# =============================================================================
# SafeClaw — Offline-First, RAG-First, MCP-Exposed Stack
# Config Schema v1.0 (Controller-Grade)
# =============================================================================

# ===========================
# core: app identity & modes
# ===========================
app:
  name: "safeclaw-rag-gateway"
  env: "local"                  # local | dev | prod
  mode: "offline"               # offline | hybrid (hybrid enables gated Grok fallback)
  debug: false

# ===========================
# models: local + online
# ===========================
models:
  local_llm:
    provider: "lmstudio"
    base_url: "http://127.0.0.1:1234/v1"
    model: "qwen2.5-7b-instruct"
    max_tokens: 2048
    temperature: 0.3
    timeout_sec: 400

  embeddings:
    provider: "sentence-transformers"
    model: "all-MiniLM-L6-v2"
    dim: 384
    cache_dir: "./.emb_cache"

  grok:
    enabled: false
    base_url: "https://api.x.ai/v1"
    model: "grok-beta"
    timeout_sec: 20
    max_tokens: 2048
    temperature: 0.2

# ===========================
# corpus & indexing
# ===========================
corpus:
  path: "data/corpus"
  extensions: [".md", ".txt"]

indexing:
  chroma_path: "index/chroma_db"
  bm25_path: "index/bm25.pkl"
  collection_name: "safeclaw_kb"
  chunk_size: 512
  chunk_overlap: 50
  batch_size: 50

# =================================================
# retrieval: hybrid search + thresholds
# =================================================
retrieval:
  top_k_semantic: 5
  top_k_keyword: 5
  rrf_k: 60
  max_context_tokens: 2400
  min_score: 0.025

  hybrid:
    enabled: true
    rrf:
      k: 60
      vector_weight: 0.6
      bm25_weight: 0.4

# ===========================
# policy: gates & guardrails
# ===========================
policy:
  fallback:
    enabled: true
    require_user_confirm: true
    send_local_context_to_grok: false

  prompt_filter:
    enabled: true
    banned_patterns:
      - "ignore previous instructions"
      - "ignore all instructions"
      - "you are now in developer mode"
      - "as an ai with no restrictions"
      - "system prompt:"
      - "disregard your instructions"
      - "pretend you are"
      - "jailbreak"
    max_input_chars: 4000

  privacy:
    redact_emails: true
    redact_ips: true
    redact_secrets_like:
      - "AKIA[0-9A-Z]{16}"
      - "xoxb-[0-9a-zA-Z-]+"
      - "sk-[a-zA-Z0-9]{20,}"

# ===========================
# api: FastAPI gateway
# ===========================
api:
  host: "127.0.0.1"
  port: 8787
  request_timeout_sec: 60

# ===========================
# logging & audit
# ===========================
logging:
  level: "INFO"
  log_file: "./logs/gateway.log"
  audit_file: "./logs/audit.jsonl"

  audit_fields:
    include_query_hash: true
    include_top_score: true
    include_retrieval_mode: true
    include_online_escalated: true
    include_model_used: true

# ===========================
# security
# ===========================
security:
  require_env:
    - "GROK_API_KEY"
  allowed_origins:
    - "http://127.0.0.1"
    - "http://localhost"
  rate_limit:
    enabled: true
    requests_per_minute: 60

# ===========================
# mcp: server registration
# ===========================
mcp:
  server_name: "safeclaw-hybrid-rag"
  version: "1.0.0"
  capabilities:
    tools: true
    sampling: false
