# A0 Software Orchestrator — Default Plugin Config
# Source of truth for orchestrator behavior.
# Per-project/per-agent overrides via standard plugin config system.

advanced_packs:
  coolify_deep_handoff: false
  extended_permissions: false
  full_evaluation_harness: false
  operations_deep_readiness: false
  security_data_deep_audit: false
autonomy:
  default_level: balanced
  levels:
    balanced:
      commits: true
      deploy: false
      local_changes: true
      push: false
    high:
      commits: true
      deploy_production: false
      deploy_staging: false
      local_changes: true
      push_feature_branch: true
    low:
      commits: false
      deploy: false
      local_changes: false
      push: false
autonomy_level: balanced
block_compact:
  conversation_summary_file: .a0/conversation_summary.md
  enabled: true
  max_conversation_summary_lines: 200
  min_lines_user_status: 30
  note: 'NEU: automatisches Block-Compact-Protokoll. Vor jedem Compact MÜSSEN alle
    5 mandatory artifacts aktualisiert sein + next_steps.md nicht leer. Schutz vor
    Info-Verlust.'
  require_user_approval: false
  resume_file: .a0/resume.md
  snapshot_dir: .a0/session_snapshots
  threshold_hard: 0.9
  threshold_warn: 0.8
cost_control:
  context_hard_threshold: 0.9
  context_warning_threshold: 0.8
  max_subagent_calls_per_work_block: 3
  max_subagent_result_lines: 80
  max_user_status_lines: 30
  prefer_repo_state_over_chat_history: true
  raw_logs_to_files: false
  release_auditor_every_n_blocks: 3
  summarize_long_outputs: true
external_tools:
  browser:
    enabled: true
    required_for_web_apps: false
    mode: public_ui_smoke_only_explicit_user_approval_no_auth_without_user_provided_test_account
    tool_name: browser
  coolify:
    enabled: true
    required: false
    tool_name: coolify
  docker:
    enabled: true
    required: false
    tool_name: docker
  forgejo:
    enabled: true
    required: false
    tool_name: forgejo
  git:
    enabled: true
    required: false
    tool_name: git
  github:
    enabled: false
    required: false
    tool_name: github
  terminal:
    enabled: true
    required: true
    tool_name: terminal
gates:
  require_user_approval_for:
  - implementation_start
  - production_deploy
  - push_to_main
  - destructive_command
  - secret_change
  - database_migration
  - dependency_major_change
  - scope_change_major
model_routing:
  create_profile_model_config_files: false
  fallback_to_current_agent_model: true
  mode: per_agent_profile
  roles:
    a0_software_orchestrator:
      preset: strong-reasoning
      purpose: User dialogue, overview, plan mode, delegation, decisions
    codebase_explorer:
      preset: cheap-long-context
      purpose: Repo exploration and compressed findings
    implementation_engineer:
      preset: best-coding
      purpose: Code implementation and refactoring
    release_auditor:
      preset: cheap-fast
      purpose: Audit, release readiness, handoff, next steps
    requirements_analyst:
      preset: strong-reasoning
      purpose: Requirements, acceptance criteria, assumptions, non-goals
    runtime_devops_engineer:
      preset: reasoning-devops
      purpose: Runtime verification, deployment basics, Coolify handoff basics
    security_data_engineer:
      preset: strong-reasoning
      purpose: Security, data, migration and backup risks
    solution_architect:
      preset: strong-reasoning
      purpose: Architecture, design, task graph, deployment implications
    test_debug_engineer:
      preset: balanced-coding
      purpose: Tests, logs, debugging, root cause
orchestrator:
  hide_subagent_details_from_user: true
  mode: core
  require_agents_md: true
  require_git_repo: true
  require_known_errors_file: true
  require_next_step_before_stop: true
  require_plan_mode: true
  require_project_artifacts: true
  require_worklog_after_each_work_block: true
  subagent_visibility: compact
plan_mode:
  default_mode: planning_only
  require_explicit_transition_to_implementation: true
  require_release_audit_before_handoff: true
  require_runtime_report_before_deployment: true
quality:
  minimum_score_for_production_handoff: 90
  minimum_score_for_release: 80
storage:
  allow_custom_code_root: true
  default_code_root: /a0/usr/workdir/dev-projects
  require_user_confirmation_for_new_root: true

credential_handling:
  mode: no_live_secret_access
  safe_sources:
    - env_example
    - docs
    - config_schema
    - compose_placeholders
    - coolify_redacted_metadata
    - user_redacted_confirmation
  restricted_sources:
    - live_secret_files
    - credential_stores
    - shell_history
    - runtime_environment_dumps
    - logs_for_credential_discovery
    - browser_stores
    - cookies
    - sessions
    - config_files_with_live_values
  restricted_actions:
    - credential_value_search
    - credential_discovery_command
    - secret_value_validation
    - login_credential_search
    - authenticated_ui_login_attempt_without_user_provided_test_account