File Configuration and Startup¶
Startup and runtime configuration¶
Gateway and Console load reviewed global/Organization YAML at startup. Strict schemas/references, existing Organization mapping and required static env/NAME values must prepare before either gateway listener binds. Unknown fields, missing nonempty secrets, references to reserved platform variables and invalid provider profiles fail closed. Cloud secret stores are unavailable. The same preparation performs no writes, network calls, OAuth consent or upstream checks.
Working directory: platform/, with explicit database/configuration paths and service environment.
Success exits zero; invalid configuration exits nonzero with a safe diagnostic. Bootstrap compatible storage first. Each process retains an immutable configuration view until restart. A coordinated gateway/Console restart loads file edits and rotated provider or Connector header credentials. Drain in-flight work: an admitted request keeps its acquired view. Manage → Settings displays current redacted configuration without Validate, Apply or restart controls. Administrative configuration visibility requires organization.settings.manage.
Team allowance, key policy/status/namespace and budgets remain live database authority. Capture is resolved per operation/ingestion from Organization maximum plus Team/key/deployment narrowing. Those database edits need no configuration restart. Key lifetime settings apply to later issuance; existing keys still obey their recorded expiry.
Shared OAuth state and activation¶
Changed client/header material, issuer, resource, grant, client ID, scopes or endpoint policy invalidates incompatible grants/flows. Unrelated name/tool edits preserve compatible grants. All Organizations prepare before persistent credential reconciliation. Disconnect disables its generation immediately; unchanged restart does not reconnect it. Personal grants are exact owner/member-bound. Discovery uses shared/discovery credentials and never a person's grant.
What activation changes in projects¶
This stable historical section anchor now refers to Teams. The catalog is one ceiling in catalog ∩ Team allowance ∩ key policy. Removed/disabled catalog resources cannot be invoked; re-adding a resource cannot exceed current Team/key policy. New catalog resources require explicit Team allowance; selected keys remain selected while inherit_team follows current Team allowance. Tool-set following resolves current loaded membership, still intersected with eligibility and authority.
Configuration evidence and upgrades¶
Named guardrail definitions and Organization/model assignments follow the same reviewed-file and coordinated-restart workflow. An admitted model call keeps its resolved policy across fallback; a later independent call uses current configuration. New Requests save effective guardrail sources with their configuration hash, including when OTLP is disabled. Existing inline guardrail files remain compatible. Before rolling back to a binary without named-policy support, convert the intended baseline back to supported inline YAML and remove the new fields; do not expect older binaries to ignore unknown policy configuration.
New Requests record Configuration hash, the original normalized configuration hash excluding resolved secrets. The historical archive stores a normalized non-secret projection under that original hash, not the full runtime object. URLs and evidence are validated/redacted before exposure. Full historical configuration read requires organization.settings.manage; request metadata alone does not grant it. Missing, corrupt or mismatched evidence is explicitly unavailable, without a runtime-configuration fallback. Evidence archived from a file that referenced a now-reserved platform variable is also unavailable.
Legacy configuration revision is historical attribution only. Historical migration 0041_file_configuration_evidence retired live config_activation; it did not make old configuration an activation API. Current traffic never consults archived configuration for authority. Review generation cutover and backup before upgrades.