Module consts_policy 

Policy constants: our choices. Changing one changes behavior and therefore requires EVAL evidence or an explicit ruling. Data only — zero branches by charter. The part crates/kernel/spec/ConstsPolicy.lean specifies this module.

Six entries carry a type rather than a plain number (crates/kernel/spec/ConstsPolicy.lean §8-8): AUTONOMY_DEFAULT, CLOCK_STAMP_DEFAULT, DEFAULT_EFFORT, and the three limits whose refusal derives from their type (crates/kernel/spec/PolicyLimit.lean §8-73).

Structs

Ratio

Exact ratio as an integer pair: kernel decision paths never touch floats (determinism rule 6). Kept unreduced so the spelling mirrors the value as it was decided.

Constants

AUTONOMY_DEFAULT

Who reads the Approval Inbox in a city nobody has configured: the person, because the inbox holds design questions and a design question is the kind a person wants. What a run may do is settled by the gates, which answer from the rules and never ask.

BYTES_PER_TOKEN

Bytes per token, typical: the rate every budget that crosses the two units is converted at. It is an estimate for English prose and code, and it is deliberately not the worst-case ratio INTERVAL_CAP_BYTES reasons from - a budget that has to hold is sized by the worst case, a budget that has to be spent is sized by the typical one.

CLOCK_STAMP_DEFAULT

Every Timestamped result carries the clock line, and a Timeless one at most once a minute, until a layer writes [clock] stamp: a model that cannot tell when a command ran cannot tell a stale answer from a fresh one (runtime D8).

CLOCK_ZONES_MAX

CREDENTIAL_NAME_MARKERS

Words that make an environment variable name read as a credential (11.1). Matched as a case-insensitive substring, so AWS_SECRET_KEY and npm_password are both caught.

CTX_REMINDER_FIRST_PERCENT

Where the context reminder’s two rungs sit, as whole percents of the window. The first is not adjustable: one number, one meaning. The second is the one a layer may move, and these three numbers are the whole of what it may move it between — kernel::config::SecondThreshold enforces the domain at its one construction point.

CTX_REMINDER_SECOND_DEFAULT

CTX_REMINDER_SECOND_MAX

CTX_REMINDER_SECOND_MIN

DEFAULT_AT

Where a city listens when nobody says otherwise: the loopback interface, so a city started by a double-click is reachable from the browser on that machine and from nowhere else.

DEFAULT_EFFORT

The thinking level a request takes when nobody stated one, if the (Endpoint, model) offers it: a balanced level for a person who never opened the setting. Whether it is used is the answer of the gateway’s thinking ladder, which falls back to the upstream’s own default when this level is not offered (crates/kernel/spec/Model.lean D56).

DISCARD_FILES_MAX

DISCARD_RETENTION_DAYS

DRAFT_HELD_ESCALATE

EDIT_WAR_FREEZE

EXCHANGE_BUDGET_BYTES

What one turn’s exchange — its assistant reply and its wave’s results — may occupy in the window, in bytes. Shared evenly across the exchange’s texts when the whole does not fit; which end of a text survives is runtime::compaction’s decision, and this file only says how much there is.

HALL_BUILDING

The building raised with every city, which holds the city’s own plan and the two residents that serve every other building.

HALL_CLERK

Who answers approvals when the person delegated them. Genesis writes the delegation as an event rather than baking it into AUTONOMY_DEFAULT: who answers is a decision this city made, and a decision the person can change needs a line of history to change.

HALL_MAYOR

The city’s planner. It writes Markdown and plans; it does not build.

IMAGES_PER_TURN

Four pictures in one turn. Past that the window is being spent on pixels rather than on the work, and a limit stated once is what a refusal can name.

IMAGE_MAX_BYTES

2 MiB per picture. A ceiling a refusal can state and a person can raise, sized so a base64 body (4/3 of this) stays inside what both providers accept.

IMAGE_QUALITY

100 is the whole domain a lossy encoder has. Refused rather than clamped where a caller names one: quality: 120 is a caller that believes it asked for something better, and an answer clamped to 100 would agree with it.

INTERVAL_CAP_BYTES

What one interval of a document may carry into the window: 64 KiB, cut on a line end, continued by the offset the answer reports.

LOOP_REPEAT_THRESHOLD

OFFLOAD_MIN_BYTES

Floor, not threshold: the effective offload bound is derived by pipeline from window headroom (4.4).

OUTPUT_CEILING_DEFAULT

How long one answer may be on the messages face when nobody has said: 8_192 tokens.

PREFIX_SLOTS

How many slots a whole-prefix budget divides evenly across. runtime::prefix::SegmentSlot is the authority on how many slots there are, and runtime::prefix::tests holds this divisor against that enum so the two cannot drift apart.

SANDBOX_FUEL_DEFAULT

Instruction budget for one sandboxed call when no layer states one. Large enough that ordinary work finishes, small enough that a loop stops rather than runs until somebody notices: the point of fuel is that exhaustion is a verdict the city writes down, not a machine that gets slow.

SECRET_ENTROPY_MIN

3.5 bits/char. Second constant scheduled for re-estimation; evidence = false-positive rate on repository and fixture corpora.

STARTUP_BUDGET_TOKENS

WORKTREE_MAX_BYTES

2 GiB per node’s working tree. A ceiling rather than a free-space probe: free space is a moving fact about one machine, while this is the number a refusal can state and a person can raise. Checked before a tree is created, so an over-large city is refused rather than half-copied (11.4).