Struct MissionConfig 

pub struct MissionConfig {

    pub orchestrator: RoleConfig,
    pub worker: RoleConfig,
    pub validator_scrutiny: RoleConfig,
    pub validator_functional: RoleConfig,
    pub skip_scrutiny: bool,
    pub skip_functional: bool,
    pub reviewer_independence: ReviewerIndependence,
    pub max_fix_cycles_per_milestone: u32,
    pub max_respawns: u32,
    pub max_parallel_workers: u32,
    pub event_stream_throttle_ms: u64,
    pub planning_idle_release_minutes: u64,
    pub auto_work: bool,
    pub considered_alternatives_feature_threshold: usize,
    pub considered_alternatives_touch_set_threshold: usize,
    pub considered_alternatives_high_usd_threshold: f64,
    pub deny_patterns: Vec<String>,
    pub allow_validator_commands: Vec<String>,
    pub dangerously_allow_all: bool,
    pub allow_below_default_worker_model: bool,
    pub claude_binary: Option<String>,
    pub worker_isolation: WorkerIsolation,
    pub contract_env_passthrough: Vec<String>,
    pub workspace: WorkspaceConfig,
    pub pack_dir: Option<String>,
    pub rubber_stamp_threshold_ms: u64,
    pub worker_candidates: Vec<CandidateSpec>,
    pub routing: RoutingConfig,
    pub hook_status: Option<HookStatusConfig>,
    pub validator_allow_uncontained_degrade: bool,
    pub local_backend_allowed_hosts: Vec<String>,
}

Fields

orchestrator: RoleConfig

worker: RoleConfig

validator_scrutiny: RoleConfig

validator_functional: RoleConfig

skip_scrutiny: bool

skip_functional: bool

reviewer_independence: ReviewerIndependence

Require a different model family for the selected reviewer roles. Pinned at approval; cannot be changed through runtime config patches.

max_fix_cycles_per_milestone: u32

max_respawns: u32

max_parallel_workers: u32

event_stream_throttle_ms: u64

planning_idle_release_minutes: u64

An in-planning mission whose hosted engine sits idle this many minutes is released (its events.jsonl lock freed); 0 disables auto-release.

auto_work: bool

When true, the serve process drains the queue automatically whenever entries are waiting. Default off.

considered_alternatives_feature_threshold: usize

Require Plan.consideredAlternatives when feature count reaches this threshold. 0 disables this trigger.

considered_alternatives_touch_set_threshold: usize

Require Plan.consideredAlternatives when touchSet breadth reaches this threshold. 0 disables this trigger.

considered_alternatives_high_usd_threshold: f64

Require Plan.consideredAlternatives when the estimated high cost reaches this threshold. 0.0 disables this trigger.

deny_patterns: Vec<String>

Extra Bash deny patterns beyond the built-in list (§4.7).

allow_validator_commands: Vec<String>

Commands validators may run, in addition to contract commands.

dangerously_allow_all: bool

Loud, never-default escape hatch.

allow_below_default_worker_model: bool

Explicit mission opt-in for worker models below the default worker tier.

Default false: cheap/lower-tier workers must be chosen deliberately on the mission config rather than becoming a silent global default.

claude_binary: Option<String>

Path to the claude binary (auto-discovered when None).

worker_isolation: WorkerIsolation

How worker/validator sessions are isolated (§M7 tier 1).

contract_env_passthrough: Vec<String>

Escape hatch for the cleared contract-command environment (ticket agent-env-clear): NAMES of ambient env vars copied verbatim into the env of contract command assertions (validation round, final gate, approval-time lint). This is the sanctioned way to give a contract command one credential (e.g. a private-registry token the toolchain-cache passthrough does not cover). Values are never logged — decision records list names only. Names colliding with the contract env’s own managed keys (PATH/HOME/TMPDIR/ KRANZ_BASE_SHA/toolchain caches) are refused. Everything else ambient is cleared before the command runs.

workspace: WorkspaceConfig

Workspace provider seam (design D-B). provider absent = local-worktree; unknown names fail closed at run start.

pack_dir: Option<String>

Pack contract (ticket pack-contract-gates-prompts): directory of the pack this mission runs with — a pack.toml declaring deterministic gates, role prompts, checklists, and artefact stores (docs/pack-contract.md). Relative paths resolve against the repo root. Loaded and validated (fail-closed, naming the offending field) at run start and at each consuming surface; absent ⇒ byte-identical pack-less behavior.

rubber_stamp_threshold_ms: u64

Outcomes-report flag threshold (ticket rubber-stamp-grant-flag): grants APPROVED in under this many milliseconds are flagged as rubber-stamp signals — a flag on a report row, never an enforcement. The default (10s) is the docs/metrics.md §2 bucket made configurable.

worker_candidates: Vec<CandidateSpec>

Heterogeneous dispatch pool (ticket heterogeneous-dispatch-pool, KRZ-303; the positioning ADR’s 2026-07-31 boundary gloss). Empty (the default) is today’s single-backend worker behavior EXACTLY. With ≥2 candidates, every worker feature — the unit of work — is dispatched to ALL of them concurrently, one git worktree per stream, and every output is recorded as a sibling CandidateLinked run: a candidate for judgement, never auto-merged into a winner (no code path selects or merges one), and the mission then parks for the human judgement act the follow-up divergence ticket surfaces. The claimed value is divergence for scrutiny, never throughput; cost multiplies by N and the approval-time estimate prices the SUM. config::validate rejects a 1-entry list (use worker.backend), local/acp entries (no per-candidate endpoint config in this pass), and combining the pool with maxParallelWorkers > 1 (a different fan-out model).

routing: RoutingConfig

The backend routing table (ticket backend-routing-abstraction, KRZ-331): ordered task-class → executor-tier rules, resolved deterministically by crate::routing at mission seed time (crate::config::route_task_class_executor). Empty (the default) keeps today’s hardcoded literal floor byte-for-byte. Capability classes only — a rule names an ExecutorTier, never a model id; which endpoint a local route resolves to is ordinary local-backend role config, so a hosted fine-tune needs no new kind here.

hook_status: Option<HookStatusConfig>

Hook-derived status-signal lane (ticket agent-hooks-status-signals). Absent/disabled = byte-identical pre-lane behavior; enabled installs hook config ONLY into session-private scratch HOMEs on hook-capable backends.

validator_allow_uncontained_degrade: bool

EXPLICIT per-repo opt-in for the uncontained-validator degrade (ticket validator-containment-degrade-fail-closed, 14th-pass review): when the mandatory validator containment wrap cannot apply (an uncontainable platform, linux without bwrap, a validator backend that does not honor the resolved sandbox), validation now FAILS CLOSED by default — the degrade reopens the modify→use→restore path the mandatory-containment work was built to close. This reverses the recorded 224fa73 decision (loud-degrade-by-default); setting this true restores that posture: the validator runs uncontained with the loud per-round degradation decision, snapshot isolation, and the after-fingerprint tripwire as the only remaining layers.

local_backend_allowed_hosts: Vec<String>

Non-loopback hosts a local-backend baseUrl may name (audit 2026-09-01, MEDIUM baseUrl).

The engine POSTs the assembled system + user prompt to baseUrl from the engine process, outside every sandbox, and the readiness probe connects to whatever host:port it names. config::validate therefore requires the host to be loopback unless it is listed here — the same reasoning hookStatus.endpoint already carries. OPERATOR-ONLY: the project config layer may not set this key (it is the escape hatch from the rule, so a repo that could set it would face no rule at all). Empty (the default) means loopback only.

Implementations

impl MissionConfig

pub fn isolation(&self) -> WorkerIsolation

pub fn role(&self, role: Role) -> &RoleConfig

pub fn backend_kind(&self, role: Role) -> BackendKind

Which backend drives a role’s sessions. config::validate rejects unknown backend strings before runtime; this accessor treats any unexpected value as Claude as a conservative fallback for callers that operate on already-validated config.

pub fn executor_tier(&self) -> ExecutorTier

Which inference tier the Worker executes on under this config, derived from the Worker RoleConfig.backend rather than stored: ExecutorTier::Local when the Worker backend is BackendKind::Local, else ExecutorTier::Frontier. A configured dispatch pool (worker_candidates) is always Frontier: pool candidates are never local-backed (validation rejects local entries), so a stray local worker.backend alongside a pool must not classify the spend as $0-marginal. The config-level home of the derivation — MissionState::executor_tier delegates here, and the per-session route record (ExecutorRoute) reads the same source.

Trait Implementations

impl Clone for MissionConfig

fn clone(&self) -> MissionConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MissionConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for MissionConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for MissionConfig

where MissionConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for MissionConfig

fn eq(&self, other: &MissionConfig) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for MissionConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for MissionConfig