Struct OrchestrationConfig 

pub struct OrchestrationConfig {

    pub enabled: bool,
    pub max_tasks: u32,
    pub max_parallel: u32,
    pub default_failure_strategy: FailureStrategy,
    pub default_max_retries: u32,
    pub task_timeout_secs: u64,
    pub planner_provider: ProviderName,
    pub planner_max_tokens: u32,
    pub dependency_context_budget: usize,
    pub confirm_before_execute: bool,
    pub aggregator_max_tokens: u32,
    pub deferral_backoff_ms: u64,
    pub plan_cache: PlanCacheConfig,
    pub topology_selection: bool,
    pub verify_provider: ProviderName,
    pub verify_max_tokens: u32,
    pub max_replans: u32,
    pub verify_completeness: bool,
    pub tool_provider: ProviderName,
    pub completeness_threshold: f32,
    pub cascade_routing: bool,
    pub cascade_failure_threshold: f32,
    pub tree_optimized_dispatch: bool,
    pub adaptorch: AdaptOrchConfig,
    pub cascade_chain_threshold: usize,
    pub cascade_failure_rate_abort_threshold: f32,
    pub lineage_ttl_secs: u64,
    pub verify_predicate_enabled: bool,
    pub predicate_provider: ProviderName,
    pub max_predicate_replans: u32,
    pub predicate_timeout_secs: u64,
    pub persistence_enabled: bool,
    pub orchestrator_provider: ProviderName,
    pub default_task_budget_cents: f64,
    pub default_asset_sensitivity: AssetSensitivity,
    pub aggregator_timeout_secs: u64,
    pub planner_timeout_secs: u64,
    pub verifier_timeout_secs: u64,
    pub whole_plan_verifier_timeout_secs: u64,
    pub ensemble: EnsembleConfig,
    pub default_idle_timeout_secs: Option<u64>,
    pub command: CommandConfig,
}

Configuration for the task orchestration subsystem ([orchestration] TOML section).

Fields

enabled: bool

Enable the orchestration subsystem.

max_tasks: u32

Maximum number of tasks in a single graph.

max_parallel: u32

Maximum number of tasks that can run in parallel.

default_failure_strategy: FailureStrategy

Default failure strategy applied to every task graph unless overridden per-task.

default_max_retries: u32

Default number of retries for the retry failure strategy.

task_timeout_secs: u64

Timeout in seconds for a single task. 0 means no timeout.

planner_provider: ProviderName

Provider name from [[llm.providers]] for planning LLM calls. Empty string = use the agent’s primary provider.

planner_max_tokens: u32

Maximum tokens budget hint for planner responses. Reserved for future use when per-call token limits are added to the LlmProvider::chat API.

dependency_context_budget: usize

Total character budget for cross-task dependency context injection.

confirm_before_execute: bool

Whether to show a confirmation prompt before executing a plan.

aggregator_max_tokens: u32

Maximum tokens budget for aggregation LLM calls. Default: 4096.

deferral_backoff_ms: u64

Base backoff for ConcurrencyLimit retries; grows exponentially (×2 each attempt) up to 5 s.

plan_cache: PlanCacheConfig

Plan template caching configuration.

topology_selection: bool

Enable topology-aware concurrency selection. When true, TopologyClassifier adjusts max_parallel based on the DAG structure. Default: false (opt-in).

verify_provider: ProviderName

Provider name from [[llm.providers]] for verification LLM calls. Empty string = use the agent’s primary provider. Should be a cheap/fast provider.

verify_max_tokens: u32

Maximum tokens budget for verification LLM calls. Default: 1024.

max_replans: u32

Maximum number of replan cycles per graph execution. Default: 2.

Prevents infinite verify-replan loops. 0 = disable replan (verification still runs, gaps are logged only).

verify_completeness: bool

Enable post-task completeness verification. Default: false (opt-in).

When true, completed tasks are evaluated by PlanVerifier. Task stays Completed during verification; downstream tasks are unblocked immediately. Verification is best-effort and does not gate dispatch.

tool_provider: ProviderName

Provider name from [[llm.providers]] for tool-dispatch routing. When set, tool-heavy tasks prefer this provider over the primary. Prefer mid-tier models (e.g., qwen2.5:14b) for reliability per arXiv:2601.16280. Empty string = use the primary provider.

completeness_threshold: f32

Minimum completeness score (0.0–1.0) for the plan to be accepted without replanning. Default: 0.7. When the verifier reports confidence < completeness_threshold AND gaps exist, a replan cycle is triggered. Used by both per-task and whole-plan verification. Values outside [0.0, 1.0] are rejected at startup by Config::validate().

cascade_routing: bool

Enable cascade-aware routing for Mixed-topology DAGs. Requires topology_selection = true. When enabled, tasks in failing subtrees are deprioritized in favour of healthy branches. Default: false (opt-in).

cascade_failure_threshold: f32

Failure rate threshold (0.0–1.0) above which a DAG region is considered “cascading”. Must be in (0.0, 1.0]. Default: 0.5.

tree_optimized_dispatch: bool

Enable tree-optimized dispatch for FanOut/FanIn topologies. Sorts the ready queue by critical-path distance (deepest tasks first) to minimize end-to-end latency. Default: false (opt-in).

adaptorch: AdaptOrchConfig

AdaptOrch bandit-driven topology advisor. Default: disabled.

cascade_chain_threshold: usize

Consecutive-chain cascade abort threshold: number of consecutive Failed entries in a depends_on chain that triggers a DAG abort.

0 disables linear-chain cascade abort. Default: 3. Must not be 1 — a threshold of 1 would abort on every single failure.

cascade_failure_rate_abort_threshold: f32

Fan-out cascade abort failure-rate threshold (0.0–1.0).

When a DAG region’s failure rate reaches this value AND the region has ≥ 3 tasks, the DAG is aborted immediately. 0.0 disables this signal (opt-in). Recommended production value: 0.7.

lineage_ttl_secs: u64

TTL for lineage entries in seconds. Entries older than this are pruned during chain merge. Setting this too low can prevent detection of slow-build cascades.

Default: 300 seconds (5 minutes).

verify_predicate_enabled: bool

Enable per-subtask predicate verification gate.

Requires predicate_provider or a primary LLM provider to be configured. Default: false (opt-in).

predicate_provider: ProviderName

Provider name from [[llm.providers]] for predicate evaluation.

Empty string = fall back to verify_provider, then primary.

max_predicate_replans: u32

Maximum number of predicate-driven task re-runs across the entire DAG.

Independent of max_replans (verifier completeness budget). Default: 2.

predicate_timeout_secs: u64

Timeout in seconds for each predicate LLM evaluation call.

On timeout the evaluator returns a fail-open outcome (passed = true, confidence = 0.0) and logs a warning. Default: 30.

persistence_enabled: bool

Persist task graph state to SQLite across scheduler ticks.

When true and a SemanticMemory store is available, the scheduler snapshots the graph once per tick and on plan completion. Graphs can then be rehydrated via /plan resume <id> after a restart. Default: true.

orchestrator_provider: ProviderName

Provider name from [[llm.providers]] for scheduling-tier LLM calls (aggregation, predicate evaluation, verification when no specific provider is set).

Acts as fallback for verify_provider and predicate_provider when those are empty. Does NOT affect planner_provider — planning is a complex task and stays on the quality provider. Empty string = use the agent’s primary provider.

Trade-off

Setting this to a fast/cheap model reduces aggregation quality because LlmAggregator produces user-visible output. See CHANGELOG for details.

default_task_budget_cents: f64

Default per-task cost budget in US cents. 0.0 = unlimited (no budget check).

When a sub-agent task completes, the scheduler emits a tracing::warn! if the task exceeded this budget. In MVP this is warn-only — hard enforcement requires per-task CostTracker scoping, which is deferred post-v1.0.0.

Individual tasks can override this via TaskNode::token_budget_cents. Default: 0.0 (unlimited).

default_asset_sensitivity: AssetSensitivity

Default asset sensitivity level for task nodes that do not set their own.

Advisory only in the current implementation — the dispatcher does not yet auto-restrict tool access based on this field. See specs/069-threat-model/spec.md §5.

TOML: [orchestration] default_asset_sensitivity = "public" Default: public (no restriction).

aggregator_timeout_secs: u64

Timeout in seconds for aggregation LLM calls. Default: 60.

On timeout the aggregator falls back to raw concatenation so that a graph result is always returned. Set to 0 is rejected by Config::validate().

planner_timeout_secs: u64

Timeout in seconds for planner LLM calls. Default: 120.

On timeout the planner returns OrchestrationError::PlanningFailed. Planning has no fallback — without a graph no tasks can be dispatched. Set to 0 is rejected by Config::validate().

verifier_timeout_secs: u64

Timeout in seconds for verifier LLM calls (per-task and whole-plan). Default: 120.

On timeout the verifier returns a fail-open result (complete = true, no gaps) and ground() is never called, so the entire tool-call grounding safety net (spec 009, #6278/#6287) silently never runs for that verification. Local Ollama models in the 20B+ parameter range (e.g. gemma4:26b) commonly take 60-120s to respond, so a low timeout here causes fail-open to trigger on essentially every verification when verify_provider targets such a model — see #6366. Set to 0 is rejected by Config::validate().

whole_plan_verifier_timeout_secs: u64

Timeout in seconds for the whole-plan verify_plan() LLM call. 0 = fall back to verifier_timeout_secs. Default: 0.

verify_plan() runs once per plan (after all tasks complete) whereas per-task verify() runs many times per plan — a shared timeout budget forces both to the same value even though they are invoked at structurally different points. See #6379.

ensemble: EnsembleConfig

ORCH-style deterministic verifier ensemble-merge configuration. Default: disabled. See specs/073-orch-ensemble-merge/spec.md.

default_idle_timeout_secs: Option<u64>

Global default idle/no-progress timeout in seconds, used when a TaskNode’s own TimeoutPolicy.idle_timeout_secs is unset. None (the default) disables idle enforcement — it is opt-in, unlike task_timeout_secs.

A task is killed if no progress heartbeat is observed for this many seconds — a heartbeat is written once per agent-loop turn boundary, so this value must be set above the longest expected single-turn (single LLM call + its tool calls) duration, or a healthy task performing one long-running tool call can be killed spuriously. Only enforced on the normal spawn dispatch path; RunInline tasks (no sub-agent definitions configured) are exempt. See specs/075-orchestration-node-control-parity/spec.md §4/FR-005.

command: CommandConfig

Command-style dynamic task handoff configuration (spec-080, GitHub #6363). Default: disabled. See specs/080-cross-thread-store-dynamic-handoff/spec.md.

Trait Implementations

impl Clone for OrchestrationConfig

fn clone(&self) -> OrchestrationConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OrchestrationConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for OrchestrationConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for OrchestrationConfig

where OrchestrationConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for OrchestrationConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.