled. A conservative 64 MiB upload ceiling: large enough for real workflow packages, small enough to bound a single upload. Overridable.

DEFAULT_DEPLOY_MAX_INFLATED_BYTES

Default deploy.max_inflated_bytes applied when omitted and deploy is enabled. A conservative 256 MiB decompressed-contents ceiling (4x the archive ceiling) that still hard-caps DEFLATE-bomb inflation. Overridable.

DEFAULT_EVENT_BROADCAST_CAPACITY

Default event_broadcast_capacity applied when omitted, so a minimal/empty config boots without forcing the operator to size a tuning knob. Sized for global event volume across namespaces; override for high-throughput fleets.

DEFAULT_FAILOVER_CONFIRMATIONS

Default SS-5b debounce count when [store.cluster] does not set failover_confirmations.

DEFAULT_FAILOVER_POLL_INTERVAL_MS

Default SS-5b failover poll interval (milliseconds) when [store.cluster] does not set failover_poll_interval_ms.

DEFAULT_HAEMATITE_DATA_DIR

Child directory below Aion home used by the default haematite store.

DEFAULT_HTTP_ADDRESS

Shipping HTTP/WebSocket listener used when no server override is supplied.

DEFAULT_MAX_IN_FLIGHT_ACTIVITIES

Generous platform default for [namespaces] max_in_flight_activities: the cluster-wide concurrent in-flight-activity ceiling applied to a namespace that sets no explicit override. A generous power-of-two (Control-Plane Phase 2 §6.1 / Open Decision 4) so the default is HEADROOM, not a low hard cap — a tenant only ever hits a ceiling it (or the operator) raised. Nothing enforces it yet (P2-Q1 is config + record field only).

DEFAULT_MCP_DISCOVER_TTL_MS

Default mcp.discover_ttl_ms: how long a client may treat a server/discover result as fresh. Sixty seconds — the discover result names the protocol revisions and the extension set, which change only on a deploy, but a minute is short enough that a rolling upgrade is visible to a client promptly. Overridable per deployment.

DEFAULT_MCP_TASK_POLL_INTERVAL_MS

Default mcp.task_poll_interval_ms: the interval a created task asks its client to poll at. One second. Overridable per deployment.

DEFAULT_MCP_TOOLS_LIST_TTL_MS

Default mcp.tools_list_ttl_ms: how long a client may treat a tools/list result as fresh. Five minutes — the catalog is compiled into the binary and cannot change while the process runs, so the only event that invalidates it is a restart. Overridable per deployment.

DEFAULT_OBSERVABILITY_MAX_EVENT_BYTES

Default observability.max_event_bytes: the ceiling on one persisted transcript event’s serialized size. 256 KiB comfortably holds real tool-result payloads while bounding what one hostile/verbose harness line can write to the durable O keyspace. Overridable per deployment.

DEFAULT_OBSERVABILITY_MAX_STREAM_EVENTS

Default observability.max_stream_events: the ceiling on retained events per (workflow, activity, attempt) transcript stream. Past it one marker record is retained and further events stay live-only. Overridable.

DEFAULT_OUTBOX_BACKOFF_BASE_MS

Default outbox.backoff_base_ms applied when omitted and the dispatcher is enabled: the first retry’s backoff, in milliseconds.

DEFAULT_OUTBOX_BACKOFF_MAX_MS

Default outbox.backoff_max_ms applied when omitted and the dispatcher is enabled: the per-retry backoff ceiling, in milliseconds.

DEFAULT_OUTBOX_BACKOFF_MULTIPLIER

Default outbox.backoff_multiplier applied when omitted and the dispatcher is enabled: geometric growth factor per prior attempt (must be >= 1).

DEFAULT_OUTBOX_BATCH_SIZE

Default outbox.batch_size applied when omitted and the dispatcher is enabled: rows claimed per sweep.

DEFAULT_OUTBOX_MAX_ATTEMPTS

Default outbox.max_attempts applied when omitted and the dispatcher is enabled: dispatch attempts before a row is dead-lettered to failed.

DEFAULT_OUTBOX_POLL_INTERVAL_MS

Default outbox.poll_interval_ms applied when omitted and the dispatcher is enabled. A tight 20ms claim cadence keeps fan-out latency low; raise it for lower-rate, larger-batch sweeps.

DEFAULT_QUERY_TIMEOUT_MS

Default query_timeout_ms applied when omitted, so a minimal/empty config boots with a sane workflow-query reply deadline instead of failing startup.

DEFAULT_STOP_DRAIN_TIMEOUT_MS

Default runtime.stop_drain_timeout_ms applied when omitted: thirty seconds, ruled 2026-08-29 as the honest patience of one deploy (it sits beside the estate’s 30 s boot gate as the same kind of number).

DEFAULT_WORKLOOP_SWEEP_INTERVAL_MS

Default runtime.workloop_sweep_interval_ms applied when omitted.

FIRST_RUN_CONFIG

The embedded first-run configuration: the exact bytes a first boot with no discovered config writes to <AION_HOME>/config.toml.

MAX_TRANSCRIPT_WINDOW_LIMIT

Maximum bounded transcript page accepted by the HTTP transcript endpoint.

OBSERVABILITY_MAX_BATCH_EVENTS_REQUIRED

Operator-facing message for an absent or zero observability.max_batch_events.

OBSERVABILITY_MAX_BATCH_HOLD_MS_REQUIRED

Operator-facing message for an absent observability.max_batch_hold_ms.

STORE_NODE_CACHE_BUDGET_REQUIRED

Operator-facing message for an absent store.node_cache_budget.

Functions

aion_home

Resolve the Aion user-level configuration and state directory.