Security defaults

What the shipped defaults bound, how hard each bound is, and the tests that enforce it. Generated from config.Defaults() and the exported constants, so this page cannot drift from the code.

Setting	Default	What it bounds	Verified by
`task_budget_usd`	2.00	Per-task USD spend through the gateway. Soft: metering is post-hoc, so spend can overshoot by up to task_max_inflight in-flight requests.	`TestGateway_OverBudget402`
`task_max_inflight`	1	Concurrent gateway requests per task lease. Hard at admission; bounds the budget overshoot.	`TestAdmit_InFlightLimit`
`task_max_requests`	0 (0 falls closed to 1000)	Total gateway requests per task, every auth mode. Hard at admission.	`TestRequestCap_RejectsOverLimit`
`max_request_cost_usd`	0.00 (0 = reservation off)	Per-request USD reservation taken at admission. Off by default; setting it makes the per-task budget reservation-backed.	`TestAdmit_InFlightReservationBounds`
`aggregate_budget_usd`	0.00 (0 = off)	Cross-task USD ceiling per api_key vendor over aggregate_window. Soft in the same post-hoc sense as task_budget_usd.	`TestGateway_AggregateCap`
`global_budget_usd`	0.00 (0 = off)	Cumulative broker-metered USD across ALL vendors and both auth modes over global_window, refused at task admission. FAIL-CLOSED per limb: a ledger that cannot be read at all refuses, and so does a quarantined line, because the spend total is then only a lower bound (an ABSENT ledger is not a failure — an install that has never run a task has spent nothing). Durable across restarts, in both window modes. Soft in the same post-hoc sense as task_budget_usd: an admitted task's spend is unknown until it ends, so the overshoot bound is max_concurrent_tasks × task_budget_usd. Only broker-metered spend counts — an agent-reported total_cost_usd never reaches it.	`TestGlobalCap_Limbs` `TestGlobalCeiling_HostileLedgerStatesRefuseRatherThanAdmit` `TestGlobalCeiling_RefusalSurvivesARestartInBothWindowModes` `TestGlobalCeiling_RetryStormIsBoundedEndToEnd` `TestGlobalRecord_USDIsTheLeaseNotTheAudit`
`global_max_tasks`	0 (0 = off)	Cumulative TASK STARTS across all vendors and both auth modes over global_window. Hard at admission (the count is claimed in the same critical section as the check, so concurrent admissions cannot overshoot it). This is the limb that bounds subscription mode and the backstop for every USD metering gap, because it counts an event the broker causes rather than dollars a response reported. Must be >= max_concurrent_tasks.	`TestGlobalCap_ConcurrentAdmissionsCannotOvershoot` `TestGlobalCeiling_SubscriptionModeIsBoundedByTheTaskLimb` `TestGlobalCeiling_RetryStormIsBoundedEndToEnd` `TestGlobalCeiling_RejectsLimbBelowConcurrency`
`global_window`	24h0m0s	Rolling window both global limbs are measured over; strictly after the cutoff, matching the gateway's own window arithmetic. 0 = total mode: nothing ages out, and unlike aggregate_window it is DURABLE, so an exhausted ceiling survives a restart until an operator raises a limb or removes the ledger.	`TestGlobalCap_WindowRollsOver` `TestGlobalCeiling_WindowBoundaryAtTheCutoff` `TestGlobalLedgerTotalModeHasNoDecay` `TestGlobalCeiling_RefusalSurvivesARestartInBothWindowModes`
`task_timeout`	30m0s	Wall-clock bound per task: on expiry the run context is cancelled and the task terminates without pushing (VM force-delete is best effort). Hard.	`TestHandleTask_TimeoutTerminatesAndDoesNotPush`
`verify.repos.*.timeout`	10m0s per command when the repo's config leaves it unset	Wall-clock bound per verification command; on expiry the verify VM is force-removed and the command records timed_out, so the overall verdict reads inconclusive — never passed. Verifier output is display-only (log + host-side digest), bounded by the same per-task host output cap limit as the agent run, from a separate budget. Hard.	`TestRunVerify_TimeoutIsInconclusiveNeverPassed`
`profiles.repos.*.timeout`	10m0s per command when the repo's profile leaves it unset	Wall-clock bound per setup/readiness command; on expiry the setup VM is force-removed, the command records timed_out, and the task fails closed with outcome setup_failed BEFORE the agent VM boots — no credential is ever injected into any VM and no API budget is spent. Setup output is display-only (log + host-side digest), bounded by the same per-task host output cap as the agent run. Hard.	`TestRunSetup_TimeoutForceDeletesVM`
`stage_quota_gb`	8	Per-task disk bound: the stage dir is an APFS sparse image of this size (macOS). Hard (filesystem ENOSPC).	`TestQuota_HardBoundENOSPC`
`(built-in) stage soft bounds`	4 GiB, 200000 files, 2 GiB host free floor	Polling guard (2s) cancels a task growing past these, before the hard quota wall. Soft by design; the quota is the wall.	`TestHandleTask_StageFillTerminatesAndDoesNotPush`
`cache_quota_gb`	20 (0 = cache disabled)	Total disk for the persistent dependency cache under cache_root, all opted-in repos combined. Least-recently-used entries are evicted past the bound (and below a host free-space floor) at brokerd boot and after each cache-using task; entries mounted by live tasks are never evicted, so a sweep can end over-quota only while those tasks still hold the excess.	`TestStore_EvictLRU`
`(built-in) review diff cap`	32 MiB	A staged diff over the cap fails the task closed; a diff is never truncated for review. Hard.	`TestCaptureDiff_OversizeDiffFailsClosed`

Soft means enforcement is post-hoc or polling-based with a stated overshoot bound; hard means the mechanism cannot be raced. The full adversarial context is in the threat model.