Rotation for ~/.mur/queue/events.jsonl, in the shape FreeBSD’s
newsyslog(8) uses: rotate past a size, keep a bounded number of
generations, compress all but the newest, drop the oldest.
Routing for Anthropic subscription-OAuth (sk-ant-oat*) tokens through a
local bridge — cc-proxy — that swaps x-api-key for the Bearer +
claude-code betas disguise the upstream requires.
Daemon-wide gate for unattended fleet auto-run (mur-daemon’s fleet_tick).
Stored under fleet: in ~/.mur/config.yaml. Either this flag OR the
MUR_FLEET_AUTORUN env var satisfies the gate — both are equally explicit,
off-by-default opt-ins; the env var remains for ops/CI use, this flag is
what the Hub’s Settings toggle controls. Per-fleet budget_usd > 0 and the
.stopped kill-switch are unaffected — see mur-daemon/src/fleet_tick.rs.
Authorization gate for the runtime’s built-in fleet_run tool. Stored under
fleet_run: in ~/.mur/config.yaml. Deny-by-default on BOTH axes: an agent
not named in agents never even sees the tool, and a fleet not named in
fleets cannot be run. Lives in the global config (not the agent profile)
because the profile is writable by the concierge itself — this gate must be
out of reach of a prompt-injected agent (same rationale as
ParallelJobsConfig).
Proactive memory capture (memory federation P2): gates the runtime’s
built-in remember tool and its system-prompt directive. Stored under
memory: in ~/.mur/config.yaml.
Authorization gate for the parallel_jobs MCP tool. Stored under parallel_jobs:
in ~/.mur/config.yaml. Deny-by-default: an empty targets list means the
tool cannot delegate to ANY agent (inert until the user opts specific
agents in). This is a deterministic, out-of-model gate that a
prompt-injected concierge cannot widen (OWASP Agentic ASI02/03/04).
When enabled, the daemon fires a consolidation pipeline after the user has been
idle for idle_threshold_minutes minutes (default 15). Opt-in only — off by default.
Smart background routing: auto-pick a cheap model for low-stakes/background
requests instead of always dialing the agent’s primary model_ref. Defaults
OFF — enable it globally (mur model smart on) or per agent. cheap: None
auto-picks the cheapest registry entry that can serve the request
(mur_common::model::pick_cheap_model).
Partial view of SmartConfig for per-agent overrides: None on a field
means “inherit the global value”. A distinct type rather than reusing
SmartConfig, because a full config standing in for a partial is exactly
what made an omitted field silently mean false instead of “unset”.
Daemon-side settings for the signed snapshot pull. Stored under
federation_snapshot: in ~/.mur/config.yaml; every field has a default
so an absent block means “defaults”, never “off”.
Default model id seeded for the built-in “Mur” agent and used to name the
bundled MLX weights. This is the DEFAULT VALUE only — it is written into the
seed agent’s profile and can be changed by the user afterwards; it is not a
behavioural constant baked into logic.
The Ollama provider default endpoint. Single definition — BackendConfig
resolution (default_ollama_endpoint), config_migrate, and the
conversations doctor/preflight probes all read this constant instead of
repeating the literal.
Smart background routing is opt-in. Its failure mode is silent and
irreversible for the turn it degrades, which is the kind of automation that
has to be asked for. See the capability-gate spec §2.