Module consts_policy 

Policy constants: our choices. Changing one changes behavior and therefore requires EVAL evidence or an explicit ruling. Data only — zero branches by charter. The part crates/kernel/spec/ConstsPolicy.lean specifies this module.

Five entries carry a type rather than a plain number (crates/kernel/spec/ConstsPolicy.lean §8-8): AUTONOMY_DEFAULT, CLOCK_STAMP_DEFAULT, and the three limits whose refusal derives from their type (crates/kernel/spec/PolicyLimit.lean §8-73).

Structs

Ratio

Exact ratio as an integer pair: kernel decision paths never touch floats (determinism rule 6). Kept unreduced so the spelling mirrors the value as it was decided.

Constants

AUTONOMY_DEFAULT

Who reads the Approval Inbox in a city nobody has configured: the person, because the inbox holds design questions and a design question is the kind a person wants. What a run may do is settled by the gates, which answer from the rules and never ask.

BYTES_PER_TOKEN

Bytes per token, typical: the rate every budget that crosses the two units is converted at. It is an estimate for English prose and code, and it is deliberately not the worst-case ratio INTERVAL_CAP_BYTES reasons from - a budget that has to hold is sized by the worst case, a budget that has to be spent is sized by the typical one.

CLOCK_STAMP_DEFAULT

Every Timestamped result carries the clock line, and a Timeless one at most once a minute, until a layer writes [clock] stamp: a model that cannot tell when a command ran cannot tell a stale answer from a fresh one (runtime D8).

CLOCK_ZONES_MAX

CREDENTIAL_NAME_MARKERS

Words that make an environment variable name read as a credential (11.1). Matched as a case-insensitive substring, so AWS_SECRET_KEY and npm_password are both caught.

CTX_REMINDER_FIRST_PERCENT

Where the context reminder’s two rungs sit, as whole percents of the window. The first is not adjustable: one number, one meaning. The second is the one a layer may move, and these three numbers are the whole of what it may move it between — kernel::config::SecondThreshold enforces the domain at its one construction point.

CTX_REMINDER_SECOND_DEFAULT

CTX_REMINDER_SECOND_MAX

CTX_REMINDER_SECOND_MIN

DEFAULT_AT

Where a city listens when nobody says otherwise: the loopback interface, so a city started by a double-click is reachable from the browser on that machine and from nowhere else.

DISCARD_FILES_MAX

DISCARD_RETENTION_DAYS

DRAFT_HELD_ESCALATE

EDIT_WAR_FREEZE

EXCHANGE_BUDGET_BYTES

What one turn’s exchange — its assistant reply and its wave’s results — may occupy in the window, in bytes. Shared evenly across the exchange’s texts when the whole does not fit; which end of a text survives is runtime::compaction’s decision, and this file only says how much there is.

HALL_BUILDING

The building raised with every city, which holds the city’s own plan and the two residents that serve every other building.

HALL_CLERK

Who answers approvals when the person delegated them. Genesis writes the delegation as an event rather than baking it into AUTONOMY_DEFAULT: who answers is a decision this city made, and a decision the person can change needs a line of history to change.

HALL_MAYOR

The city’s planner. It writes Markdown and plans; it does not build.

IMAGES_PER_TURN

Four pictures in one turn. Past that the window is being spent on pixels rather than on the work, and a limit stated once is what a refusal can name.

IMAGE_MAX_BYTES

2 MiB per picture. A ceiling a refusal can state and a person can raise, sized so a base64 body (4/3 of this) stays inside what both providers accept.

IMAGE_QUALITY

100 is the whole domain a lossy encoder has. Refused rather than clamped where a caller names one: quality: 120 is a caller that believes it asked for something better, and an answer clamped to 100 would agree with it.

INTERVAL_CAP_BYTES

What one interval of a document may carry into the window: 64 KiB, cut on a line end, continued by the offset the answer reports.

LOOP_REPEAT_THRESHOLD

OFFLOAD_MIN_BYTES

Floor, not threshold: the effective offload bound is derived by pipeline from window headroom (4.4).

OUTPUT_CEILING_DEFAULT

How long one answer may be on the messages face when nobody has said: 8_192 tokens.

PREFIX_SLOTS

How many slots a whole-prefix budget divides evenly across. runtime::prefix::SegmentSlot is the authority on how many slots there are, and runtime::prefix::tests holds this divisor against that enum so the two cannot drift apart.

SANDBOX_FUEL_DEFAULT

Instruction budget for one sandboxed call when no layer states one. Large enough that ordinary work finishes, small enough that a loop stops rather than runs until somebody notices: the point of fuel is that exhaustion is a verdict the city writes down, not a machine that gets slow.

SECRET_ENTROPY_MIN

3.5 bits/char. Second constant scheduled for re-estimation; evidence = false-positive rate on repository and fixture corpora.

STARTUP_BUDGET_TOKENS

WORKTREE_MAX_BYTES

2 GiB per node’s working tree. A ceiling rather than a free-space probe: free space is a moving fact about one machine, while this is the number a refusal can state and a person can raise. Checked before a tree is created, so an over-large city is refused rather than half-copied (11.4).