Example configuration

Copy this file to ~/.provefab/provefab.toml (or $PROVEFAB_HOME/provefab.toml), adapt it, then run provefab doctor. Every field is described in Configuration.

# Provefab configuration: copy this file to ~/.provefab/provefab.toml
# (or to $PROVEFAB_HOME/provefab.toml), then adapt it.
# Full reference: docs/guide/configuration.md
# No secret here: the TypeSafe key goes in the macOS Keychain, or on Linux in credentials.toml (provefab login jev).

[jev]
model = "jev-1.13.0"            # full, pinned version; never "jev-latest"
underspecified_threshold = 0.7  # above this, Provefab asks a question instead of coding
loop_threshold = 0.8            # above this, an agent going in circles is stopped

# Which model a stage takes inside its tier (docs/guide/configuration.md).
[routing]
prefer = "subscription"          # your plans first, then API keys by price;
                                 # or "api_key", or "cheapest"
# prices_url = "https://models.dev/api.json"   # a mirror; prices refresh daily

# The catalog: the models Provefab may use, by tier.
# Inside a tier, the cheapest usable model goes first (see [routing]).
# All claude-code stages temporarily refuse before host version/auth probes.
# Remove or replace every claude-code entry in an existing/init-generated catalog.
# Successful doctor/login results do not establish stage support. Keep user state.
[[models]]
id = "codex-gpt"
worker = "codex"
model = "gpt-5.5"
tier = "standard"
# Codex requires exactly 0.162.1, personal/API file authentication and no
# system/managed/cloud policy sources; see the native policy configuration guide.

[[models]]
id = "codex-frontier"
worker = "codex"
model = "gpt-5.5"
tier = "frontier"
# This minimal catalog has one provider. Add a Pi model from another provider
# for cross-provider review; choose its provider/model from your installed Pi catalog.

# One block per watched repository.
[[repos]]
slug = "your-account/your-repo"
# local_path = "~/code/your-repo"   # optional: without it, Provefab clones into ~/.provefab/repos
label = "provefab"
base = "main"
poll_interval = "3m"
gates = ["cargo fmt -- --check", "cargo clippy --offline --all-targets -- -D warnings", "cargo test --offline"]
# Provision dependencies before tasks start. Network downloads and binding are denied.
# Optional: checks run against the exact merge commit after this repo's
# Provefab-created PR merges. If they fail and still fail on the current base,
# Provefab opens a human-reviewed revert PR, only when the reverted tree passes.
# Never put secrets in these commands: failing command lines are posted on GitHub.
# post_merge_checks = ["cargo test", "cargo clippy --all-targets -- -D warnings"]
# [repos.merge]                  # read by Provefab Pro only: guarded auto-merge
# auto = true
# max_lines = 400

# Native sandbox for this repository. Provision SRT outside the checkout first.
# Tested SRT: 0.0.79. No unsandboxed fallback; missing runtime fails gates.
[repos.sandbox]
runtime = "srt"                  # trusted PATH lookup, or an absolute external executable
allow_local_network = false      # true currently refuses: loopback-only binding is unverified
protected_paths = []              # explicit validators; empty makes no immutability guarantee
# protected_paths = ["tests", "scripts/check.sh", "Cargo.lock", "/opt/checks/check.sh"]
# Include the scripts, config, fixtures and dependencies that define success.
# No automatic dependency closure: protecting an entrypoint alone is insufficient.
deny_read = []                    # extra literal absolute host-secret paths
# Native gates/Codex/Pi tools exercised on macOS with SRT 0.0.79, Codex 0.162.1,
# Pi 1.0.3. Linux enforcement is unverified; unavailable enforcement refuses.

# Risk-aware policy (optional): changed paths in ci, dependencies, migrations,
# infrastructure or secrets-config get a frontier reviewer (when one from another
# provider than the implementer's is configured), a Risk section in the PR and a
# provefab:risk-<category> label. Add your own sensitive paths:
# [repos.risk]
# disable = ["infrastructure"]                # turn a built-in category off
# [repos.risk.categories.auth]
# paths = ["src/auth/**", "src/billing/**"]   # anchored at the repository root
# checks = ["cargo test --test auth"]         # extra commands after gates, when touched
# reviewer_tier = "frontier"                  # or "standard"

# Issues from Jira Cloud or Linear instead of GitHub issues (optional). Code and
# pull requests stay on GitHub. Credentials: `provefab login jira --site <site>`
# or `provefab login linear`, never in this file. See docs/guide/trackers.md.
# [repos.tracker]
# kind = "jira"                  # "github" (default), "jira" or "linear"
# site = "acme.atlassian.net"    # Jira only
# project = "ENG"                # Jira project key or Linear team key

[limits]
stage_timeout = "30m"
gate_timeout = "20m"
max_turns = { plan = 40, implement = 150, review = 40 }
review_rounds = 2
max_auto_passes = 3
max_stage_runs_per_day = 60
max_drive_steps = 200
retry_delays = ["5m", "15m", "45m"]