Config Reference (Generated)

Machine-readable companion to docs/config-reference.md. Every key below was verified to exist in config.yaml at generation time — no invented keys. Lab values (config.yaml) vs schema defaults (tools/config_manager.py:CONFIG_SCHEMA) are both shown where they differ. See docs/configuration/overview.md for loading/precedence and docs/configuration/validation.md for type checks.

Source locations use config.yaml:<top-level-line> + tools/config_manager.py:CONFIG_SCHEMA path. Consumers are primary file:line citations; full call graph is in docs/module-guide.md.

Generated 2026-09-07 from config.yaml (439 leaf keys, 46 top-level blocks). Lab-only keys (not in CONFIG_SCHEMA) are marked.

Key	Type	Default (schema → lab)	Allowed	Source	Consumer(s)	Effect	Env override	Restart	Subsystem	Tests
adaptive_exploits.enabled	bool	True	—	config.yaml:381 + CONFIG_SCHEMA['adaptive_exploits'].enabled	cli_exploit_settings.py, mcp_tools/attack_modules.py	Mutation engine	—	no	exploit	tests/test_mutator.py
adaptive_exploits.max_mutations	int	5	—	config.yaml:381 + CONFIG_SCHEMA['adaptive_exploits'].max_mutations	cli_exploit_settings.py, mcp_tools/attack_modules.py	Mutation engine	—	no	exploit	tests/test_mutator.py
adaptive_exploits.mutation_strategies	list[str]	['parameter_tweak', 'encoding_change', 'delivery_swap', 'context_aware']	—	config.yaml:381 + CONFIG_SCHEMA['adaptive_exploits'].mutation_strategies	cli_exploit_settings.py, mcp_tools/attack_modules.py	Mutation engine	—	no	exploit	tests/test_mutator.py
agent.capability_discovery_enabled	bool	True	—	config.yaml:513 + CONFIG_SCHEMA['agent'].capability_discovery_enabled	attack_planner.py, decision_log.py	Task graph	—	no	agent	tests/test_agent*.py
agent.decision_log_enabled	bool	True	—	config.yaml:513 + CONFIG_SCHEMA['agent'].decision_log_enabled	attack_planner.py, decision_log.py	Task graph	—	no	agent	tests/test_agent*.py
agent.generated_code_repair_attempts	int	3	—	config.yaml:513 + CONFIG_SCHEMA['agent'].generated_code_repair_attempts	attack_planner.py, decision_log.py	Task graph	—	no	agent	tests/test_agent*.py
agent.max_actions	int	0	—	config.yaml:513 + CONFIG_SCHEMA['agent'].max_actions	attack_planner.py, decision_log.py	Task graph	—	no	agent	tests/test_agent*.py
agent.max_retries_per_task	int	2	—	config.yaml:513 + CONFIG_SCHEMA['agent'].max_retries_per_task	attack_planner.py, decision_log.py	Task graph	—	no	agent	tests/test_agent*.py
agent.planner_hints_enabled	bool	True	—	config.yaml:513 + CONFIG_SCHEMA['agent'].planner_hints_enabled	attack_planner.py, decision_log.py	Task graph	—	no	agent	tests/test_agent*.py
agent.reflection_enabled	bool	True	—	config.yaml:513 + CONFIG_SCHEMA['agent'].reflection_enabled	attack_planner.py, decision_log.py	Task graph	—	no	agent	tests/test_agent*.py
agent.state_tools_enabled	bool	True	—	config.yaml:513 + CONFIG_SCHEMA['agent'].state_tools_enabled	attack_planner.py, decision_log.py	Task graph	—	no	agent	tests/test_agent*.py
agent.task_graph_enabled	bool	True	—	config.yaml:513 + CONFIG_SCHEMA['agent'].task_graph_enabled	attack_planner.py, decision_log.py	Task graph	—	no	agent	tests/test_agent*.py
api.allowed_origins	list	[]	—	config.yaml:438 + CONFIG_SCHEMA['api'].allowed_origins	app.py, api/*, doctor.py	WebUI daemon	—	yes	api/webui	tests/test_api*.py
api.enabled	bool	True	—	config.yaml:438 + CONFIG_SCHEMA['api'].enabled	app.py, api/*, doctor.py	WebUI daemon	—	yes	api/webui	tests/test_api*.py
api.event_buffer_size	int	256	—	config.yaml:438 + CONFIG_SCHEMA['api'].event_buffer_size	app.py, api/*, doctor.py	WebUI daemon	—	yes	api/webui	tests/test_api*.py
api.graph_route	bool	True	—	config.yaml:438 + CONFIG_SCHEMA['api'].graph_route	app.py, api/*, doctor.py	WebUI daemon	—	yes	api/webui	tests/test_api*.py
api.host	str	'127.0.0.1'	127.0.0.1 | localhost | ::1 else ERROR	config.yaml:438 + CONFIG_SCHEMA['api'].host	app.py, api/*, doctor.py	WebUI daemon	—	yes	api/webui	tests/test_api*.py
api.max_concurrent_runs	int	3 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:438 (lab extra)	app.py, api/*, doctor.py	WebUI daemon	—	yes	api/webui	tests/test_api*.py
api.multi_operator	bool	True (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:438 (lab extra)	app.py, api/*, doctor.py	WebUI daemon	—	yes	api/webui	tests/test_api*.py
api.port	int	8765	—	config.yaml:438 + CONFIG_SCHEMA['api'].port	app.py, api/*, doctor.py	WebUI daemon	—	yes	api/webui	tests/test_api*.py
api.serve_webui	bool	False (schema) → True (lab)	—	config.yaml:438 + CONFIG_SCHEMA['api'].serve_webui	app.py, api/*, doctor.py	WebUI daemon	—	yes	api/webui	tests/test_api*.py
api.shutdown_timeout_seconds	int	15	—	config.yaml:438 + CONFIG_SCHEMA['api'].shutdown_timeout_seconds	app.py, api/*, doctor.py	WebUI daemon	—	yes	api/webui	tests/test_api*.py
api.token_file	str	'.webui_secret_key'	—	config.yaml:438 + CONFIG_SCHEMA['api'].token_file	app.py, api/*, doctor.py	WebUI daemon	BREACHPILOT_API_TOKEN overrides	yes	api/webui	tests/test_api*.py
autonomous.adaptive_replan	bool	False	—	config.yaml:198 + CONFIG_SCHEMA['autonomous'].adaptive_replan	autonomous_orchestrator.py	Orchestrator Phase 2	—	no	autonomous	tests/test_autonomous*.py
autonomous.checkpoint_every	int	0	—	config.yaml:198 + CONFIG_SCHEMA['autonomous'].checkpoint_every	autonomous_orchestrator.py	Orchestrator Phase 2	—	no	autonomous	tests/test_autonomous*.py
autonomous.dedup_targets	bool	False (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:198 (lab extra)	autonomous_orchestrator.py	Orchestrator Phase 2	—	no	autonomous	tests/test_autonomous*.py
autonomous.hard_target_max_rounds	int	0 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:198 (lab extra)	autonomous_orchestrator.py	Orchestrator Phase 2	—	no	autonomous	tests/test_autonomous*.py
autonomous.max_cycles	int	100	—	config.yaml:198 + CONFIG_SCHEMA['autonomous'].max_cycles	autonomous_orchestrator.py	Orchestrator Phase 2	—	no	autonomous	tests/test_autonomous*.py
autonomous.max_parallel_targets	int	1 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:198 (lab extra)		—	—	no	autonomous	—
autonomous.max_pivot_depth	int	0	—	config.yaml:198 + CONFIG_SCHEMA['autonomous'].max_pivot_depth	autonomous_orchestrator.py	Orchestrator Phase 2	—	no	autonomous	tests/test_autonomous*.py
autonomous.persistence_phase	bool	False	—	config.yaml:198 + CONFIG_SCHEMA['autonomous'].persistence_phase	autonomous_orchestrator.py	Orchestrator Phase 2	—	no	autonomous	tests/test_autonomous*.py
autonomous.skip_non_routable	bool	False (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:198 (lab extra)	autonomous_orchestrator.py	Orchestrator Phase 2	—	no	autonomous	tests/test_autonomous*.py
benchmark.baseline_path	str	'reports/benchmarks/baseline.json'	—	config.yaml:276 + CONFIG_SCHEMA['benchmark'].baseline_path		—	—	no	benchmark	—
benchmark.enabled	bool	True	—	config.yaml:276 + CONFIG_SCHEMA['benchmark'].enabled		—	—	no	benchmark	—
benchmark.output_dir	str	'reports/benchmarks'	—	config.yaml:276 + CONFIG_SCHEMA['benchmark'].output_dir		—	—	no	benchmark	—
benchmark.regression.cost_tolerance	float	0.3	—	config.yaml:276 + CONFIG_SCHEMA['benchmark'].regression.cost_tolerance		—	—	no	benchmark	—
benchmark.regression.enabled	bool	True	—	config.yaml:276 + CONFIG_SCHEMA['benchmark'].regression.enabled		—	—	no	benchmark	—
benchmark.regression.false_positive_tolerance	float	0.01	—	config.yaml:276 + CONFIG_SCHEMA['benchmark'].regression.false_positive_tolerance		—	—	no	benchmark	—
benchmark.regression.median_time_tolerance	float	0.2	—	config.yaml:276 + CONFIG_SCHEMA['benchmark'].regression.median_time_tolerance		—	—	no	benchmark	—
benchmark.regression.success_rate_tolerance	float	0.02	—	config.yaml:276 + CONFIG_SCHEMA['benchmark'].regression.success_rate_tolerance		—	—	no	benchmark	—
benchmark.regression.tool_actions_tolerance	float	0.3	—	config.yaml:276 + CONFIG_SCHEMA['benchmark'].regression.tool_actions_tolerance		—	—	no	benchmark	—
benchmark.sandbox_required	bool	True	—	config.yaml:276 + CONFIG_SCHEMA['benchmark'].sandbox_required		—	—	no	benchmark	—
benchmark.telemetry.cost	bool	True	—	config.yaml:276 + CONFIG_SCHEMA['benchmark'].telemetry.cost		—	—	no	benchmark	—
benchmark.telemetry.events	bool	True	—	config.yaml:276 + CONFIG_SCHEMA['benchmark'].telemetry.events		—	—	no	benchmark	—
benchmark.telemetry.token_usage	bool	True	—	config.yaml:276 + CONFIG_SCHEMA['benchmark'].telemetry.token_usage		—	—	no	benchmark	—
benchmark.timeout_seconds	int	1800	—	config.yaml:276 + CONFIG_SCHEMA['benchmark'].timeout_seconds		—	—	no	benchmark	—
benchmark.trials	int	3	—	config.yaml:276 + CONFIG_SCHEMA['benchmark'].trials		—	—	no	benchmark	—
browser.allow_mutating_actions	bool	False	—	config.yaml:299 + CONFIG_SCHEMA['browser'].allow_mutating_actions		—	—	no	browser	—
browser.artifact_dir	str	''	—	config.yaml:299 + CONFIG_SCHEMA['browser'].artifact_dir		—	—	no	browser	—
browser.backend	str	'none' (schema) → 'playwright' (lab)	—	config.yaml:299 + CONFIG_SCHEMA['browser'].backend		—	—	no	browser	—
browser.body_sample_max_bytes	int	4096	—	config.yaml:299 + CONFIG_SCHEMA['browser'].body_sample_max_bytes		—	—	no	browser	—
browser.capture_console	bool	False	—	config.yaml:299 + CONFIG_SCHEMA['browser'].capture_console		—	—	no	browser	—
browser.capture_network	bool	True	—	config.yaml:299 + CONFIG_SCHEMA['browser'].capture_network		—	—	no	browser	—
browser.capture_screenshots	bool	True	—	config.yaml:299 + CONFIG_SCHEMA['browser'].capture_screenshots		—	—	no	browser	—
browser.console_max_events	int	200	—	config.yaml:299 + CONFIG_SCHEMA['browser'].console_max_events		—	—	no	browser	—
browser.dom_summary_max_chars	int	8000	—	config.yaml:299 + CONFIG_SCHEMA['browser'].dom_summary_max_chars		—	—	no	browser	—
browser.enabled	bool	False (schema) → True (lab)	—	config.yaml:299 + CONFIG_SCHEMA['browser'].enabled		—	—	no	browser	—
browser.executable_path	str	''	—	config.yaml:299 + CONFIG_SCHEMA['browser'].executable_path		—	—	no	browser	—
browser.headless	bool	True	—	config.yaml:299 + CONFIG_SCHEMA['browser'].headless		—	—	no	browser	—
browser.max_sessions	int	2	—	config.yaml:299 + CONFIG_SCHEMA['browser'].max_sessions		—	—	no	browser	—
browser.navigation_timeout_seconds	int	30	—	config.yaml:299 + CONFIG_SCHEMA['browser'].navigation_timeout_seconds		—	—	no	browser	—
browser.network_max_events	int	500	—	config.yaml:299 + CONFIG_SCHEMA['browser'].network_max_events		—	—	no	browser	—
browser.persist_storage	bool	False	—	config.yaml:299 + CONFIG_SCHEMA['browser'].persist_storage		—	—	no	browser	—
browser.session_timeout_seconds	int	300	—	config.yaml:299 + CONFIG_SCHEMA['browser'].session_timeout_seconds		—	—	no	browser	—
browser.worker_image	str	''	—	config.yaml:299 + CONFIG_SCHEMA['browser'].worker_image		—	—	no	browser	—
caldera.api_key_env	str	'CALDERA_API_KEY'	—	config.yaml:509 + CONFIG_SCHEMA['caldera'].api_key_env	plugins/caldera/plugin.py	Caldera emulation	CALDERA_API_KEY	no	ad
caldera.enabled	bool	False (schema) → True (lab)	—	config.yaml:509 + CONFIG_SCHEMA['caldera'].enabled	plugins/caldera/plugin.py	Caldera emulation	—	no	ad
caldera.url	str	''	—	config.yaml:509 + CONFIG_SCHEMA['caldera'].url	plugins/caldera/plugin.py	Caldera emulation	—	no	ad
chatgpt.enabled	bool	False (schema) → True (lab)	—	config.yaml:561 + CONFIG_SCHEMA['chatgpt'].enabled	providers/chatgpt_provider.py, model_router.py, doctor.py	ChatGPT proxy	—	yes	providers	tests/test_chatgpt*.py
cve_lookup.api_key_env	str	'NVD_API_KEY'	—	config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].api_key_env	mcp_shared, cve_lookup.py	NVD + KEV/EPSS	NVD_API_KEY	no	research/cve	tests/test_cve_lookup.py
cve_lookup.cache_max_entries	int	100	—	config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].cache_max_entries	mcp_shared, cve_lookup.py	NVD + KEV/EPSS	—	no	research/cve	tests/test_cve_lookup.py
cve_lookup.cache_ttl_seconds	int	3600	—	config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].cache_ttl_seconds	mcp_shared, cve_lookup.py	NVD + KEV/EPSS	—	no	research/cve	tests/test_cve_lookup.py
cve_lookup.circuit_failure_threshold	int	5	—	config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].circuit_failure_threshold	mcp_shared, cve_lookup.py	NVD + KEV/EPSS	—	no	research/cve	tests/test_cve_lookup.py
cve_lookup.circuit_recovery_timeout	float	60.0	—	config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].circuit_recovery_timeout	mcp_shared, cve_lookup.py	NVD + KEV/EPSS	—	no	research/cve	tests/test_cve_lookup.py
cve_lookup.enabled	bool	True	—	config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].enabled	mcp_shared, cve_lookup.py	NVD + KEV/EPSS	—	no	research/cve	tests/test_cve_lookup.py
cve_lookup.epss_enabled	bool	True	—	config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].epss_enabled	mcp_shared, cve_lookup.py	NVD + KEV/EPSS	—	no	research/cve	tests/test_cve_lookup.py
cve_lookup.github.token_env	str	'GITHUB_TOKEN'	—	config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].github.token_env	mcp_shared, cve_lookup.py	NVD + KEV/EPSS	GITHUB_TOKEN	no	research/cve	tests/test_cve_lookup.py
cve_lookup.kev_cache_path	str	''	—	config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].kev_cache_path	mcp_shared, cve_lookup.py	NVD + KEV/EPSS	—	no	research/cve	tests/test_cve_lookup.py
cve_lookup.kev_cache_ttl_seconds	int	86400	—	config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].kev_cache_ttl_seconds	mcp_shared, cve_lookup.py	NVD + KEV/EPSS	—	no	research/cve	tests/test_cve_lookup.py
cve_lookup.kev_enabled	bool	True	—	config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].kev_enabled	mcp_shared, cve_lookup.py	NVD + KEV/EPSS	—	no	research/cve	tests/test_cve_lookup.py
cve_lookup.max_results	int	5	—	config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].max_results	mcp_shared, cve_lookup.py	NVD + KEV/EPSS	—	no	research/cve	tests/test_cve_lookup.py
cve_lookup.rate_limit_seconds	float	6.0	—	config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].rate_limit_seconds	mcp_shared, cve_lookup.py	NVD + KEV/EPSS	—	no	research/cve	tests/test_cve_lookup.py
cve_lookup.search_rate_limit_per_minute	int	10	—	config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].search_rate_limit_per_minute	mcp_shared, cve_lookup.py	NVD + KEV/EPSS	—	no	research/cve	tests/test_cve_lookup.py
cve_lookup.timeout_seconds	int	30	—	config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].timeout_seconds	mcp_shared, cve_lookup.py	NVD + KEV/EPSS	—	no	research/cve	tests/test_cve_lookup.py
embeddings.provider	str	'ollama' (schema) → 'none' (lab)	—	config.yaml:507 + CONFIG_SCHEMA['embeddings'].provider		—	—	yes	embeddings	—
engine_mcp.enabled	bool	True	—	config.yaml:53 + CONFIG_SCHEMA['engine_mcp'].enabled	mcp_engine_server.py	Advisory MCP enable	—	yes	mcp/engine
engine_mcp.host	str	'127.0.0.1'	—	config.yaml:53 + CONFIG_SCHEMA['engine_mcp'].host	mcp_engine_server.py	Loopback bind	—	yes	mcp/engine
engine_mcp.port	int	8002	—	config.yaml:53 + CONFIG_SCHEMA['engine_mcp'].port	mcp_engine_server.py	HTTP port	—	yes	mcp/engine
eval.baseline_path	str	'reports/eval/baseline.json'	—	config.yaml:268 + CONFIG_SCHEMA['eval'].baseline_path		—	—	no	eval	—
eval.enabled	bool	True	—	config.yaml:268 + CONFIG_SCHEMA['eval'].enabled	eval_harness.py	Eval harness	—	no	eval	tests/test_eval*.py
eval.max_rounds	int	30	—	config.yaml:268 + CONFIG_SCHEMA['eval'].max_rounds	eval_harness.py	Eval harness	—	no	eval	tests/test_eval*.py
eval.output_dir	str	'reports/eval'	—	config.yaml:268 + CONFIG_SCHEMA['eval'].output_dir	eval_harness.py	Eval harness	—	no	eval	tests/test_eval*.py
eval.regression_tolerance	float	0.05	—	config.yaml:268 + CONFIG_SCHEMA['eval'].regression_tolerance		—	—	no	eval	—
eval.write_html	bool	True	—	config.yaml:268 + CONFIG_SCHEMA['eval'].write_html	eval_harness.py	Eval harness	—	no	eval	tests/test_eval*.py
eval.write_markdown	bool	True	—	config.yaml:268 + CONFIG_SCHEMA['eval'].write_markdown	eval_harness.py	Eval harness	—	no	eval	tests/test_eval*.py
exploit.ad_kerberos.adcs_enum	bool	False	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].ad_kerberos.adcs_enum	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.ad_kerberos.asrep_roast	bool	False	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].ad_kerberos.asrep_roast	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.ad_kerberos.bloodhound	bool	False	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].ad_kerberos.bloodhound	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.ad_kerberos.enabled	bool	False	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].ad_kerberos.enabled	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.ad_kerberos.golden_ticket	bool	False	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].ad_kerberos.golden_ticket	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.ad_kerberos.pass_the_hash	bool	False	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].ad_kerberos.pass_the_hash	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.ad_kerberos.responder_relay	bool	False	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].ad_kerberos.responder_relay	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.ad_kerberos.smb_signing_check	bool	True	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].ad_kerberos.smb_signing_check	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.allowed_targets	list[str]	[] (schema) → ['127.0.0.1'] (lab)	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].allowed_targets	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	EXPLOIT_TARGET* + EXPLOIT_DISCOVERED_TARGETS	no	exploit/agent	tests/test_scope_gate.py
exploit.attack_max_commands	int	150	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].attack_max_commands	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.attack_max_duration_minutes	int	360	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].attack_max_duration_minutes	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.attack_max_rounds	int	50	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].attack_max_rounds	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.attack_mode	bool	True	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].attack_mode	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.attacker_os	str	'auto'	auto | linux | windows	config.yaml:61 + CONFIG_SCHEMA['exploit'].attacker_os	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.auto_post_exploit	bool	True	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].auto_post_exploit	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.cache_max_entries	int	50	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].cache_max_entries	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.cache_ttl_seconds	int	3600	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].cache_ttl_seconds	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.command_timeout_seconds	int	300	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].command_timeout_seconds	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.context_summarize_every	int	10 (schema) → 50 (lab)	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].context_summarize_every	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.disallowed_assets	list	[]	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].disallowed_assets	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.enabled	bool	True	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].enabled	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.forbidden_actions	list	[]	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].forbidden_actions	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.listeners.dns	bool	False	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].listeners.dns	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.listeners.https_beacon	bool	False	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].listeners.https_beacon	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.listeners.socks_pivot	bool	False	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].listeners.socks_pivot	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.listeners.tls	bool	False	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].listeners.tls	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.loot_workspace	str	'exploit_workspace/loot'	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].loot_workspace	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.max_commands_per_session	int	9999	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].max_commands_per_session	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.max_pivot_depth	int	2	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].max_pivot_depth	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.max_query_chars	int	200	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].max_query_chars	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.max_rounds	int	200	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].max_rounds	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.mode	str	'standalone'	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].mode	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.msf.auto_local_exploit_suggester	bool	False	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].msf.auto_local_exploit_suggester	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.msf.recipes_enabled	bool	False	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].msf.recipes_enabled	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.msfconsole_path	str	'msfconsole'	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].msfconsole_path	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.permission	str	'full_access'	full_access | approve_only | read_only	config.yaml:61 + CONFIG_SCHEMA['exploit'].permission	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.require_explicit_allowlist	bool	True	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].require_explicit_allowlist	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.searchsploit_path	str	'searchsploit'	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].searchsploit_path	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.shell	str	'bash'	bash	config.yaml:61 + CONFIG_SCHEMA['exploit'].shell	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.terminal	str	'visible'	visible | hidden	config.yaml:61 + CONFIG_SCHEMA['exploit'].terminal	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.web_search	bool	True	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].web_search	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	—	no	exploit/agent	tests/test_scope_gate.py
exploit.workspace_dir	str	'exploit_workspace'	—	config.yaml:61 + CONFIG_SCHEMA['exploit'].workspace_dir	cli_exploit_settings.py, mcp_tools/terminal, mcp_shared	Attack posture/budgets/allowlist lock	EXPLOIT_WORKSPACE	no	exploit/agent	tests/test_scope_gate.py
fsm.enabled	bool	False	—	config.yaml:208 + CONFIG_SCHEMA['fsm'].enabled		—	—	no	fsm	—
fsm.max_retries_per_step	int	3	—	config.yaml:208 + CONFIG_SCHEMA['fsm'].max_retries_per_step		—	—	no	fsm	—
hitl.enabled	bool	True	—	config.yaml:361 + CONFIG_SCHEMA['hitl'].enabled		—	—	no	hitl	—
ics.allow_write	bool	False	—	config.yaml:450 + CONFIG_SCHEMA['ics'].allow_write	attack_modules/modules/ics_iot.py	ICS write gates	—	no	ics	tests/test_ics*.py
ics.destructive_ics	bool	False	—	config.yaml:450 + CONFIG_SCHEMA['ics'].destructive_ics	attack_modules/modules/ics_iot.py	ICS write gates	—	no	ics	tests/test_ics*.py
killchain.enabled	bool	False	—	config.yaml:294 + CONFIG_SCHEMA['killchain'].enabled		—	—	no	killchain	—
killchain.goal_state	str	'shell_as_root'	—	config.yaml:294 + CONFIG_SCHEMA['killchain'].goal_state		—	—	no	killchain	—
killchain.graph_db	str	''	—	config.yaml:294 + CONFIG_SCHEMA['killchain'].graph_db		—	—	no	killchain	—
killchain.require_verification	bool	True	—	config.yaml:294 + CONFIG_SCHEMA['killchain'].require_verification		—	—	no	killchain	—
long_session.attack_max_commands	int	1000	—	config.yaml:318 + CONFIG_SCHEMA['long_session'].attack_max_commands	cli_exploit_settings.py, run_service/service.py	Multi-hour budgets	—	no	long_session	tests/test_long*.py
long_session.attack_max_duration_minutes	int	720	—	config.yaml:318 + CONFIG_SCHEMA['long_session'].attack_max_duration_minutes	cli_exploit_settings.py, run_service/service.py	Multi-hour budgets	—	no	long_session	tests/test_long*.py
long_session.attack_max_rounds	int	200	—	config.yaml:318 + CONFIG_SCHEMA['long_session'].attack_max_rounds	cli_exploit_settings.py, run_service/service.py	Multi-hour budgets	—	no	long_session	tests/test_long*.py
long_session.enabled	bool	False (schema) → True (lab)	—	config.yaml:318 + CONFIG_SCHEMA['long_session'].enabled	cli_exploit_settings.py, run_service/service.py	Multi-hour budgets	—	no	long_session	tests/test_long*.py
long_session.persist_messages	bool	True	—	config.yaml:318 + CONFIG_SCHEMA['long_session'].persist_messages	cli_exploit_settings.py, run_service/service.py	Multi-hour budgets	—	no	long_session	tests/test_long*.py
long_session.request_timeout_seconds	int	600	—	config.yaml:318 + CONFIG_SCHEMA['long_session'].request_timeout_seconds	cli_exploit_settings.py, run_service/service.py	Multi-hour budgets	—	no	long_session	tests/test_long*.py
long_session.swarm_session_timeout_minutes	int	30	—	config.yaml:318 + CONFIG_SCHEMA['long_session'].swarm_session_timeout_minutes	cli_exploit_settings.py, run_service/service.py	Multi-hour budgets	—	no	long_session	tests/test_long*.py
mcp.default_transport	str	'stdio'	stdio | http	config.yaml:51 + CONFIG_SCHEMA['mcp'].default_transport	config_manager, mcp_session.py	stdio|http	—	yes	mcp	tests/test_config_manager.py
memory.attack_memory_enabled	bool	True	—	config.yaml:335 + CONFIG_SCHEMA['memory'].attack_memory_enabled	tools/exploit_agent/runner/_impl.py, semantic_memory.py	Cross-mission memory	—	no	memory	tests/test_memory.py
memory.attack_memory_max_context_chars	int	6000	—	config.yaml:335 + CONFIG_SCHEMA['memory'].attack_memory_max_context_chars	tools/exploit_agent/runner/_impl.py, semantic_memory.py	Cross-mission memory	—	no	memory	tests/test_memory.py
memory.cross_mission_learning	bool	True	—	config.yaml:335 + CONFIG_SCHEMA['memory'].cross_mission_learning	tools/exploit_agent/runner/_impl.py, semantic_memory.py	Cross-mission memory	—	no	memory	tests/test_memory.py
memory.embedding_model	str	'nomic-embed-text'	—	config.yaml:335 + CONFIG_SCHEMA['memory'].embedding_model	tools/exploit_agent/runner/_impl.py, semantic_memory.py	Cross-mission memory	—	no	memory	tests/test_memory.py
memory.experience_min_samples	int	3	—	config.yaml:335 + CONFIG_SCHEMA['memory'].experience_min_samples	tools/exploit_agent/runner/_impl.py, semantic_memory.py	Cross-mission memory	—	no	memory	tests/test_memory.py
memory.experience_time_decay_days	int	90	—	config.yaml:335 + CONFIG_SCHEMA['memory'].experience_time_decay_days	tools/exploit_agent/runner/_impl.py, semantic_memory.py	Cross-mission memory	—	no	memory	tests/test_memory.py
memory.semantic_enabled	bool	True	—	config.yaml:335 + CONFIG_SCHEMA['memory'].semantic_enabled	tools/exploit_agent/runner/_impl.py, semantic_memory.py	Cross-mission memory	—	no	memory	tests/test_memory.py
mitre.enabled	bool	True	—	config.yaml:482 + CONFIG_SCHEMA['mitre'].enabled	mitre_export.py	ATT&CK export	—	no	mitre
mitre.include_skill_tags	bool	True	—	config.yaml:482 + CONFIG_SCHEMA['mitre'].include_skill_tags	mitre_export.py	ATT&CK export	—	no	mitre
mitre.navigator_output_dir	str	'reports/mitre'	—	config.yaml:482 + CONFIG_SCHEMA['mitre'].navigator_output_dir	mitre_export.py	ATT&CK export	—	no	mitre
mitre.technique_map	str	'tools/mitre_technique_map.json'	—	config.yaml:482 + CONFIG_SCHEMA['mitre'].technique_map	mitre_export.py	ATT&CK export	—	no	mitre
models.auto_update	bool	True	—	config.yaml:6 + CONFIG_SCHEMA['models'].auto_update		—	—	yes	models	—
models.default_alias	str	'glm'	—	config.yaml:6 + CONFIG_SCHEMA['models'].default_alias	config_manager, run_service/service.py	Active alias	—	yes	models	tests/test_config_manager.py
models.info.deepseek.context_window	int	1000000	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.deepseek.context_window	model_router, exploit_agent/context	Context windows	—	yes	memory/context	tests/test_config_manager.py
models.info.deepseek.description	str	'DeepSeek V4 Pro — 1M token context, deep code reasoning.'	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.deepseek.description	model_router, exploit_agent/context	Context windows	—	yes	memory/context	tests/test_config_manager.py
models.info.deepseek.label	str	'DeepSeek V4 Pro'	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.deepseek.label	model_router, exploit_agent/context	Context windows	—	yes	memory/context	tests/test_config_manager.py
models.info.deepseek_flash.context_window	int	1000000	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.deepseek_flash.context_window	model_router, exploit_agent/context	Context windows	—	yes	memory/context	tests/test_config_manager.py
models.info.deepseek_flash.description	str	'DeepSeek V4 Flash - 1M token context, fast DeepSeek option for lower-latency work.'	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.deepseek_flash.description	model_router, exploit_agent/context	Context windows	—	yes	memory/context	tests/test_config_manager.py
models.info.deepseek_flash.label	str	'DeepSeek V4 Flash'	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.deepseek_flash.label	model_router, exploit_agent/context	Context windows	—	yes	memory/context	tests/test_config_manager.py
models.info.glm.context_window	int	976000	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.glm.context_window	model_router, exploit_agent/context	Context windows	—	yes	memory/context	tests/test_config_manager.py
models.info.glm.description	str	'Zhipu GLM-5.2 — 976K context, the smartest/newest GLM for deep reasoning + coding.'	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.glm.description	model_router, exploit_agent/context	Context windows	—	yes	memory/context	tests/test_config_manager.py
models.info.glm.label	str	'GLM-5.2'	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.glm.label	model_router, exploit_agent/context	Context windows	—	yes	memory/context	tests/test_config_manager.py
models.info.glm3.context_window	int	128000	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.glm3.context_window		—	—	yes	memory/context	—
models.info.glm3.description	str	'Zhipu GLM-5.3 Flash — fast low-latency GLM option (128K context).'	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.glm3.description		—	—	yes	memory/context	—
models.info.glm3.label	str	'GLM-5.3 Flash'	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.glm3.label		—	—	yes	memory/context	—
models.info.kimi.context_window	int	256000	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.kimi.context_window	model_router, exploit_agent/context	Context windows	—	yes	memory/context	tests/test_config_manager.py
models.info.kimi.description	str	'Moonshot Kimi K2.6 — strong long-form reasoning, 256K context.'	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.kimi.description	model_router, exploit_agent/context	Context windows	—	yes	memory/context	tests/test_config_manager.py
models.info.kimi.label	str	'Kimi K2.6'	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.kimi.label	model_router, exploit_agent/context	Context windows	—	yes	memory/context	tests/test_config_manager.py
models.info.minimax.context_window	int	512000	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.minimax.context_window	model_router, exploit_agent/context	Context windows	—	yes	memory/context	tests/test_config_manager.py
models.info.minimax.description	str	'Minimax M3 (cloud) — 512K context, balanced coding + reasoning.'	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.minimax.description	model_router, exploit_agent/context	Context windows	—	yes	memory/context	tests/test_config_manager.py
models.info.minimax.label	str	'Minimax M3'	—	config.yaml:6 + CONFIG_SCHEMA['models'].info.minimax.label	model_router, exploit_agent/context	Context windows	—	yes	memory/context	tests/test_config_manager.py
models.provider	str	'ollama' (schema) → 'opencode_go' (lab)	ollama | chatgpt	config.yaml:6 + CONFIG_SCHEMA['models'].provider	config_manager.get_ai_provider, model_router, doctor.py	Active chat provider	—	yes	providers	tests/test_config_manager.py
models.registry.deepseek	str	'deepseek-v4-pro:cloud'	—	config.yaml:6 + CONFIG_SCHEMA['models'].registry.deepseek	config_manager, doctor.py, run_service	Alias→model_id map	—	yes	models	tests/test_config_manager.py
models.registry.deepseek_flash	str	'deepseek-v4-flash:cloud'	—	config.yaml:6 + CONFIG_SCHEMA['models'].registry.deepseek_flash	config_manager, doctor.py, run_service	Alias→model_id map	—	yes	models	tests/test_config_manager.py
models.registry.glm	str	'glm-5.2:cloud'	—	config.yaml:6 + CONFIG_SCHEMA['models'].registry.glm	config_manager, doctor.py, run_service	Alias→model_id map	—	yes	models	tests/test_config_manager.py
models.registry.glm3	str	'glm-5.3-flash'	—	config.yaml:6 + CONFIG_SCHEMA['models'].registry.glm3		—	—	yes	models	—
models.registry.kimi	str	'kimi-k2.6:cloud'	—	config.yaml:6 + CONFIG_SCHEMA['models'].registry.kimi	config_manager, doctor.py, run_service	Alias→model_id map	—	yes	models	tests/test_config_manager.py
models.registry.minimax	str	'minimax-m3:cloud'	—	config.yaml:6 + CONFIG_SCHEMA['models'].registry.minimax	config_manager, doctor.py, run_service	Alias→model_id map	—	yes	models	tests/test_config_manager.py
models.roles.code_generator	str	''	—	config.yaml:6 + CONFIG_SCHEMA['models'].roles.code_generator	model_router.get_client_for_role	Per-role model alias	—	yes	reasoning	tests/test_config_manager.py
models.roles.critic	str	''	—	config.yaml:6 + CONFIG_SCHEMA['models'].roles.critic	model_router.get_client_for_role	Per-role model alias	—	yes	reasoning	tests/test_config_manager.py
models.roles.executor	str	''	—	config.yaml:6 + CONFIG_SCHEMA['models'].roles.executor	model_router.get_client_for_role	Per-role model alias	—	yes	reasoning	tests/test_config_manager.py
models.roles.interpreter	str	''	—	config.yaml:6 + CONFIG_SCHEMA['models'].roles.interpreter	model_router.get_client_for_role	Per-role model alias	—	yes	reasoning	tests/test_config_manager.py
models.roles.planner	str	''	—	config.yaml:6 + CONFIG_SCHEMA['models'].roles.planner	model_router.get_client_for_role	Per-role model alias	—	yes	reasoning	tests/test_config_manager.py
models.roles.summarizer	str	''	—	config.yaml:6 + CONFIG_SCHEMA['models'].roles.summarizer	model_router.get_client_for_role	Per-role model alias	—	yes	reasoning	tests/test_config_manager.py
multi_model.consult_aliases	list[str]	['kimi', 'deepseek', 'deepseek_flash', 'glm', 'minimax']	—	config.yaml:389 + CONFIG_SCHEMA['multi_model'].consult_aliases	mcp_tools/peer_models.py, exploit_agent/reflection.py	Peer consultation	—	no	multi-model	tests/test_peer*.py
multi_model.enabled	bool	False (schema) → True (lab)	—	config.yaml:389 + CONFIG_SCHEMA['multi_model'].enabled	mcp_tools/peer_models.py, exploit_agent/reflection.py	Peer consultation	—	no	multi-model	tests/test_peer*.py
multi_model.max_answer_chars	int	8000	—	config.yaml:389 + CONFIG_SCHEMA['multi_model'].max_answer_chars	mcp_tools/peer_models.py, exploit_agent/reflection.py	Peer consultation	—	no	multi-model	tests/test_peer*.py
multi_model.max_consultations	int	10	—	config.yaml:389 + CONFIG_SCHEMA['multi_model'].max_consultations	mcp_tools/peer_models.py, exploit_agent/reflection.py	Peer consultation	—	no	multi-model	tests/test_peer*.py
multi_model.max_question_chars	int	4000	—	config.yaml:389 + CONFIG_SCHEMA['multi_model'].max_question_chars	mcp_tools/peer_models.py, exploit_agent/reflection.py	Peer consultation	—	no	multi-model	tests/test_peer*.py
nmap.path	str	'nmap'	—	config.yaml:57 + CONFIG_SCHEMA['nmap'].path	recon_pipeline, mcp_server, doctor	Binary override	—	no	recon	tests/test_recon.py
nmap.priv_fallback	bool	True	—	config.yaml:57 + CONFIG_SCHEMA['nmap'].priv_fallback	recon_pipeline	auto-downgrade	—	no	recon	tests/test_recon.py
nmap.sudo	bool	False	—	config.yaml:57 + CONFIG_SCHEMA['nmap'].sudo	recon_pipeline, nmap_priv	sudo -n	—	no	recon	tests/test_recon.py
ollama.api_key_env	str	'OLLAMA_API_KEY'	—	config.yaml:1 + CONFIG_SCHEMA['ollama'].api_key_env	api_key_store.py, model_router.py	Env var name holding bearer token	OLLAMA_API_KEY (named by this key)	yes	secrets	tests/test_config_cli.py
ollama.embed_host	str	'http://localhost:11434'	—	config.yaml:1 + CONFIG_SCHEMA['ollama'].embed_host	config_manager.py, tools/exploit_agent/runner/_impl.py	Embedding host fallback	—	yes	memory/embeddings	tests/test_config_manager.py
ollama.host	str	'https://api.ollama.com'	—	config.yaml:1 + CONFIG_SCHEMA['ollama'].host	model_router.py, doctor.py	Ollama endpoint for chat/generate	—	yes	models/provider	tests/test_config_manager.py
ollama.model	str	'glm-5.2:cloud'	—	config.yaml:1 + CONFIG_SCHEMA['ollama'].model	config_manager.py, interactive_menu.py	Default concrete model id	—	yes	models	tests/test_config_manager.py
opencode_go.enabled	bool	False (schema) → True (lab)	—	config.yaml:563 + CONFIG_SCHEMA['opencode_go'].enabled		—	—	yes	providers	—
operator_connection.auto_start_listener	bool	True	—	config.yaml:523 + CONFIG_SCHEMA['operator_connection'].auto_start_listener		—	—	no	operator	—
operator_connection.beacon_interval_seconds	int	300	—	config.yaml:523 + CONFIG_SCHEMA['operator_connection'].beacon_interval_seconds		—	—	no	operator	—
operator_connection.default_callback_port	int	4444	—	config.yaml:523 + CONFIG_SCHEMA['operator_connection'].default_callback_port		—	—	no	operator	—
operator_connection.default_listener_type	str	'netcat'	—	config.yaml:523 + CONFIG_SCHEMA['operator_connection'].default_listener_type		—	—	no	operator	—
operator_connection.enabled	bool	True	—	config.yaml:523 + CONFIG_SCHEMA['operator_connection'].enabled		—	—	no	operator	—
operator_connection.health_check_interval_seconds	int	60	—	config.yaml:523 + CONFIG_SCHEMA['operator_connection'].health_check_interval_seconds		—	—	no	operator	—
operator_connection.workspace_dir	str	'exploit_workspace'	—	config.yaml:523 + CONFIG_SCHEMA['operator_connection'].workspace_dir		—	—	no	operator	—
opsec.doh	bool	False	—	config.yaml:255 + CONFIG_SCHEMA['opsec'].doh	opsec.py, validation_utils.is_private_or_local_target	OPSEC hardening	—	no	opsec	tests/test_opsec.py
opsec.doh_provider	str	'cloudflare'	cloudflare | google	config.yaml:255 + CONFIG_SCHEMA['opsec'].doh_provider	opsec.py, validation_utils.is_private_or_local_target	OPSEC hardening	—	no	opsec	tests/test_opsec.py
opsec.enabled	bool	False	—	config.yaml:255 + CONFIG_SCHEMA['opsec'].enabled	opsec.py, validation_utils.is_private_or_local_target	OPSEC hardening	—	no	opsec	tests/test_opsec.py
opsec.jitter_seconds	float	0.0	—	config.yaml:255 + CONFIG_SCHEMA['opsec'].jitter_seconds	opsec.py, validation_utils.is_private_or_local_target	OPSEC hardening	—	no	opsec	tests/test_opsec.py
opsec.local_cidrs	list	[]	—	config.yaml:255 + CONFIG_SCHEMA['opsec'].local_cidrs	opsec.py, validation_utils.is_private_or_local_target	OPSEC hardening	—	no	opsec	tests/test_opsec.py
opsec.local_targets_off	bool	True	—	config.yaml:255 + CONFIG_SCHEMA['opsec'].local_targets_off	opsec.py, validation_utils.is_private_or_local_target	OPSEC hardening	—	no	opsec	tests/test_opsec.py
opsec.min_gap_seconds	float	0.0	—	config.yaml:255 + CONFIG_SCHEMA['opsec'].min_gap_seconds	opsec.py, validation_utils.is_private_or_local_target	OPSEC hardening	—	no	opsec	tests/test_opsec.py
opsec.noise_budget	int	0	—	config.yaml:255 + CONFIG_SCHEMA['opsec'].noise_budget	opsec.py, validation_utils.is_private_or_local_target	OPSEC hardening	—	no	opsec	tests/test_opsec.py
opsec.public_autonomy	bool	True	—	config.yaml:255 + CONFIG_SCHEMA['opsec'].public_autonomy	opsec.py, validation_utils.is_private_or_local_target	OPSEC hardening	—	no	opsec	tests/test_opsec.py
opsec.quiet_command_patterns	list	[]	—	config.yaml:255 + CONFIG_SCHEMA['opsec'].quiet_command_patterns	opsec.py, validation_utils.is_private_or_local_target	OPSEC hardening	—	no	opsec	tests/test_opsec.py
opsec.rate_per_minute	int	0	—	config.yaml:255 + CONFIG_SCHEMA['opsec'].rate_per_minute	opsec.py, validation_utils.is_private_or_local_target	OPSEC hardening	—	no	opsec	tests/test_opsec.py
opsec.ua_rotation	bool	False	—	config.yaml:255 + CONFIG_SCHEMA['opsec'].ua_rotation	opsec.py, validation_utils.is_private_or_local_target	OPSEC hardening	—	no	opsec	tests/test_opsec.py
orchestrator.semantic_memory	bool	True	—	config.yaml:211 + CONFIG_SCHEMA['orchestrator'].semantic_memory	autonomous_orchestrator.py	Cross-mission semantic memory	—	no	autonomous
outcome_judgment.confirmation_threshold	float	0.75	—	config.yaml:343 + CONFIG_SCHEMA['outcome_judgment'].confirmation_threshold	cli_exploit_settings.py, outcome_judge.py	Evidence verdicts	—	no	eval	tests/test_outcome*.py
outcome_judgment.flow_a	bool	False (schema) → True (lab)	—	config.yaml:343 + CONFIG_SCHEMA['outcome_judgment'].flow_a	cli_exploit_settings.py, outcome_judge.py	Evidence verdicts	—	no	eval	tests/test_outcome*.py
outcome_judgment.max_inconclusive_attempts	int	3	—	config.yaml:343 + CONFIG_SCHEMA['outcome_judgment'].max_inconclusive_attempts	cli_exploit_settings.py, outcome_judge.py	Evidence verdicts	—	no	eval	tests/test_outcome*.py
outcome_judgment.min_evidence_references	int	1	—	config.yaml:343 + CONFIG_SCHEMA['outcome_judgment'].min_evidence_references	cli_exploit_settings.py, outcome_judge.py	Evidence verdicts	—	no	eval	tests/test_outcome*.py
outcome_judgment.peer_review	bool	False (schema) → True (lab)	—	config.yaml:343 + CONFIG_SCHEMA['outcome_judgment'].peer_review	cli_exploit_settings.py, outcome_judge.py	Evidence verdicts	—	no	eval	tests/test_outcome*.py
outcome_judgment.refutation_threshold	float	0.75	—	config.yaml:343 + CONFIG_SCHEMA['outcome_judgment'].refutation_threshold	cli_exploit_settings.py, outcome_judge.py	Evidence verdicts	—	no	eval	tests/test_outcome*.py
plugins.disabled	list	[]	—	config.yaml:453 + CONFIG_SCHEMA['plugins'].disabled	plugins.py	Plugin discovery	—	no	plugins	tests/test_plugins*.py
plugins.enabled	list[str]	[] (schema) → ['shodan_recon', 'github_dorks', 'webhook_notify', 'sliver_c2', 'bloodhound_ce', 'zap_scan', 'browser_attack', 'mobile_attack', 'wireless', 'spiderfoot', 'atomic_red_team', 'caldera', 'firmware_analysis'] (lab)	—	config.yaml:453 + CONFIG_SCHEMA['plugins'].enabled	plugins.py	Plugin discovery	—	no	plugins	tests/test_plugins*.py
plugins.entry_points	bool	True	—	config.yaml:453 + CONFIG_SCHEMA['plugins'].entry_points	plugins.py	Plugin discovery	—	no	plugins	tests/test_plugins*.py
plugins.search_paths	list[str]	['plugins']	—	config.yaml:453 + CONFIG_SCHEMA['plugins'].search_paths	plugins.py	Plugin discovery	—	no	plugins	tests/test_plugins*.py
poc_verification.compile_timeout_seconds	int	30	—	config.yaml:350 + CONFIG_SCHEMA['poc_verification'].compile_timeout_seconds	poc_verifier.py, mcp_tools/attack_modules.py	PoC compile gate	—	no	poc	tests/test_poc*.py
poc_verification.docker_image	str	'python:3.11-slim'	—	config.yaml:350 + CONFIG_SCHEMA['poc_verification'].docker_image	poc_verifier.py, mcp_tools/attack_modules.py	PoC compile gate	—	no	poc	tests/test_poc*.py
poc_verification.docker_memory	str	'256m'	—	config.yaml:350 + CONFIG_SCHEMA['poc_verification'].docker_memory	poc_verifier.py, mcp_tools/attack_modules.py	PoC compile gate	—	no	poc	tests/test_poc*.py
poc_verification.docker_network	str	'none'	—	config.yaml:350 + CONFIG_SCHEMA['poc_verification'].docker_network	poc_verifier.py, mcp_tools/attack_modules.py	PoC compile gate	—	no	poc	tests/test_poc*.py
poc_verification.docker_read_only	bool	True	—	config.yaml:350 + CONFIG_SCHEMA['poc_verification'].docker_read_only	poc_verifier.py, mcp_tools/attack_modules.py	PoC compile gate	—	no	poc	tests/test_poc*.py
poc_verification.enabled	bool	False (schema) → True (lab)	—	config.yaml:350 + CONFIG_SCHEMA['poc_verification'].enabled	poc_verifier.py, mcp_tools/attack_modules.py	PoC compile gate	—	no	poc	tests/test_poc*.py
poc_verification.max_retries	int	3	—	config.yaml:350 + CONFIG_SCHEMA['poc_verification'].max_retries	poc_verifier.py, mcp_tools/attack_modules.py	PoC compile gate	—	no	poc	tests/test_poc*.py
providers.chatgpt.enabled	bool	True (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:495 (lab extra)		—	—	yes	providers	—
providers.opencode_go.api_key_env	str	'OPENCODE_GO_API_KEY' (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:495 (lab extra)		—	—	yes	providers	—
providers.opencode_go.base_url	str	'https://opencode.ai/zen/go/v1' (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:495 (lab extra)		—	—	yes	providers	—
providers.opencode_go.context_window	int	128000 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:495 (lab extra)		—	—	yes	providers	—
providers.opencode_go.default_model	str	'muse-spark-1.2-contributor' (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:495 (lab extra)		—	—	yes	providers	—
providers.opencode_go.discover_cache_seconds	int	300 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:495 (lab extra)		—	—	yes	providers	—
providers.opencode_go.enabled	bool	True (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:495 (lab extra)		—	—	yes	providers	—
providers.opencode_go.models	list	[] (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:495 (lab extra)		—	—	yes	providers	—
providers.opencode_go.request_timeout_seconds	int	300 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:495 (lab extra)		—	—	yes	providers	—
reasoning.chain_of_thought	bool	True	—	config.yaml:326 + CONFIG_SCHEMA['reasoning'].chain_of_thought	cli_exploit_settings.py, tools/exploit_agent/runner/_impl.py	CoT / reflection	—	no	reasoning	tests/test_reasoning.py
reasoning.critic_enabled	bool	True	—	config.yaml:326 + CONFIG_SCHEMA['reasoning'].critic_enabled	cli_exploit_settings.py, tools/exploit_agent/runner/_impl.py	CoT / reflection	—	no	reasoning	tests/test_reasoning.py
reasoning.llm_reflection	bool	False (schema) → True (lab)	—	config.yaml:326 + CONFIG_SCHEMA['reasoning'].llm_reflection	cli_exploit_settings.py, tools/exploit_agent/runner/_impl.py	CoT / reflection	—	no	reasoning	tests/test_reasoning.py
reasoning.observer_mode	str	'hybrid'	heuristic | llm | hybrid	config.yaml:326 + CONFIG_SCHEMA['reasoning'].observer_mode	cli_exploit_settings.py, tools/exploit_agent/runner/_impl.py	CoT / reflection	—	no	reasoning	tests/test_reasoning.py
reasoning.peer_consult_on_failure_threshold	int	3	—	config.yaml:326 + CONFIG_SCHEMA['reasoning'].peer_consult_on_failure_threshold	cli_exploit_settings.py, tools/exploit_agent/runner/_impl.py	CoT / reflection	—	no	reasoning	tests/test_reasoning.py
reasoning.reflection_every_n_actions	int	10	—	config.yaml:326 + CONFIG_SCHEMA['reasoning'].reflection_every_n_actions	cli_exploit_settings.py, tools/exploit_agent/runner/_impl.py	CoT / reflection	—	no	reasoning	tests/test_reasoning.py
reasoning.ultrathink	bool	False (schema) → True (lab)	—	config.yaml:326 + CONFIG_SCHEMA['reasoning'].ultrathink	cli_exploit_settings.py, tools/exploit_agent/runner/_impl.py	CoT / reflection	—	no	reasoning	tests/test_reasoning.py
reasoning.ultrathink_reflection_interval	int	3	—	config.yaml:326 + CONFIG_SCHEMA['reasoning'].ultrathink_reflection_interval	cli_exploit_settings.py, tools/exploit_agent/runner/_impl.py	CoT / reflection	—	no	reasoning	tests/test_reasoning.py
recon.asn_whois	bool	False	—	config.yaml:213 + CONFIG_SCHEMA['recon'].asn_whois	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.cloud_metadata_probe	bool	False	—	config.yaml:213 + CONFIG_SCHEMA['recon'].cloud_metadata_probe	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.dns_zone_transfer	bool	False	—	config.yaml:213 + CONFIG_SCHEMA['recon'].dns_zone_transfer	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.domain_resolution.dns_zone_transfer	bool	False (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.domain_resolution.enabled	bool	True (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.domain_resolution.max_subdomains	int	500 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.domain_resolution.subdomain_sources	list[str]	['crt_sh', 'dns_bruteforce', 'subfinder', 'amass'] (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.domain_resolution.whois_enabled	bool	True (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.extended_enumerators	bool	True	—	config.yaml:213 + CONFIG_SCHEMA['recon'].extended_enumerators	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.fast.cache_ttl_seconds	int	300 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.fast.cve_concurrency	int	8 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.fast.cve_lookup	bool	True (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.fast.enabled	bool	True (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.fast.max_concurrency	int	8 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.fast.overall_timeout_seconds	int	180 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.fast.passive_osint	bool	True (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.fast.per_task_timeout_seconds	int	60 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.fast.service_concurrency	int	6 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.fast.service_enumeration	bool	True (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.fast.tcp_discovery	bool	True (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.fast.udp_top_ports	int	50 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.max_retries	int	2 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.preflight_ports	list[int]	[80, 443] (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.preflight_probe	bool	False (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.preflight_timeout_ms	int	1000 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.retry_delay	float	5.0 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.shodan_api_key	str	''	—	config.yaml:213 + CONFIG_SCHEMA['recon'].shodan_api_key	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	SHODAN_API_KEY (file wins)	no	recon	tests/test_recon*.py
recon.snmp_enum	bool	False	—	config.yaml:213 + CONFIG_SCHEMA['recon'].snmp_enum	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.subdomain_enum	bool	False	—	config.yaml:213 + CONFIG_SCHEMA['recon'].subdomain_enum	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.timeout_seconds	int	300 (lab-only, not in CONFIG_SCHEMA)	—	config.yaml:213 (lab extra)	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.udp_top_ports	int	100	—	config.yaml:213 + CONFIG_SCHEMA['recon'].udp_top_ports	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.vhost_discovery	bool	False	—	config.yaml:213 + CONFIG_SCHEMA['recon'].vhost_discovery	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
recon.waf_fingerprint	bool	False	—	config.yaml:213 + CONFIG_SCHEMA['recon'].waf_fingerprint	recon_pipeline.py, tools/mcp_tools/domain.py	Recon coverage & depth	—	no	recon	tests/test_recon*.py
replay_simulator.counterfactual	bool	False	—	config.yaml:358 + CONFIG_SCHEMA['replay_simulator'].counterfactual		—	—	no	—	—
replay_simulator.enabled	bool	False (schema) → True (lab)	—	config.yaml:358 + CONFIG_SCHEMA['replay_simulator'].enabled	—	—	—	no	—	—
research.allow_local_fetch	bool	False	—	config.yaml:141 + CONFIG_SCHEMA['research'].allow_local_fetch	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.assistant.automatic	bool	True	—	config.yaml:141 + CONFIG_SCHEMA['research'].assistant.automatic	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.assistant.enabled	bool	True	—	config.yaml:141 + CONFIG_SCHEMA['research'].assistant.enabled	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.assistant.failure_trigger	int	2	—	config.yaml:141 + CONFIG_SCHEMA['research'].assistant.failure_trigger	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.assistant.max_advisory_chars	int	4000	—	config.yaml:141 + CONFIG_SCHEMA['research'].assistant.max_advisory_chars	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.assistant.max_auto_consultations	int	4	—	config.yaml:141 + CONFIG_SCHEMA['research'].assistant.max_auto_consultations	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.assistant.max_model_rounds	int	3	—	config.yaml:141 + CONFIG_SCHEMA['research'].assistant.max_model_rounds	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.assistant.max_tool_calls_per_consultation	int	5	—	config.yaml:141 + CONFIG_SCHEMA['research'].assistant.max_tool_calls_per_consultation	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.assistant.model_alias	str	''	—	config.yaml:141 + CONFIG_SCHEMA['research'].assistant.model_alias	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.assistant.save_advisories	bool	True	—	config.yaml:141 + CONFIG_SCHEMA['research'].assistant.save_advisories	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.assistant.timeout_seconds	int	90	—	config.yaml:141 + CONFIG_SCHEMA['research'].assistant.timeout_seconds	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.cache_max_entries	int	250	—	config.yaml:141 + CONFIG_SCHEMA['research'].cache_max_entries	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.cache_ttl_seconds	int	1800	—	config.yaml:141 + CONFIG_SCHEMA['research'].cache_ttl_seconds	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.enabled	bool	True	—	config.yaml:141 + CONFIG_SCHEMA['research'].enabled	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.fallback_provider	str	'serpapi'	ollama | serpapi | stdlib | ""	config.yaml:141 + CONFIG_SCHEMA['research'].fallback_provider	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.max_content_chars	int	12000	—	config.yaml:141 + CONFIG_SCHEMA['research'].max_content_chars	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.max_fetch_depth	int	5	—	config.yaml:141 + CONFIG_SCHEMA['research'].max_fetch_depth	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.max_results	int	8	—	config.yaml:141 + CONFIG_SCHEMA['research'].max_results	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.min_source_quality	str	'medium'	low | medium | high	config.yaml:141 + CONFIG_SCHEMA['research'].min_source_quality	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.ollama.api_key_env	str	'OLLAMA_API_KEY'	—	config.yaml:141 + CONFIG_SCHEMA['research'].ollama.api_key_env	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	OLLAMA_API_KEY	no	research	tests/test_research.py
research.ollama.max_results	int	8	—	config.yaml:141 + CONFIG_SCHEMA['research'].ollama.max_results	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.ollama.use_web_fetch	bool	True	—	config.yaml:141 + CONFIG_SCHEMA['research'].ollama.use_web_fetch	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.ollama.use_web_search	bool	True	—	config.yaml:141 + CONFIG_SCHEMA['research'].ollama.use_web_search	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.provider	str	'ollama'	ollama | serpapi | stdlib	config.yaml:141 + CONFIG_SCHEMA['research'].provider	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.require_api_key_for_mcp_tools	bool	True	—	config.yaml:141 + CONFIG_SCHEMA['research'].require_api_key_for_mcp_tools	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.serpapi.api_key_env	str	'SERPAPI_API_KEY'	—	config.yaml:141 + CONFIG_SCHEMA['research'].serpapi.api_key_env	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	SERPAPI_API_KEY	no	research	tests/test_research.py
research.serpapi.endpoint	str	'https://serpapi.com/search.json'	—	config.yaml:141 + CONFIG_SCHEMA['research'].serpapi.endpoint	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.serpapi.engine	str	'duckduckgo'	—	config.yaml:141 + CONFIG_SCHEMA['research'].serpapi.engine	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.serpapi.region	str	'us-en'	—	config.yaml:141 + CONFIG_SCHEMA['research'].serpapi.region	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
research.timeout_seconds	int	15	—	config.yaml:141 + CONFIG_SCHEMA['research'].timeout_seconds	mcp_shared, web_researcher.py, api_key_store.py	Web research + cache	—	no	research	tests/test_research.py
sandbox.auto_manage_docker	bool	False (schema) → True (lab)	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].auto_manage_docker		—	—	no	sandbox	—
sandbox.backend	str	'docker'	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].backend		—	—	no	sandbox	—
sandbox.cleanup.remove_on_exit	bool	True	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].cleanup.remove_on_exit		—	—	no	sandbox	—
sandbox.cleanup.remove_stale_on_startup	bool	True	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].cleanup.remove_stale_on_startup		—	—	no	sandbox	—
sandbox.docker_start_timeout_seconds	int	60	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].docker_start_timeout_seconds		—	—	no	sandbox	—
sandbox.docker_stop_timeout_seconds	int	30	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].docker_stop_timeout_seconds		—	—	no	sandbox	—
sandbox.enabled	bool	True	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].enabled		—	—	no	sandbox	—
sandbox.env_passthrough	list	[]	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].env_passthrough		—	—	no	sandbox	—
sandbox.fallback_native	bool	False	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].fallback_native		—	—	no	sandbox	—
sandbox.image	str	'breachpilot-sandbox:latest'	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].image		—	—	no	sandbox	—
sandbox.multi_net_raw	bool	True	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].multi_net_raw		—	—	no	sandbox	—
sandbox.network.allow_dns	str	'controlled'	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].network.allow_dns		—	—	no	sandbox	—
sandbox.network.allow_gateway	bool	False	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].network.allow_gateway		—	—	no	sandbox	—
sandbox.network.allow_research_hosts	bool	True	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].network.allow_research_hosts		—	—	no	sandbox	—
sandbox.network.enforce	bool	True	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].network.enforce		—	—	no	sandbox	—
sandbox.network.extra_allow_cidrs	list	[]	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].network.extra_allow_cidrs		—	—	no	sandbox	—
sandbox.network.fail_closed	bool	True	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].network.fail_closed		—	—	no	sandbox	—
sandbox.network.map_host_loopback	bool	False	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].network.map_host_loopback		—	—	no	sandbox	—
sandbox.read_only_rootfs	bool	True	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].read_only_rootfs		—	—	no	sandbox	—
sandbox.resources.cpus	int	2	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].resources.cpus		—	—	no	sandbox	—
sandbox.resources.memory_mb	int	4096	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].resources.memory_mb		—	—	no	sandbox	—
sandbox.resources.output_max_bytes	int	2000000	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].resources.output_max_bytes		—	—	no	sandbox	—
sandbox.resources.pids	int	512	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].resources.pids		—	—	no	sandbox	—
sandbox.resources.timeout_seconds	int	300	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].resources.timeout_seconds		—	—	no	sandbox	—
sandbox.resources.tmpfs_size_mb	int	256	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].resources.tmpfs_size_mb		—	—	no	sandbox	—
sandbox.user	str	'sandbox'	—	config.yaml:531 + CONFIG_SCHEMA['sandbox'].user		—	—	no	sandbox	—
skills.allow_model_lookup	bool	True	—	config.yaml:400 + CONFIG_SCHEMA['skills'].allow_model_lookup	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.allow_reference_listing	bool	True	—	config.yaml:400 + CONFIG_SCHEMA['skills'].allow_reference_listing	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.context_skill_weight	int	24	—	config.yaml:400 + CONFIG_SCHEMA['skills'].context_skill_weight	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.default_enabled	list[str]	['scanning-network-with-nmap-advanced', 'conducting-network-penetration-test', 'executing-red-team-engagement-planning', 'auditing-mcp-servers-for-tool-poisoning', 'securing-agentic-ai-tool-invocation'] (schema) → ['scanning-network-with-nmap-advanced', 'conducting-network-penetration-test', 'executing-red-team-engagement-planning', 'auditing-mcp-servers-for-tool-poisoning', 'securing-agentic-ai-tool-invocation', 'attacking-domains-end-to-end'] (lab)	—	config.yaml:400 + CONFIG_SCHEMA['skills'].default_enabled	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.default_skill_weight	int	12	—	config.yaml:400 + CONFIG_SCHEMA['skills'].default_skill_weight	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.diversity_penalty	int	12	—	config.yaml:400 + CONFIG_SCHEMA['skills'].diversity_penalty	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.enabled	bool	True	—	config.yaml:400 + CONFIG_SCHEMA['skills'].enabled	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.exclude_names	list	[]	—	config.yaml:400 + CONFIG_SCHEMA['skills'].exclude_names	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.feedback_enabled	bool	True	—	config.yaml:400 + CONFIG_SCHEMA['skills'].feedback_enabled	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.feedback_min_observations	int	3	—	config.yaml:400 + CONFIG_SCHEMA['skills'].feedback_min_observations	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.feedback_skill_weight	int	8	—	config.yaml:400 + CONFIG_SCHEMA['skills'].feedback_skill_weight	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.include_metadata	bool	False	—	config.yaml:400 + CONFIG_SCHEMA['skills'].include_metadata	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.include_tags	list	[]	—	config.yaml:400 + CONFIG_SCHEMA['skills'].include_tags	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.inject_startup_context	bool	False	—	config.yaml:400 + CONFIG_SCHEMA['skills'].inject_startup_context	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.max_active_skills	int	6	—	config.yaml:400 + CONFIG_SCHEMA['skills'].max_active_skills	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.max_chars_per_skill	int	2500	—	config.yaml:400 + CONFIG_SCHEMA['skills'].max_chars_per_skill	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.max_total_chars	int	9000	—	config.yaml:400 + CONFIG_SCHEMA['skills'].max_total_chars	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.maybe_enabled	bool	False	—	config.yaml:400 + CONFIG_SCHEMA['skills'].maybe_enabled	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.min_contextual_skills	int	3	—	config.yaml:400 + CONFIG_SCHEMA['skills'].min_contextual_skills	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.reselect_max_per_run	int	3	—	config.yaml:400 + CONFIG_SCHEMA['skills'].reselect_max_per_run	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.reselect_mid_run	bool	True	—	config.yaml:400 + CONFIG_SCHEMA['skills'].reselect_mid_run	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.reselect_min_interval_actions	int	5	—	config.yaml:400 + CONFIG_SCHEMA['skills'].reselect_min_interval_actions	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.reselect_sticky_defaults	bool	True	—	config.yaml:400 + CONFIG_SCHEMA['skills'].reselect_sticky_defaults	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.roots	list[str]	['skills']	—	config.yaml:400 + CONFIG_SCHEMA['skills'].roots	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.semantic_matching	bool	True	—	config.yaml:400 + CONFIG_SCHEMA['skills'].semantic_matching	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.semantic_min_similarity	float	0.35	—	config.yaml:400 + CONFIG_SCHEMA['skills'].semantic_min_similarity	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.semantic_model	str	'nomic-embed-text'	—	config.yaml:400 + CONFIG_SCHEMA['skills'].semantic_model	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.semantic_skill_weight	int	16	—	config.yaml:400 + CONFIG_SCHEMA['skills'].semantic_skill_weight	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.swarm_inject	bool	True	—	config.yaml:400 + CONFIG_SCHEMA['skills'].swarm_inject	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
skills.swarm_phase_hints_only	bool	True	—	config.yaml:400 + CONFIG_SCHEMA['skills'].swarm_phase_hints_only	skill_selector.py, skill_pipeline.py, exploit_agent/skills.py	Runtime skills	—	no	skills	tests/test_skills*.py
snapshots.auto_before_destructive	bool	True	—	config.yaml:363 + CONFIG_SCHEMA['snapshots'].auto_before_destructive		—	—	no	snapshots	—
snapshots.enabled	bool	False	—	config.yaml:363 + CONFIG_SCHEMA['snapshots'].enabled		—	—	no	snapshots	—
snapshots.max_snapshots_per_target	int	3	—	config.yaml:363 + CONFIG_SCHEMA['snapshots'].max_snapshots_per_target		—	—	no	snapshots	—
snapshots.provider	str	'docker'	—	config.yaml:363 + CONFIG_SCHEMA['snapshots'].provider		—	—	no	snapshots	—
snapshots.providers.docker.compose_file	str	'eval_targets/docker-compose.yml'	—	config.yaml:363 + CONFIG_SCHEMA['snapshots'].providers.docker.compose_file		—	—	no	snapshots	—
snapshots.providers.hyperv.powershell_command	str	'powershell'	—	config.yaml:363 + CONFIG_SCHEMA['snapshots'].providers.hyperv.powershell_command		—	—	no	snapshots	—
snapshots.providers.libvirt.virsh_path	str	'virsh'	—	config.yaml:363 + CONFIG_SCHEMA['snapshots'].providers.libvirt.virsh_path		—	—	no	snapshots	—
snapshots.providers.proxmox.host	str	''	—	config.yaml:363 + CONFIG_SCHEMA['snapshots'].providers.proxmox.host		—	—	no	snapshots	—
snapshots.providers.proxmox.node	str	''	—	config.yaml:363 + CONFIG_SCHEMA['snapshots'].providers.proxmox.node		—	—	no	snapshots	—
snapshots.providers.vmware.vmrun_path	str	'vmrun'	—	config.yaml:363 + CONFIG_SCHEMA['snapshots'].providers.vmware.vmrun_path		—	—	no	snapshots	—
snapshots.vm_map	dict	{}	—	config.yaml:363 + CONFIG_SCHEMA['snapshots'].vm_map		—	—	no	snapshots	—
stealth.dns_over_https	bool	False	—	config.yaml:108 + CONFIG_SCHEMA['stealth'].dns_over_https	interactive_menu.py (legacy)	Legacy stealth	—	no	opsec
stealth.doh_provider	str	'cloudflare'	cloudflare | google	config.yaml:108 + CONFIG_SCHEMA['stealth'].doh_provider	interactive_menu.py (legacy)	Legacy stealth	—	no	opsec
stealth.rotate_ua	bool	False	—	config.yaml:108 + CONFIG_SCHEMA['stealth'].rotate_ua	interactive_menu.py (legacy)	Legacy stealth	—	no	opsec
swarm.agents	list[str]	['recon', 'vuln', 'exploit', 'post_exploit', 'critic', 'reflection']	—	config.yaml:175 + CONFIG_SCHEMA['swarm'].agents	cli_exploit_settings.py, swarm/orchestrator.py	Multi-agent swarm	—	no	swarm	tests/test_swarm*.py
swarm.enabled	bool	True	—	config.yaml:175 + CONFIG_SCHEMA['swarm'].enabled	cli_exploit_settings.py, swarm/orchestrator.py	Multi-agent swarm	—	no	swarm	tests/test_swarm*.py
swarm.exploit_parallel	bool	False	—	config.yaml:175 + CONFIG_SCHEMA['swarm'].exploit_parallel	cli_exploit_settings.py, swarm/orchestrator.py	Multi-agent swarm	—	no	swarm	tests/test_swarm*.py
swarm.max_parallel_agents	int	3	—	config.yaml:175 + CONFIG_SCHEMA['swarm'].max_parallel_agents	cli_exploit_settings.py, swarm/orchestrator.py	Multi-agent swarm	—	no	swarm	tests/test_swarm*.py
swarm.negotiation_rounds	int	0 (schema) → 2 (lab)	—	config.yaml:175 + CONFIG_SCHEMA['swarm'].negotiation_rounds	cli_exploit_settings.py, swarm/orchestrator.py	Multi-agent swarm	—	no	swarm	tests/test_swarm*.py
swarm.parallel_enabled	bool	False	—	config.yaml:175 + CONFIG_SCHEMA['swarm'].parallel_enabled	cli_exploit_settings.py, swarm/orchestrator.py	Multi-agent swarm	—	no	swarm	tests/test_swarm*.py
swarm.per_phase_concurrency	int	3	—	config.yaml:175 + CONFIG_SCHEMA['swarm'].per_phase_concurrency	cli_exploit_settings.py, swarm/orchestrator.py	Multi-agent swarm	—	no	swarm	tests/test_swarm*.py
swarm.subagent_timeout_seconds	int	600	—	config.yaml:175 + CONFIG_SCHEMA['swarm'].subagent_timeout_seconds	cli_exploit_settings.py, swarm/orchestrator.py	Multi-agent swarm	—	no	swarm	tests/test_swarm*.py
threat_intel.cache_dir	str	'exploit_workspace/.threat_intel'	—	config.yaml:129 + CONFIG_SCHEMA['threat_intel'].cache_dir	threat_intel.py, mcp_tools/research.py	OSV/GHSA/KEV	—	no	threat_intel	tests/test_threat*.py
threat_intel.cache_ttl_seconds	int	86400	—	config.yaml:129 + CONFIG_SCHEMA['threat_intel'].cache_ttl_seconds	threat_intel.py, mcp_tools/research.py	OSV/GHSA/KEV	—	no	threat_intel	tests/test_threat*.py
threat_intel.enabled	bool	True	—	config.yaml:129 + CONFIG_SCHEMA['threat_intel'].enabled	threat_intel.py, mcp_tools/research.py	OSV/GHSA/KEV	—	no	threat_intel	tests/test_threat*.py
threat_intel.github_token_env	str	'GITHUB_TOKEN'	—	config.yaml:129 + CONFIG_SCHEMA['threat_intel'].github_token_env	threat_intel.py, mcp_tools/research.py	OSV/GHSA/KEV	GITHUB_TOKEN	no	threat_intel	tests/test_threat*.py
threat_intel.max_results	int	20	—	config.yaml:129 + CONFIG_SCHEMA['threat_intel'].max_results	threat_intel.py, mcp_tools/research.py	OSV/GHSA/KEV	—	no	threat_intel	tests/test_threat*.py
threat_intel.sources.exploitdb_rss	bool	False	—	config.yaml:129 + CONFIG_SCHEMA['threat_intel'].sources.exploitdb_rss	threat_intel.py, mcp_tools/research.py	OSV/GHSA/KEV	—	no	threat_intel	tests/test_threat*.py
threat_intel.sources.ghsa	bool	True	—	config.yaml:129 + CONFIG_SCHEMA['threat_intel'].sources.ghsa	threat_intel.py, mcp_tools/research.py	OSV/GHSA/KEV	—	no	threat_intel	tests/test_threat*.py
threat_intel.sources.kev	bool	True	—	config.yaml:129 + CONFIG_SCHEMA['threat_intel'].sources.kev	threat_intel.py, mcp_tools/research.py	OSV/GHSA/KEV	—	no	threat_intel	tests/test_threat*.py
threat_intel.sources.osv	bool	True	—	config.yaml:129 + CONFIG_SCHEMA['threat_intel'].sources.osv	threat_intel.py, mcp_tools/research.py	OSV/GHSA/KEV	—	no	threat_intel	tests/test_threat*.py
threat_intel.timeout_seconds	int	30	—	config.yaml:129 + CONFIG_SCHEMA['threat_intel'].timeout_seconds	threat_intel.py, mcp_tools/research.py	OSV/GHSA/KEV	—	no	threat_intel	tests/test_threat*.py
ticketing.backoff_seconds	float	2.0	—	config.yaml:487 + CONFIG_SCHEMA['ticketing'].backoff_seconds	ticketing.py	Jira/GitHub tickets	—	no	ticketing
ticketing.base_url	str	''	—	config.yaml:487 + CONFIG_SCHEMA['ticketing'].base_url	ticketing.py	Jira/GitHub tickets	—	no	ticketing
ticketing.enabled	bool	True	—	config.yaml:487 + CONFIG_SCHEMA['ticketing'].enabled	ticketing.py	Jira/GitHub tickets	—	no	ticketing
ticketing.max_retries	int	3	—	config.yaml:487 + CONFIG_SCHEMA['ticketing'].max_retries	ticketing.py	Jira/GitHub tickets	—	no	ticketing
ticketing.project_key	str	''	—	config.yaml:487 + CONFIG_SCHEMA['ticketing'].project_key	ticketing.py	Jira/GitHub tickets	—	no	ticketing
ticketing.provider	str	''	—	config.yaml:487 + CONFIG_SCHEMA['ticketing'].provider	ticketing.py	Jira/GitHub tickets	—	no	ticketing
ticketing.token_env	str	'TICKETING_TOKEN'	—	config.yaml:487 + CONFIG_SCHEMA['ticketing'].token_env	ticketing.py	Jira/GitHub tickets	TICKETING_TOKEN	no	ticketing
webhook_notify.backoff_seconds	float	2.0	—	config.yaml:472 + CONFIG_SCHEMA['webhook_notify'].backoff_seconds	plugins/webhook_notify.py	Slack/Discord webhook	—	no	plugins
webhook_notify.enabled	bool	True	—	config.yaml:472 + CONFIG_SCHEMA['webhook_notify'].enabled	plugins/webhook_notify.py	Slack/Discord webhook	—	no	plugins
webhook_notify.events	list[str]	['finding', 'state']	—	config.yaml:472 + CONFIG_SCHEMA['webhook_notify'].events	plugins/webhook_notify.py	Slack/Discord webhook	—	no	plugins
webhook_notify.max_payload_chars	int	8192	—	config.yaml:472 + CONFIG_SCHEMA['webhook_notify'].max_payload_chars	plugins/webhook_notify.py	Slack/Discord webhook	—	no	plugins
webhook_notify.max_retries	int	3	—	config.yaml:472 + CONFIG_SCHEMA['webhook_notify'].max_retries	plugins/webhook_notify.py	Slack/Discord webhook	—	no	plugins
webhook_notify.timeout_seconds	int	5	—	config.yaml:472 + CONFIG_SCHEMA['webhook_notify'].timeout_seconds	plugins/webhook_notify.py	Slack/Discord webhook	—	no	plugins
webhook_notify.url	str	''	—	config.yaml:472 + CONFIG_SCHEMA['webhook_notify'].url	plugins/webhook_notify.py	Slack/Discord webhook	—	no	plugins
witness.dos_failure_threshold	int	8	—	config.yaml:190 + CONFIG_SCHEMA['witness'].dos_failure_threshold	swarm/agents/witness_agent.py	Audit watcher	—	no	witness	tests/test_witness.py
witness.dos_failure_window_seconds	float	60.0	—	config.yaml:190 + CONFIG_SCHEMA['witness'].dos_failure_window_seconds	swarm/agents/witness_agent.py	Audit watcher	—	no	witness	tests/test_witness.py
witness.enabled	bool	False (schema) → True (lab)	—	config.yaml:190 + CONFIG_SCHEMA['witness'].enabled	run_service/execute.py (per-run side task) + swarm/agents/witness_agent.py	Audit watcher (advisory)	—	no	witness	tests/test_witness_wiring.py, tests/test_witness.py
witness.escalate_to_event_broker	bool	True	—	config.yaml:190 + CONFIG_SCHEMA['witness'].escalate_to_event_broker	swarm/agents/witness_agent.py	Audit watcher	—	no	witness	tests/test_witness.py
witness.log_path	str	'reports/witness.jsonl'	—	config.yaml:190 + CONFIG_SCHEMA['witness'].log_path	swarm/agents/witness_agent.py	Audit watcher	—	no	witness	tests/test_witness.py
witness.max_flags_per_signal_per_minute	int	10	—	config.yaml:190 + CONFIG_SCHEMA['witness'].max_flags_per_signal_per_minute	swarm/agents/witness_agent.py	Audit watcher	—	no	witness	tests/test_witness.py
witness.poll_interval_seconds	int	5	—	config.yaml:190 + CONFIG_SCHEMA['witness'].poll_interval_seconds	swarm/agents/witness_agent.py	Audit watcher	—	no	witness	tests/test_witness.py

Notes

• Verified: every Key is a leaf path present in config.yaml (checked via yaml.safe_load). No invented keys.
• Schema vs lab: Default shows CONFIG_SCHEMA default; when lab differs, both shown as schema → lab. Lab-only keys (autonomous.dedup_targets, recon.preflight_*, recon.fast.*, api.max_concurrent_runs) have no schema default.
• Restart: yes = daemon/router rebuild; no = next build_*/orchestration.
• Allowed: — = free-form string/int/list; enums where validated (see tools/config_manager.ConfigValidator.validate).