truth-mirror 0.15.0

//! truth-mirror configuration: adversarial pairs, reasoning effort, gates,
//! ground-truth, trajectory, and enforcement.
use std::{
    collections::BTreeMap,
    fs::{self, OpenOptions},
    io::{self, Write},
    path::{Path, PathBuf},
    sync::atomic::{AtomicU64, Ordering},
};

use serde::{Deserialize, Serialize};
use thiserror::Error;

pub const DEFAULT_STATE_DIR: &str = ".truth";
pub const LEGACY_STATE_DIR: &str = ".truth-mirror";
pub const MAX_PETITION_BATCH_SIZE: usize = 32;

/// Environment variable that can force-disable (or leave enabled) truth-mirror.
pub const TRUTH_MIRROR_ENABLED_ENV: &str = "TRUTH_MIRROR_ENABLED";

static CONFIG_TEMP_COUNTER: AtomicU64 = AtomicU64::new(0);

/// Checked-in annotated config asset used for both system and project defaults.
pub const DEFAULT_CONFIG_ASSET: &str = include_str!("../assets/config.toml");

/// Hard safety ceiling for concurrent provider processes.
pub const MAX_CONCURRENT_REVIEW_RUNS: usize = 4;
pub const DEFAULT_MEMORY_SKILL_BLOCKED_PATTERNS: &[&str] = &[
    "BEGIN SYSTEM PROMPT",
    "ignore previous instructions",
    "api_key",
    "secret_key",
    "secret:",
    "secret=",
    "token:",
    "token=",
    "password:",
    "password=",
    "credential:",
    "credential=",
    "private_key",
    "aws_secret_access_key",
];

/// Reasoning effort (`C`). Highest is `Xhigh`.
#[derive(Clone, Copy, Debug, Default, Deserialize, Eq, PartialEq, Serialize, clap::ValueEnum)]
#[serde(rename_all = "lowercase")]
#[value(rename_all = "lowercase")]
pub enum Effort {
    Minimal,
    Low,
    Medium,
    High,
    #[default]
    Xhigh,
}

impl Effort {
    pub fn as_str(self) -> &'static str {
        match self {
            Effort::Minimal => "minimal",
            Effort::Low => "low",
            Effort::Medium => "medium",
            Effort::High => "high",
            Effort::Xhigh => "xhigh",
        }
    }

    /// The highest supported effort — the default reviewer aggressiveness.
    pub fn highest() -> Self {
        Effort::Xhigh
    }

    /// Value accepted by Claude's `--effort`. Verified: claude takes
    /// `low|medium|high|xhigh|max` and has no `minimal`, so `Minimal` clamps to
    /// `low`. (Codex and Pi both accept `minimal`.)
    pub fn claude_value(self) -> &'static str {
        match self {
            Effort::Minimal => "low",
            other => other.as_str(),
        }
    }
}

/// A concrete reviewer/arbiter selection: harness + model + reasoning effort.
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct HarnessSelection {
    pub harness: String,
    pub model: String,
    #[serde(default)]
    pub effort: Effort,
}

impl HarnessSelection {
    pub fn new(harness: impl Into<String>, model: impl Into<String>, effort: Effort) -> Self {
        Self {
            harness: harness.into(),
            model: model.into(),
            effort,
        }
    }
}

/// The opposed reviewer (and optional second-pass arbiter) for one writer harness.
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct AdversarialPair {
    pub reviewer: HarnessSelection,
    #[serde(default)]
    pub arbiter: Option<HarnessSelection>,
}

#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
pub struct TruthMirrorConfig {
    #[serde(default = "default_enabled")]
    pub enabled: bool,
    #[serde(default = "default_announce_when_disabled")]
    pub announce_when_disabled: bool,
    #[serde(default = "default_ledger_dir")]
    pub ledger_dir: String,
    #[serde(default)]
    pub allow_same_model: bool,
    /// Writer harness assumed when none is provided on the CLI or commit trailer.
    #[serde(default = "default_writer")]
    pub default_writer: String,
    /// Adversarial pairs keyed by writer harness (lowercase). Empty in the parsed
    /// form when `[pairs]` is absent; `normalize` fills defaults / folds legacy.
    #[serde(default)]
    pub pairs: BTreeMap<String, AdversarialPair>,
    #[serde(default)]
    pub strict: StrictConfig,
    #[serde(default)]
    pub gates: GatesConfig,
    #[serde(default)]
    pub ground_truth: GroundTruthConfig,
    #[serde(default)]
    pub history: HistoryConfig,
    #[serde(default)]
    pub enforcement: EnforcementConfig,
    #[serde(default)]
    pub skills: SkillsConfig,
    #[serde(default)]
    pub memory_skill: MemorySkillConfig,
    /// Reviewer subprocess settings (per-review wall-clock timeout).
    #[serde(default)]
    pub reviewer: ReviewerPolicyConfig,
    /// Legacy `[review]` block, folded into `pairs` on load for back-compat.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub review: Option<LegacyReview>,
}

impl Default for TruthMirrorConfig {
    fn default() -> Self {
        Self {
            enabled: default_enabled(),
            announce_when_disabled: default_announce_when_disabled(),
            ledger_dir: default_ledger_dir(),
            allow_same_model: false,
            default_writer: default_writer(),
            pairs: default_pairs(),
            strict: StrictConfig::default(),
            gates: GatesConfig::default(),
            ground_truth: GroundTruthConfig::default(),
            history: HistoryConfig::default(),
            enforcement: EnforcementConfig::default(),
            skills: SkillsConfig::default(),
            memory_skill: MemorySkillConfig::default(),
            reviewer: ReviewerPolicyConfig::default(),
            review: None,
        }
    }
}
/// Resolve the system configuration directory from `$XDG_CONFIG_HOME` or `$HOME`.
pub fn system_config_dir() -> Result<PathBuf, ConfigError> {
    if let Some(xdg) = std::env::var_os("XDG_CONFIG_HOME").filter(|v| !v.is_empty()) {
        return Ok(PathBuf::from(xdg).join("truth-mirror"));
    }
    if let Some(home) = std::env::var_os("HOME").filter(|v| !v.is_empty()) {
        return Ok(PathBuf::from(home).join(".config/truth-mirror"));
    }
    Err(ConfigError::NoSystemConfigDir)
}

/// Full path to the system `config.toml`.
pub fn system_config_path() -> Result<PathBuf, ConfigError> {
    Ok(system_config_dir()?.join("config.toml"))
}

/// Write `contents` to `path` atomically by hard-linking a synced temporary file.
/// The link is the create-exclusive primitive: an existing destination is preserved.
pub(crate) fn write_config_atomically(path: &Path, contents: &str) -> Result<(), ConfigError> {
    let dir = path
        .parent()
        .ok_or_else(|| ConfigError::CreateSystemConfig {
            path: path.to_path_buf(),
            source: io::Error::new(io::ErrorKind::InvalidInput, "no parent directory"),
        })?;
    fs::create_dir_all(dir).map_err(|source| ConfigError::CreateSystemConfig {
        path: path.to_path_buf(),
        source,
    })?;
    let serial = CONFIG_TEMP_COUNTER.fetch_add(1, Ordering::Relaxed);
    let temp_path = dir.join(format!(
        ".truth-mirror-config-{}-{serial}.tmp",
        std::process::id()
    ));
    let mut temp = OpenOptions::new()
        .write(true)
        .create_new(true)
        .open(&temp_path)
        .map_err(|source| ConfigError::CreateSystemConfig {
            path: path.to_path_buf(),
            source,
        })?;
    if let Err(source) = temp
        .write_all(contents.as_bytes())
        .and_then(|()| temp.sync_all())
    {
        let _ = fs::remove_file(&temp_path);
        return Err(ConfigError::CreateSystemConfig {
            path: path.to_path_buf(),
            source,
        });
    }
    let linked = fs::hard_link(&temp_path, path);
    let _ = fs::remove_file(&temp_path);
    match linked {
        Ok(()) => Ok(()),
        Err(error) if error.kind() == io::ErrorKind::AlreadyExists => Ok(()),
        Err(source) => Err(ConfigError::CreateSystemConfig {
            path: path.to_path_buf(),
            source,
        }),
    }
}

/// Create the system config from the checked-in asset when absent, preserving any
/// existing file byte-for-byte. Returns the path to the system config.
pub fn ensure_system_config() -> Result<PathBuf, ConfigError> {
    let path = system_config_path()?;
    if !path.exists() {
        write_config_atomically(&path, DEFAULT_CONFIG_ASSET)?;
    }
    Ok(path)
}
/// Create the project-local config from the checked-in asset when absent,
/// preserving any existing file byte-for-byte. Returns the path to the project
/// config.
pub fn ensure_project_config(state_dir: &Path) -> Result<PathBuf, ConfigError> {
    let path = TruthMirrorConfig::default_path(state_dir);
    if !path.exists() {
        write_config_atomically(&path, DEFAULT_CONFIG_ASSET)?;
    }
    Ok(path)
}

/// Deep-merge two TOML values. Tables merge recursively; scalars and arrays are
/// replaced by the overlay value.
fn merge_toml(base: &mut toml::Value, overlay: toml::Value) {
    match (base, overlay) {
        (toml::Value::Table(base_table), toml::Value::Table(overlay_table)) => {
            for (key, overlay_value) in overlay_table {
                let base_value = base_table
                    .entry(key)
                    .or_insert(toml::Value::Table(toml::map::Map::new()));
                merge_toml(base_value, overlay_value);
            }
        }
        (base, overlay) => *base = overlay,
    }
}

fn read_toml_value(path: &Path) -> Result<Option<toml::Value>, ConfigError> {
    match fs::read_to_string(path) {
        Ok(contents) => {
            let table = contents
                .parse::<toml::Table>()
                .map_err(|source| ConfigError::Parse {
                    path: path.to_path_buf(),
                    source,
                })?;
            Ok(Some(toml::Value::Table(table)))
        }
        Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(None),
        Err(source) => Err(ConfigError::Read {
            path: path.to_path_buf(),
            source,
        }),
    }
}

fn parse_env_enabled() -> Result<Option<bool>, ConfigError> {
    match std::env::var_os(TRUTH_MIRROR_ENABLED_ENV) {
        None => Ok(None),
        Some(raw) => {
            let s = raw.to_string_lossy().trim().to_ascii_lowercase();
            match s.as_str() {
                "true" | "1" => Ok(Some(true)),
                "false" | "0" => Ok(Some(false)),
                _ => Err(ConfigError::InvalidEnabledEnv {
                    value: raw.to_string_lossy().into_owned(),
                }),
            }
        }
    }
}

impl TruthMirrorConfig {
    /// Effective runtime loader: built-in defaults < system config < project or
    /// explicit config < `TRUTH_MIRROR_ENABLED` env var. The optional system
    /// layer is read-only and best-effort; installation materializes it.
    /// Monotonic `enabled`: any system/project/env false disables; true never
    /// re-enables a lower false layer.
    pub fn load_for_cli(
        explicit_path: Option<&Path>,
        state_dir: &Path,
    ) -> Result<Self, ConfigError> {
        let project_path = if let Some(path) = explicit_path {
            PathBuf::from(path)
        } else {
            // Resolve the project config path WITHOUT creating it. Loading config
            // happens for every command, including `install-hooks --dry-run` and
            // commands that fail a precondition, and both must leave no `.truth`
            // behind. Project-local materialization is owned by the install path
            // (hooks::ensure_state_gitignore -> ensure_default_config).
            Self::default_path(state_dir)
        };
        Self::load_effective(project_path)
    }

    fn load_effective(project_path: PathBuf) -> Result<Self, ConfigError> {
        // The checked-in asset is the authoritative default surface; parse it once
        // and use it as the merge base so every non-legacy key is present.
        let mut base: toml::Value = toml::Value::Table(
            DEFAULT_CONFIG_ASSET
                .parse::<toml::Table>()
                .expect("checked-in assets/config.toml must be valid TOML"),
        );

        // Track `enabled` across layers with AND semantics: any explicit false
        // from any layer disables inference; true cannot re-enable after false.
        let mut enabled = true;

        if let Ok(system_path) = system_config_path()
            && system_path.is_file()
        {
            match read_toml_value(&system_path) {
                Ok(Some(system)) => {
                    if system.get("enabled").and_then(toml::Value::as_bool) == Some(false) {
                        enabled = false;
                    }
                    merge_toml(&mut base, system);
                }
                Ok(None) | Err(ConfigError::Read { .. }) => {}
                Err(error) => return Err(error),
            }
        }

        if let Some(project) = read_toml_value(&project_path)? {
            if project.get("enabled").and_then(toml::Value::as_bool) == Some(false) {
                enabled = false;
            }
            merge_toml(&mut base, project);
        }

        let env_enabled = parse_env_enabled()?;
        let final_enabled = enabled && env_enabled.unwrap_or(true);
        if let Some(table) = base.as_table_mut() {
            table.insert("enabled".to_owned(), toml::Value::Boolean(final_enabled));
        }

        let mut config: Self = base.try_into().map_err(|source| ConfigError::Parse {
            path: project_path.clone(),
            source,
        })?;
        config.normalize();
        config.validate()?;
        Ok(config)
    }
    pub fn load_or_default(path: impl Into<PathBuf>) -> Result<Self, ConfigError> {
        let path = path.into();
        match fs::read_to_string(&path) {
            Ok(contents) => Self::from_toml_str(&path, &contents),
            Err(error) if error.kind() == io::ErrorKind::NotFound => Ok(Self::default()),
            Err(source) => Err(ConfigError::Read { path, source }),
        }
    }

    pub fn from_toml_str(path: &Path, contents: &str) -> Result<Self, ConfigError> {
        let mut config: Self = toml::from_str(contents).map_err(|source| ConfigError::Parse {
            path: path.to_path_buf(),
            source,
        })?;
        config.normalize();
        config.validate()?;
        Ok(config)
    }

    /// Resolve the effective `pairs`: explicit `[pairs]` win; a legacy `[review]`
    /// block folds in as an OVERRIDE for its writer (on top of defaults so other
    /// writers still resolve); with neither, all writers get default pairs.
    fn normalize(&mut self) {
        // Lowercase explicit pair keys FIRST so every comparison below is
        // case-insensitive (matching `pair_for`). Otherwise a `[pairs.CODEX]` could
        // be clobbered by a legacy `[review]` folded under `codex`.
        let lowered: BTreeMap<String, AdversarialPair> = std::mem::take(&mut self.pairs)
            .into_iter()
            .map(|(key, value)| (key.trim().to_ascii_lowercase(), value))
            .collect();
        self.pairs = lowered;

        let had_explicit_pairs = !self.pairs.is_empty();
        let review = self.review.take();

        if !had_explicit_pairs && review.is_some() {
            // Legacy-only config: seed defaults so non-legacy writers still resolve.
            self.pairs = default_pairs();
        }

        if let Some(review) = review {
            let writer = review.watched.harness.trim().to_ascii_lowercase();
            let pair = AdversarialPair {
                reviewer: HarnessSelection::new(
                    review.reviewer.harness,
                    review.reviewer.model,
                    Effort::highest(),
                ),
                arbiter: None,
            };
            if had_explicit_pairs {
                // Explicit `[pairs]` win: legacy only fills a writer they omit.
                self.pairs.entry(writer).or_insert(pair);
            } else {
                // Legacy-only config: override the seeded default for this writer.
                self.pairs.insert(writer, pair);
            }
        }

        if self.pairs.is_empty() {
            self.pairs = default_pairs();
        }
        if self.history.transcript_path.as_deref() == Some("") {
            self.history.transcript_path = None;
        }
    }

    fn validate(&self) -> Result<(), ConfigError> {
        for (writer, pair) in &self.pairs {
            if let Some(arbiter) = &pair.arbiter
                && normalized_model(&arbiter.model) == normalized_model(&pair.reviewer.model)
            {
                return Err(ConfigError::ArbiterNotDistinct {
                    writer: writer.clone(),
                });
            }
        }
        if !self.memory_skill.scan.entropy_threshold.is_finite()
            || self.memory_skill.scan.entropy_threshold <= 0.0
        {
            return Err(ConfigError::InvalidMemorySkillEntropyThreshold {
                value: self.memory_skill.scan.entropy_threshold,
            });
        }
        if !self.memory_skill.signals.similarity_threshold.is_finite()
            || !(0.0..=1.0).contains(&self.memory_skill.signals.similarity_threshold)
        {
            return Err(ConfigError::InvalidMemorySkillSimilarityThreshold {
                value: self.memory_skill.signals.similarity_threshold,
            });
        }
        if !(1..=MAX_PETITION_BATCH_SIZE).contains(&self.reviewer.max_petition_batch_size) {
            return Err(ConfigError::InvalidPetitionBatchSize {
                value: self.reviewer.max_petition_batch_size,
            });
        }
        if !(1..=MAX_CONCURRENT_REVIEW_RUNS).contains(&self.reviewer.max_concurrent_runs) {
            return Err(ConfigError::InvalidConcurrentReviewRuns {
                value: self.reviewer.max_concurrent_runs,
            });
        }

        if self.memory_skill.max_skill_bytes == 0 {
            return Err(ConfigError::InvalidMemorySkillMaxSkillBytes);
        }
        if self.memory_skill.scan.secret_detector_timeout_seconds == 0 {
            return Err(ConfigError::InvalidMemorySkillSecretDetectorTimeout);
        }
        Ok(())
    }

    /// The adversarial pair for a writer harness (case-insensitive).
    pub fn pair_for(&self, writer_harness: &str) -> Option<&AdversarialPair> {
        self.pairs.get(&writer_harness.trim().to_ascii_lowercase())
    }

    pub fn default_path(state_dir: &Path) -> PathBuf {
        state_dir.join("config.toml")
    }
    #[cfg(test)]
    fn from_test_sources(
        system: Option<&str>,
        project: &str,
        env_enabled: Option<bool>,
    ) -> Result<Self, ConfigError> {
        let mut base: toml::Value = toml::Value::Table(
            DEFAULT_CONFIG_ASSET
                .parse::<toml::Table>()
                .expect("checked-in asset must be valid TOML"),
        );
        let mut enabled = true;
        if let Some(system) = system {
            let value: toml::Value =
                toml::from_str(system).map_err(|source| ConfigError::Parse {
                    path: PathBuf::from("system.toml"),
                    source,
                })?;
            if value.get("enabled").and_then(toml::Value::as_bool) == Some(false) {
                enabled = false;
            }
            merge_toml(&mut base, value);
        }
        let project_value: toml::Value =
            toml::from_str(project).map_err(|source| ConfigError::Parse {
                path: PathBuf::from("project.toml"),
                source,
            })?;
        if project_value.get("enabled").and_then(toml::Value::as_bool) == Some(false) {
            enabled = false;
        }
        merge_toml(&mut base, project_value);

        let final_enabled = enabled && env_enabled.unwrap_or(true);
        if let Some(table) = base.as_table_mut() {
            table.insert("enabled".to_owned(), toml::Value::Boolean(final_enabled));
        }

        let mut config: Self = base.try_into().map_err(|source| ConfigError::Parse {
            path: PathBuf::from("project.toml"),
            source,
        })?;
        config.normalize();
        config.validate()?;
        Ok(config)
    }
}

/// Default per-review wall-clock timeout: 20 minutes. Two days of field use
/// showed wedged reviewer subprocesses running 1–7 hours with the queue frozen
/// behind them; a healthy adversarial review takes minutes, so 20 minutes is
/// comfortably past legitimate work and short enough to unstick the queue.
pub const DEFAULT_REVIEWER_TIMEOUT_SECS: u64 = 20 * 60;

/// Reviewer queue policies, subprocess settings, and concurrent scheduling.
#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
#[serde(default)]
pub struct ReviewerPolicyConfig {
    /// Opt-in compatibility boundary: false retains one reviewer invocation per petition.
    pub batch_petitions: bool,
    pub max_petition_batch_size: usize,
    /// Per-review wall-clock timeout in seconds. A reviewer subprocess that
    /// outlives this is killed and the run recorded as failed with a timeout
    /// reason, so one wedged reviewer never freezes the queue. `0` disables
    /// the timeout.
    pub timeout_secs: u64,
    /// Maximum number of independent reviewer processes in one drain wave.
    /// `1` preserves the historical serial scheduler.
    pub max_concurrent_runs: usize,
}

impl Default for ReviewerPolicyConfig {
    fn default() -> Self {
        Self {
            batch_petitions: false,
            max_petition_batch_size: MAX_PETITION_BATCH_SIZE,
            timeout_secs: DEFAULT_REVIEWER_TIMEOUT_SECS,
            max_concurrent_runs: 1,
        }
    }
}

impl ReviewerPolicyConfig {
    /// The configured timeout as a duration, or `None` when disabled (`0`).
    pub fn timeout(&self) -> Option<std::time::Duration> {
        (self.timeout_secs > 0).then(|| std::time::Duration::from_secs(self.timeout_secs))
    }
}

/// Legacy single watched/reviewer pair (pre-adversarial-pairs config).
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct LegacyReview {
    pub watched: LegacyModel,
    pub reviewer: LegacyModel,
}

#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
pub struct LegacyModel {
    pub harness: String,
    pub model: String,
}

/// Strict goal-loop thresholds. `N == 0` disables that stop condition.
#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
#[serde(default)]
pub struct StrictConfig {
    pub stop_after_lies: u32,
    pub stop_after_fuckups: u32,
    pub max_passes: u32,
}

impl Default for StrictConfig {
    fn default() -> Self {
        Self {
            stop_after_lies: 1,
            stop_after_fuckups: 3,
            max_passes: 3,
        }
    }
}

impl StrictConfig {
    pub fn goal_policy(
        &self,
        lies_override: Option<u32>,
        fuckups_override: Option<u32>,
    ) -> crate::reviewer::StrictGoalPolicy {
        crate::reviewer::StrictGoalPolicy {
            stop_after_lies: lies_override.unwrap_or(self.stop_after_lies),
            stop_after_fuckups: fuckups_override.unwrap_or(self.stop_after_fuckups),
        }
    }
}

/// Deterministic-gate configuration: banned diff sentinels, evidence patterns,
/// and diff paths excluded from marker scanning.
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
#[serde(default)]
pub struct GatesConfig {
    pub fake_markers: Vec<String>,
    pub evidence_patterns: Vec<String>,
    pub marker_ignore_paths: Vec<String>,
}

impl Default for GatesConfig {
    fn default() -> Self {
        Self {
            fake_markers: strs(crate::claim::DEFAULT_FAKE_MARKERS),
            evidence_patterns: strs(crate::claim::DEFAULT_EVIDENCE_PATTERNS),
            marker_ignore_paths: strs(crate::claim::DEFAULT_MARKER_IGNORE_PATHS),
        }
    }
}

impl GatesConfig {
    /// The resolved gate policy: config values plus built-in defaults for any
    /// list left empty, so an empty config never silently disables a gate.
    pub fn to_policy(&self) -> crate::claim::GatePolicy {
        crate::claim::GatePolicy {
            fake_markers: union_defaults(&self.fake_markers, crate::claim::DEFAULT_FAKE_MARKERS),
            evidence_patterns: union_defaults(
                &self.evidence_patterns,
                crate::claim::DEFAULT_EVIDENCE_PATTERNS,
            ),
            marker_ignore_paths: union_defaults(
                &self.marker_ignore_paths,
                crate::claim::DEFAULT_MARKER_IGNORE_PATHS,
            ),
        }
    }
}

fn strs(values: &[&str]) -> Vec<String> {
    values.iter().map(|value| (*value).to_owned()).collect()
}

/// Built-in defaults ALWAYS apply; configured values are additive. A repo can add
/// its own banned tokens or evidence patterns but cannot silently disable the
/// deterministic anti-lie defaults by setting a shorter list.
fn union_defaults(values: &[String], defaults: &[&str]) -> Vec<String> {
    let mut out: Vec<String> = strs(defaults);
    for value in values {
        if !out.iter().any(|existing| existing == value) {
            out.push(value.clone());
        }
    }
    out
}

/// Ground-truth constraint loading.
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
#[serde(default)]
pub struct GroundTruthConfig {
    pub enabled: bool,
    pub file_names: Vec<String>,
    pub include_openspec_specs: bool,
    pub max_bytes: usize,
}

impl Default for GroundTruthConfig {
    fn default() -> Self {
        Self {
            enabled: true,
            file_names: ["TRUTH.md", "AGENTS.md", "CLAUDE.md", ".truth/TRUTH.md"]
                .iter()
                .map(|name| (*name).to_owned())
                .collect(),
            include_openspec_specs: true,
            max_bytes: 20_000,
        }
    }
}

/// Conversation-trajectory window.
#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
#[serde(default)]
pub struct HistoryConfig {
    pub window_user: usize,
    pub window_agent: usize,
    pub max_bytes: usize,
    /// Optional repo-relative JSONL transcript (`{role,text}` per line). When
    /// unset or missing, recent commits are used as the trajectory proxy.
    pub transcript_path: Option<String>,
}

impl Default for HistoryConfig {
    fn default() -> Self {
        Self {
            window_user: 3,
            window_agent: 10,
            max_bytes: 12_000,
            transcript_path: None,
        }
    }
}

/// Enforcement escalation thresholds. `0` disables a condition.
#[derive(Clone, Copy, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
#[serde(default)]
pub struct EnforcementConfig {
    pub block_tools_after_unresolved: u32,
    pub block_tools_after_secs: u64,
}

impl EnforcementConfig {
    pub fn is_enabled(&self) -> bool {
        self.block_tools_after_unresolved > 0 || self.block_tools_after_secs > 0
    }
}

#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
#[serde(default)]
pub struct SkillsConfig {
    pub enabled: bool,
}

impl Default for SkillsConfig {
    fn default() -> Self {
        Self { enabled: true }
    }
}

#[derive(Clone, Copy, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum MemorySkillMode {
    Off,
    Suggest,
    #[default]
    Stage,
}

#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
#[serde(rename_all = "snake_case")]
pub enum MemorySkillCandidateKind {
    HowToSkill,
    AntiPatternSkill,
    RemediationSkill,
}

impl MemorySkillCandidateKind {
    pub fn as_str(self) -> &'static str {
        match self {
            Self::HowToSkill => "how_to_skill",
            Self::AntiPatternSkill => "anti_pattern_skill",
            Self::RemediationSkill => "remediation_skill",
        }
    }
}

impl std::fmt::Display for MemorySkillCandidateKind {
    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        formatter.write_str(self.as_str())
    }
}

#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
#[serde(default)]
pub struct MemorySkillConfig {
    pub enabled: bool,
    pub mode: MemorySkillMode,
    pub candidate_dir: String,
    pub approved_dir: String,
    pub approved_slug_prefix: String,
    pub toolbox_delivery_registry: String,
    pub allow_global_writes: bool,
    pub require_claim_evidence: bool,
    pub max_candidates_per_commit: usize,
    pub max_skill_bytes: usize,
    pub pre_push_blocks_pending: bool,
    /// Historical config key: when true, `memory_skill::scan_text` rejects the
    /// whole candidate on secret matches; it does not redact matched text in
    /// place. Scanning is fully disabled only when this is false and
    /// `memory_skill.scan.secret_detection = "off"`.
    pub redact_secrets: bool,
    pub signals: MemorySkillSignalsConfig,
    pub review: MemorySkillReviewConfig,
    pub scan: MemorySkillScanConfig,
}

impl Default for MemorySkillConfig {
    fn default() -> Self {
        Self {
            enabled: true,
            mode: MemorySkillMode::Stage,
            candidate_dir: format!("{DEFAULT_STATE_DIR}/skills/candidates"),
            approved_dir: ".agents/skills".to_owned(),
            approved_slug_prefix: "generated-".to_owned(),
            toolbox_delivery_registry: String::new(),
            allow_global_writes: false,
            require_claim_evidence: true,
            max_candidates_per_commit: 1,
            max_skill_bytes: 12_000,
            pre_push_blocks_pending: false,
            redact_secrets: true,
            signals: MemorySkillSignalsConfig::default(),
            review: MemorySkillReviewConfig::default(),
            scan: MemorySkillScanConfig::default(),
        }
    }
}

impl MemorySkillConfig {
    pub fn effective_enabled(&self, skills: &SkillsConfig) -> bool {
        skills.enabled && self.enabled && self.mode != MemorySkillMode::Off
    }
}

#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
#[serde(default)]
pub struct MemorySkillSignalsConfig {
    pub similarity_threshold: f64,
    pub min_occurrences: usize,
    pub require_reusable_procedure: bool,
    pub capture_passes_as_how_to: bool,
    pub capture_rejections_as_remediation: bool,
    pub capture_rejections_as_antipattern: bool,
    pub rejection_precedence: Vec<MemorySkillCandidateKind>,
}

impl Default for MemorySkillSignalsConfig {
    fn default() -> Self {
        Self {
            similarity_threshold: 0.55,
            min_occurrences: 2,
            require_reusable_procedure: true,
            capture_passes_as_how_to: true,
            capture_rejections_as_remediation: true,
            capture_rejections_as_antipattern: true,
            rejection_precedence: vec![
                MemorySkillCandidateKind::AntiPatternSkill,
                MemorySkillCandidateKind::RemediationSkill,
            ],
        }
    }
}

#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
#[serde(default)]
pub struct MemorySkillReviewConfig {
    pub require_adversarial_review: bool,
    pub require_reviewed_ledger_entry: bool,
    pub require_pass_for_how_to: bool,
    pub require_structured_findings_checked: bool,
    pub reject_without_ledger_entry: bool,
}

impl Default for MemorySkillReviewConfig {
    fn default() -> Self {
        Self {
            require_adversarial_review: true,
            require_reviewed_ledger_entry: true,
            require_pass_for_how_to: true,
            require_structured_findings_checked: true,
            reject_without_ledger_entry: true,
        }
    }
}

#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
#[serde(default)]
pub struct MemorySkillScanConfig {
    pub secret_detection: SecretDetectionMode,
    /// Optional scanner command. A non-zero exit is treated as a detected
    /// finding; best-effort mode only downgrades operational failures.
    pub secret_detector: String,
    pub allow_secret_detector_command: bool,
    pub secret_detector_timeout_seconds: u64,
    pub entropy_threshold: f64,
    pub blocked_patterns: Vec<String>,
    pub blocked_patterns_case_insensitive: bool,
}

impl Default for MemorySkillScanConfig {
    fn default() -> Self {
        Self {
            secret_detection: SecretDetectionMode::Required,
            secret_detector: String::new(),
            allow_secret_detector_command: false,
            secret_detector_timeout_seconds: 10,
            entropy_threshold: 4.5,
            blocked_patterns: Vec::new(),
            blocked_patterns_case_insensitive: true,
        }
    }
}

impl MemorySkillScanConfig {
    pub fn effective_blocked_patterns(&self) -> Vec<String> {
        let mut patterns = Vec::new();
        for pattern in DEFAULT_MEMORY_SKILL_BLOCKED_PATTERNS {
            push_unique_pattern(
                &mut patterns,
                pattern,
                self.blocked_patterns_case_insensitive,
            );
        }
        for pattern in &self.blocked_patterns {
            push_unique_pattern(
                &mut patterns,
                pattern,
                self.blocked_patterns_case_insensitive,
            );
        }
        patterns
    }
}

fn push_unique_pattern(patterns: &mut Vec<String>, pattern: &str, case_insensitive: bool) {
    let pattern = pattern.trim();
    if pattern.is_empty()
        || patterns.iter().any(|existing| {
            if case_insensitive {
                existing.eq_ignore_ascii_case(pattern)
            } else {
                existing == pattern
            }
        })
    {
        return;
    }
    patterns.push(pattern.to_owned());
}

#[derive(Clone, Copy, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
#[serde(rename_all = "kebab-case")]
pub enum SecretDetectionMode {
    #[default]
    Required,
    BestEffort,
    Off,
}

#[derive(Debug, Error)]
pub enum ConfigError {
    #[error("failed to read config {path}: {source}")]
    Read {
        path: PathBuf,
        #[source]
        source: io::Error,
    },
    #[error("failed to parse config {path}: {source}")]
    Parse {
        path: PathBuf,
        #[source]
        source: toml::de::Error,
    },
    #[error("failed to create system config {path}: {source}")]
    CreateSystemConfig {
        path: PathBuf,
        #[source]
        source: io::Error,
    },
    #[error("TRUTH_MIRROR_ENABLED must be 'true', 'false', '1', or '0', got '{value}'")]
    InvalidEnabledEnv { value: String },
    #[error("could not resolve system config directory; set XDG_CONFIG_HOME or HOME")]
    NoSystemConfigDir,
    #[error("pair for writer {writer:?} has an arbiter model equal to the reviewer model")]
    ArbiterNotDistinct { writer: String },
    #[error("memory_skill.scan.entropy_threshold must be finite and greater than 0.0, got {value}")]
    InvalidMemorySkillEntropyThreshold { value: f64 },
    #[error(
        "memory_skill.signals.similarity_threshold must be finite and between 0.0 and 1.0, got {value}"
    )]
    InvalidMemorySkillSimilarityThreshold { value: f64 },
    #[error(
        "reviewer.max_petition_batch_size must be between 1 and {MAX_PETITION_BATCH_SIZE}, got {value}"
    )]
    InvalidPetitionBatchSize { value: usize },
    #[error(
        "reviewer.max_concurrent_runs must be between 1 and {MAX_CONCURRENT_REVIEW_RUNS}, got {value}"
    )]
    InvalidConcurrentReviewRuns { value: usize },
    #[error("memory_skill.max_skill_bytes must be greater than 0")]
    InvalidMemorySkillMaxSkillBytes,
    #[error("memory_skill.scan.secret_detector_timeout_seconds must be greater than 0")]
    InvalidMemorySkillSecretDetectorTimeout,
}

fn default_enabled() -> bool {
    true
}

fn default_announce_when_disabled() -> bool {
    true
}

fn default_ledger_dir() -> String {
    DEFAULT_STATE_DIR.to_owned()
}

fn default_writer() -> String {
    "codex".to_owned()
}

/// Sensible opposed pairs so a repo with no `[pairs]` still reviews adversarially.
fn default_pairs() -> BTreeMap<String, AdversarialPair> {
    let mut pairs = BTreeMap::new();
    pairs.insert(
        "codex".to_owned(),
        AdversarialPair {
            reviewer: HarnessSelection::new("claude", "claude-opus-4-8", Effort::highest()),
            arbiter: Some(HarnessSelection::new(
                "pi",
                "openai-codex/gpt-5.5",
                Effort::highest(),
            )),
        },
    );
    pairs.insert(
        "claude".to_owned(),
        AdversarialPair {
            reviewer: HarnessSelection::new("codex", "gpt-5.5", Effort::highest()),
            // Arbiter must be a third distinct model. The reviewer is codex/gpt-5.5;
            // using pi/openai-codex/gpt-5.5 as arbiter would be the SAME underlying
            // model after provider-prefix stripping, violating the distinct-model rule.
            // Gemini (gemini-2.5-pro) is a genuinely different family and provider,
            // and InvocationPlan::for_harness supports ReviewerHarness::Gemini.
            arbiter: Some(HarnessSelection::new(
                "gemini",
                "gemini-2.5-pro",
                Effort::highest(),
            )),
        },
    );
    pairs.insert(
        "pi".to_owned(),
        AdversarialPair {
            reviewer: HarnessSelection::new("codex", "gpt-5.5", Effort::highest()),
            arbiter: Some(HarnessSelection::new(
                "claude",
                "claude-opus-4-8",
                Effort::highest(),
            )),
        },
    );
    // Grok is a watched agent surface, not a reviewer harness. Oppose with Claude
    // review + Codex arbiter so model/provider families stay distinct by default.
    pairs.insert(
        "grok".to_owned(),
        AdversarialPair {
            reviewer: HarnessSelection::new("claude", "claude-opus-4-8", Effort::highest()),
            arbiter: Some(HarnessSelection::new("codex", "gpt-5.5", Effort::highest())),
        },
    );
    pairs
}

/// Normalise a model identifier for opposition comparisons.
///
/// Strips the provider prefix (everything up to and including the last `/`)
/// so `openai-codex/gpt-5.5` compares equal to `gpt-5.5`. Keeps config
/// validation consistent with the runtime check in `reviewer::normalized_model`.
/// The prefix is only stripped when it leaves a non-empty suffix.
pub(crate) fn normalized_model(model: &str) -> String {
    let model = model.trim();
    let short = model
        .rsplit_once('/')
        .and_then(|(_, suffix)| {
            let s = suffix.trim();
            if s.is_empty() { None } else { Some(s) }
        })
        .unwrap_or(model);
    short.to_ascii_lowercase()
}

#[cfg(test)]
fn parse_env_enabled_for_test(value: &str) -> Result<Option<bool>, ConfigError> {
    if value.is_empty() {
        return Ok(None);
    }
    match value.trim().to_ascii_lowercase().as_str() {
        "true" | "1" => Ok(Some(true)),
        "false" | "0" => Ok(Some(false)),
        _ => Err(ConfigError::InvalidEnabledEnv {
            value: value.to_owned(),
        }),
    }
}
#[cfg(test)]
mod tests {
    use super::*;
    use std::path::Path;

    #[test]
    fn default_config_has_four_opposed_pairs() {
        let config = TruthMirrorConfig::default();

        assert_eq!(config.pairs.len(), 4);
        assert_eq!(config.ledger_dir, ".truth");
        assert!(config.skills.enabled);
        assert!(config.memory_skill.enabled);
        assert!(config.memory_skill.effective_enabled(&config.skills));
        assert_eq!(config.memory_skill.mode, super::MemorySkillMode::Stage);
        assert_eq!(config.memory_skill.signals.similarity_threshold, 0.55);
        let codex = config.pair_for("codex").unwrap();
        assert_eq!(codex.reviewer.harness, "claude");
        assert_eq!(codex.reviewer.model, "claude-opus-4-8");
        assert_eq!(codex.reviewer.effort, Effort::Xhigh);
        let grok = config.pair_for("grok").unwrap();
        assert_eq!(grok.reviewer.harness, "claude");
        assert_eq!(grok.reviewer.model, "claude-opus-4-8");
    }

    #[test]
    fn reviewer_batching_defaults_to_legacy_serial_petitions() {
        let config = TruthMirrorConfig::default();

        assert!(!config.reviewer.batch_petitions);
        assert_eq!(
            config.reviewer.max_petition_batch_size,
            super::MAX_PETITION_BATCH_SIZE
        );
        assert_eq!(config.reviewer.max_concurrent_runs, 1);
    }

    #[test]
    fn reviewer_batching_policy_parses_when_explicitly_enabled() {
        let contents = r#"
[reviewer]
batch_petitions = true
max_petition_batch_size = 7
max_concurrent_runs = 2
"#;

        let config = TruthMirrorConfig::from_toml_str(Path::new("config.toml"), contents).unwrap();

        assert!(config.reviewer.batch_petitions);
        assert_eq!(config.reviewer.max_petition_batch_size, 7);
        assert_eq!(config.reviewer.max_concurrent_runs, 2);
    }

    #[test]
    fn reviewer_concurrency_rejects_zero_and_values_above_the_bound() {
        for value in [0, super::MAX_CONCURRENT_REVIEW_RUNS + 1] {
            let contents = format!("[reviewer]\nmax_concurrent_runs = {value}\n");

            let error =
                TruthMirrorConfig::from_toml_str(Path::new("config.toml"), &contents).unwrap_err();

            assert!(matches!(
                error,
                super::ConfigError::InvalidConcurrentReviewRuns { value: invalid }
                    if invalid == value
            ));
        }
    }

    #[test]
    fn reviewer_batch_size_rejects_zero_and_values_above_the_bound() {
        for value in [0, super::MAX_PETITION_BATCH_SIZE + 1] {
            let contents =
                format!("[reviewer]\nbatch_petitions = true\nmax_petition_batch_size = {value}\n");

            let error =
                TruthMirrorConfig::from_toml_str(Path::new("config.toml"), &contents).unwrap_err();

            assert!(matches!(
                error,
                super::ConfigError::InvalidPetitionBatchSize { value: invalid }
                    if invalid == value
            ));
        }
    }

    #[test]
    fn reviewer_timeout_defaults_to_twenty_minutes() {
        let config = TruthMirrorConfig::default();

        assert_eq!(
            config.reviewer.timeout_secs,
            super::DEFAULT_REVIEWER_TIMEOUT_SECS
        );
        assert_eq!(
            config.reviewer.timeout(),
            Some(std::time::Duration::from_secs(20 * 60))
        );
    }

    #[test]
    fn reviewer_timeout_parses_and_zero_disables() {
        // A wedged reviewer froze the ONYXIO queue for hours (0.9.2 field
        // report): the timeout is configurable, and 0 opts out explicitly.
        let contents = "[reviewer]\ntimeout_secs = 90\n";
        let config = TruthMirrorConfig::from_toml_str(Path::new("config.toml"), contents).unwrap();
        assert_eq!(
            config.reviewer.timeout(),
            Some(std::time::Duration::from_secs(90))
        );

        let disabled = "[reviewer]\ntimeout_secs = 0\n";
        let config = TruthMirrorConfig::from_toml_str(Path::new("config.toml"), disabled).unwrap();
        assert_eq!(config.reviewer.timeout(), None);
    }

    #[test]
    fn effort_serializes_lowercase() {
        assert_eq!(Effort::Xhigh.as_str(), "xhigh");
        assert_eq!(Effort::highest(), Effort::Xhigh);
    }

    #[test]
    fn pairs_config_parses_and_resolves_by_writer() {
        // Arbiter must be distinct from reviewer after provider-prefix stripping:
        // gemini/gemini-2.5-pro normalizes to "gemini-2.5-pro", which != "gpt-5.5".
        let contents = r#"
default_writer = "claude"

[pairs.claude]
reviewer = { harness = "codex", model = "gpt-5.5", effort = "xhigh" }
arbiter  = { harness = "gemini", model = "gemini-2.5-pro", effort = "high" }

[pairs.codex]
reviewer = { harness = "claude", model = "claude-opus-4-8" }
"#;
        let config = TruthMirrorConfig::from_toml_str(Path::new("config.toml"), contents).unwrap();

        let claude_pair = config.pair_for("claude").unwrap();
        assert_eq!(claude_pair.reviewer.harness, "codex");
        assert_eq!(claude_pair.reviewer.effort, Effort::Xhigh);
        assert_eq!(claude_pair.arbiter.as_ref().unwrap().effort, Effort::High);

        // Omitted effort defaults to highest.
        let codex_pair = config.pair_for("codex").unwrap();
        assert_eq!(codex_pair.reviewer.effort, Effort::Xhigh);
    }

    #[test]
    fn arbiter_same_as_reviewer_after_prefix_strip_is_rejected() {
        // openai-codex/gpt-5.5 normalizes to gpt-5.5, same as the reviewer model.
        // This was the bug in the original claude default pair (B1/B2 remediation).
        let contents = r#"
[pairs.claude]
reviewer = { harness = "codex", model = "gpt-5.5" }
arbiter  = { harness = "pi", model = "openai-codex/gpt-5.5" }
"#;
        let result = TruthMirrorConfig::from_toml_str(Path::new("config.toml"), contents);
        assert!(result.is_err());
        let err = result.unwrap_err().to_string();
        assert!(
            err.contains("arbiter"),
            "expected arbiter error, got: {err}"
        );
    }

    #[test]
    fn default_claude_pair_arbiter_is_distinct_from_reviewer() {
        // B1 fix: the claude default pair used to have arbiter=pi/openai-codex/gpt-5.5
        // and reviewer=codex/gpt-5.5. After provider-prefix stripping both normalize
        // to "gpt-5.5", which is the same model. The fix changed the arbiter to
        // gemini/gemini-2.5-pro. This test ensures the default config loads without
        // ArbiterNotDistinct and has a genuinely distinct arbiter.
        let config = TruthMirrorConfig::default();
        let pair = config.pair_for("claude").expect("claude pair must exist");
        let arbiter = pair.arbiter.as_ref().expect("claude arbiter must be set");
        assert_eq!(
            arbiter.harness, "gemini",
            "claude arbiter harness must be gemini"
        );
        assert_ne!(
            super::normalized_model(&arbiter.model),
            super::normalized_model(&pair.reviewer.model),
            "claude arbiter must be distinct from reviewer after normalization"
        );
    }

    #[test]
    fn normalized_strips_provider_prefix_for_comparison() {
        // B2: openai-codex/gpt-5.5 and gpt-5.5 should normalize to the same token.
        assert_eq!(
            super::normalized_model("openai-codex/gpt-5.5"),
            super::normalized_model("gpt-5.5")
        );
        // Prefix-only values (bare "/") keep their identity to avoid false collisions.
        assert_ne!(super::normalized_model("/"), super::normalized_model(""));
    }

    #[test]
    fn legacy_review_block_overrides_default_pair() {
        // Reviewer distinct from the built-in codex default (claude/opus-4-8) so
        // the test proves the legacy block actually overrides the default rather
        // than coincidentally matching it.
        let contents = r#"
ledger_dir = ".truth-mirror"

[review.watched]
harness = "codex"
model = "gpt-5.5"

[review.reviewer]
harness = "gemini"
model = "gemini-3-pro"
"#;
        let config = TruthMirrorConfig::from_toml_str(Path::new("config.toml"), contents).unwrap();

        let pair = config.pair_for("codex").unwrap();
        assert_eq!(pair.reviewer.harness, "gemini");
        assert_eq!(pair.reviewer.model, "gemini-3-pro");
        // Other writers still resolve from defaults.
        assert!(config.pair_for("claude").is_some());
        assert!(config.pair_for("pi").is_some());
        assert!(config.pair_for("grok").is_some());
    }

    #[test]
    fn explicit_pairs_win_over_legacy_review() {
        // A mixed migration config must not let legacy [review] clobber a modern
        // explicit [pairs.<writer>] entry.
        let contents = r#"
[pairs.codex]
reviewer = { harness = "claude", model = "explicit-model" }

[review.watched]
harness = "codex"
model = "gpt-5.5"

[review.reviewer]
harness = "gemini"
model = "legacy-model"
"#;
        let config = TruthMirrorConfig::from_toml_str(Path::new("config.toml"), contents).unwrap();

        let pair = config.pair_for("codex").unwrap();
        assert_eq!(pair.reviewer.harness, "claude");
        assert_eq!(pair.reviewer.model, "explicit-model");
    }

    #[test]
    fn explicit_pairs_win_case_insensitively_over_legacy() {
        // `[pairs.CODEX]` (uppercase) must not be clobbered by a legacy [review]
        // folded under lowercase `codex`.
        let contents = r#"
[pairs.CODEX]
reviewer = { harness = "claude", model = "explicit-model" }

[review.watched]
harness = "codex"
model = "gpt-5.5"

[review.reviewer]
harness = "gemini"
model = "legacy-model"
"#;
        let config = TruthMirrorConfig::from_toml_str(Path::new("config.toml"), contents).unwrap();

        let pair = config.pair_for("codex").unwrap();
        assert_eq!(pair.reviewer.model, "explicit-model");
        // No duplicate CODEX/codex entries.
        assert_eq!(config.pairs.len(), 1);
    }

    #[test]
    fn arbiter_equal_to_reviewer_model_is_rejected() {
        let contents = r#"
[pairs.codex]
reviewer = { harness = "claude", model = "same-model" }
arbiter  = { harness = "pi", model = "same-model" }
"#;
        let error =
            TruthMirrorConfig::from_toml_str(Path::new("config.toml"), contents).unwrap_err();

        assert!(matches!(
            error,
            super::ConfigError::ArbiterNotDistinct { .. }
        ));
    }

    #[test]
    fn missing_config_loads_default() {
        let config = TruthMirrorConfig::load_or_default("missing-config.toml").unwrap();

        assert_eq!(config.pairs.len(), 4);
        assert!(config.ground_truth.enabled);
        assert_eq!(config.history.window_user, 3);
        assert!(!config.enforcement.is_enabled());
    }

    #[test]
    fn gates_config_parses_and_builds_policy() {
        let contents = r#"
[pairs.codex]
reviewer = { harness = "claude", model = "claude-opus-4-8" }

[gates]
fake_markers = ["pretend-pass"]
evidence_patterns = ["jira:"]
marker_ignore_paths = [".md", "vendor/"]
"#;
        let config = TruthMirrorConfig::from_toml_str(Path::new("config.toml"), contents).unwrap();

        // Config values are ADDITIVE: built-in defaults always apply, plus the
        // repo's custom entries. A repo can add but not silently disable defaults.
        // The default marker literal is built at runtime so it never appears as an
        // added line in this file (truth-mirror's own gate would flag it).
        let default_marker = ["mock", "as", "real"].join("-");
        let policy = config.gates.to_policy();
        assert!(policy.fake_markers.iter().any(|m| m == "pretend-pass"));
        assert!(policy.fake_markers.contains(&default_marker));
        assert!(policy.evidence_patterns.iter().any(|p| p == "jira:"));
        assert!(policy.evidence_patterns.iter().any(|p| p == "tests:"));
        assert!(policy.marker_ignore_paths.iter().any(|p| p == "vendor/"));
        assert!(policy.marker_ignore_paths.iter().any(|p| p == "openspec/"));
    }

    #[test]
    fn memory_skill_effective_enabled_requires_parent_self_and_active_mode() {
        let skills_enabled = super::SkillsConfig { enabled: true };
        let skills_disabled = super::SkillsConfig { enabled: false };
        let mut memory = super::MemorySkillConfig {
            enabled: true,
            mode: super::MemorySkillMode::Stage,
            ..super::MemorySkillConfig::default()
        };

        assert!(memory.effective_enabled(&skills_enabled));
        assert!(!memory.effective_enabled(&skills_disabled));

        memory.enabled = false;
        assert!(!memory.effective_enabled(&skills_enabled));

        memory.enabled = true;
        memory.mode = super::MemorySkillMode::Off;
        assert!(!memory.effective_enabled(&skills_enabled));
    }

    #[test]
    fn missing_config_file_enables_memory_skill() {
        let temp = tempfile::tempdir().unwrap();
        let config = TruthMirrorConfig::load_or_default(temp.path().join("missing.toml")).unwrap();

        assert!(config.skills.enabled);
        assert!(config.memory_skill.enabled);
        assert!(config.memory_skill.effective_enabled(&config.skills));
    }

    #[test]
    fn empty_config_enables_memory_skill() {
        let config = TruthMirrorConfig::from_toml_str(Path::new("config.toml"), "").unwrap();

        assert!(config.skills.enabled);
        assert!(config.memory_skill.enabled);
        assert!(config.memory_skill.effective_enabled(&config.skills));
    }

    #[test]
    fn config_without_skill_sections_enables_memory_skill() {
        let contents = r#"
[history]
window_user = 5

"#;
        let config = TruthMirrorConfig::from_toml_str(Path::new("config.toml"), contents).unwrap();

        assert!(config.skills.enabled);
        assert!(config.memory_skill.enabled);
        assert!(config.memory_skill.effective_enabled(&config.skills));
    }

    #[test]
    fn memory_skill_rejection_precedence_is_legacy_compatible() {
        let contents = r#"
[memory_skill.signals]
rejection_precedence = ["how_to_skill"]
"#;

        let config = TruthMirrorConfig::from_toml_str(Path::new("config.toml"), contents).unwrap();

        assert_eq!(
            config.memory_skill.signals.rejection_precedence,
            vec![super::MemorySkillCandidateKind::HowToSkill]
        );
    }

    #[test]
    fn memory_skill_entropy_threshold_must_be_finite() {
        let contents = r#"
[memory_skill.scan]
entropy_threshold = inf
"#;

        let error =
            TruthMirrorConfig::from_toml_str(Path::new("config.toml"), contents).unwrap_err();

        assert!(matches!(
            error,
            super::ConfigError::InvalidMemorySkillEntropyThreshold { .. }
        ));
    }
    #[test]
    fn runtime_enable_defaults_to_true_and_parses_top_level_false() {
        assert!(TruthMirrorConfig::default().enabled);
        let config =
            TruthMirrorConfig::from_toml_str(Path::new("config.toml"), "enabled = false\n")
                .unwrap();
        assert!(!config.enabled);
    }

    #[test]
    fn announce_when_disabled_defaults_true_and_uses_last_layer() {
        assert!(TruthMirrorConfig::default().announce_when_disabled);

        let system_disabled = super::TruthMirrorConfig::from_test_sources(
            Some("announce_when_disabled = false\n"),
            "",
            None,
        )
        .unwrap();
        assert!(!system_disabled.announce_when_disabled);

        let project_override = super::TruthMirrorConfig::from_test_sources(
            Some("announce_when_disabled = false\n"),
            "announce_when_disabled = true\n",
            None,
        )
        .unwrap();
        assert!(project_override.announce_when_disabled);
    }

    #[test]
    fn memory_skill_entropy_threshold_must_be_positive() {
        let contents = r#"
[memory_skill.scan]
entropy_threshold = 0.0
"#;

        let error =
            TruthMirrorConfig::from_toml_str(Path::new("config.toml"), contents).unwrap_err();

        assert!(matches!(
            error,
            super::ConfigError::InvalidMemorySkillEntropyThreshold { .. }
        ));
    }

    #[test]
    fn memory_skill_max_skill_bytes_must_be_positive() {
        let contents = r#"
[memory_skill]
max_skill_bytes = 0
"#;

        let error =
            TruthMirrorConfig::from_toml_str(Path::new("config.toml"), contents).unwrap_err();

        assert!(matches!(
            error,
            super::ConfigError::InvalidMemorySkillMaxSkillBytes
        ));
    }

    #[test]
    fn memory_skill_secret_detector_timeout_must_be_positive() {
        let contents = r#"
[memory_skill.scan]
secret_detector_timeout_seconds = 0
"#;

        let error =
            TruthMirrorConfig::from_toml_str(Path::new("config.toml"), contents).unwrap_err();

        assert!(matches!(
            error,
            super::ConfigError::InvalidMemorySkillSecretDetectorTimeout
        ));
    }

    #[test]
    fn memory_skill_similarity_threshold_must_be_finite_and_bounded() {
        for value in ["-0.1", "1.1", "nan", "inf"] {
            let contents = format!("[memory_skill.signals]\nsimilarity_threshold = {value}\n");
            let error =
                TruthMirrorConfig::from_toml_str(Path::new("config.toml"), &contents).unwrap_err();
            assert!(matches!(
                error,
                super::ConfigError::InvalidMemorySkillSimilarityThreshold { .. }
            ));
        }
    }

    #[test]
    fn empty_gate_lists_fall_back_to_defaults() {
        // An explicitly empty list must not silently disable a gate.
        let policy = super::GatesConfig {
            fake_markers: Vec::new(),
            evidence_patterns: Vec::new(),
            marker_ignore_paths: Vec::new(),
        }
        .to_policy();

        assert!(!policy.fake_markers.is_empty());
        assert!(!policy.evidence_patterns.is_empty());
        assert!(!policy.marker_ignore_paths.is_empty());
    }

    #[test]
    fn memory_skill_blocked_patterns_trim_and_dedupe() {
        let config = super::MemorySkillScanConfig {
            blocked_patterns: vec![
                " API_KEY ".to_owned(),
                " custom ".to_owned(),
                " ".to_owned(),
                "custom".to_owned(),
            ],
            ..super::MemorySkillScanConfig::default()
        };

        let patterns = config.effective_blocked_patterns();

        assert_eq!(
            patterns
                .iter()
                .filter(|pattern| pattern.eq_ignore_ascii_case("api_key"))
                .count(),
            1
        );
        assert_eq!(
            patterns
                .iter()
                .filter(|pattern| *pattern == "custom")
                .count(),
            1
        );
        assert!(patterns.iter().all(|pattern| pattern.trim() == pattern));
    }

    #[test]
    fn pair_keys_are_lowercased() {
        let contents = r#"
[pairs.CODEX]
reviewer = { harness = "claude", model = "claude-opus-4-8" }
"#;
        let config = TruthMirrorConfig::from_toml_str(Path::new("config.toml"), contents).unwrap();

        assert!(config.pair_for("codex").is_some());
        assert!(config.pair_for("CoDeX").is_some());
    }

    #[test]
    fn checked_in_config_asset_parses_to_defaults() {
        let parsed = TruthMirrorConfig::from_toml_str(
            Path::new("assets/config.toml"),
            super::DEFAULT_CONFIG_ASSET,
        )
        .expect("checked-in asset must be valid and pass validation");
        let expected = TruthMirrorConfig::default();
        assert_eq!(parsed, expected);
    }
    #[test]
    fn system_false_project_true_is_disabled() {
        let config = super::TruthMirrorConfig::from_test_sources(
            Some("enabled = false\n"),
            "enabled = true\n",
            None,
        )
        .unwrap();
        assert!(!config.enabled);
    }

    #[test]
    fn project_false_env_true_is_disabled() {
        let config =
            super::TruthMirrorConfig::from_test_sources(None, "enabled = false\n", Some(true))
                .unwrap();
        assert!(!config.enabled);
    }

    #[test]
    fn env_false_overrides_project_true() {
        let config =
            super::TruthMirrorConfig::from_test_sources(None, "enabled = true\n", Some(false))
                .unwrap();
        assert!(!config.enabled);
    }

    #[test]
    fn default_asset_is_enabled() {
        let config = super::TruthMirrorConfig::from_test_sources(None, "", None).unwrap();
        assert!(config.enabled);
    }

    #[test]
    fn ensure_project_config_creates_and_preserves_existing_bytes() {
        let temp = tempfile::tempdir().unwrap();
        let state_dir = temp.path().join(".truth");
        super::ensure_project_config(&state_dir).unwrap();
        let path = state_dir.join("config.toml");
        assert!(path.is_file());
        assert_eq!(
            std::fs::read_to_string(&path).unwrap(),
            super::DEFAULT_CONFIG_ASSET
        );
        std::fs::write(&path, "custom").unwrap();
        super::ensure_project_config(&state_dir).unwrap();
        assert_eq!(std::fs::read_to_string(&path).unwrap(), "custom");
    }

    #[test]
    fn invalid_env_value_is_a_hard_error() {
        let result = super::parse_env_enabled_for_test("maybe");
        assert!(matches!(
            result,
            Err(super::ConfigError::InvalidEnabledEnv { .. })
        ));
    }

    #[test]
    fn valid_env_values_are_accepted() {
        assert_eq!(
            super::parse_env_enabled_for_test("true").unwrap(),
            Some(true)
        );
        assert_eq!(
            super::parse_env_enabled_for_test("false").unwrap(),
            Some(false)
        );
        assert_eq!(super::parse_env_enabled_for_test("1").unwrap(), Some(true));
        assert_eq!(super::parse_env_enabled_for_test("0").unwrap(), Some(false));
        assert_eq!(super::parse_env_enabled_for_test("").unwrap(), None);
    }
}