Pack configuration

Installed packs declare their namespace and shipped schema in the pack manifest. Kernel startup validates these settings and delivers the resolved configuration to ordinary subprocess handlers as context.pack_config. Tool input and caller metadata cannot replace this trusted configuration or expand permissions.

Workspace key	Value	Omitted behavior
`sidekick.default_priority`	`P0`, `P1`, `P2`, `P3`	Task priority `P2`
`sidekick.default_list_limit`	Positive safe integer	Unlimited task listing
`campus.telemetry_sample_limit`	Positive safe integer	Unlimited PUE samples in persisted order
`knowledge.ingestion.max_documents`	Positive safe integer	Unlimited documents per explicit ingestion batch
`knowledge.ingestion.max_total_bytes`	Positive safe integer	Unlimited UTF-8 content bytes per explicit ingestion batch

Positive safe integers range from 1 to 9007199254740991. All three schemas reject unknown keys; Knowledge also rejects unknown ingestion keys. Invalid consumer settings prevent runtime startup.

Sidekick and Campus standalone packages use the existing publish lifecycle to rewrite source manifest entries to compiled dist/ files during packing and restore the source manifest afterwards. Their shipped schemas stay at the pack root. CLI bundling uses the same manifest rewrite, so both distributions resolve the compiled tools and policy factory.

Edit settings

Install the relevant pack, then use the supported commands. Read each command’s help before first use:

pnpm config:set --help
pnpm config:get --help
pnpm config:unset --help
pnpm config:set --key sidekick.default_priority --value P1
pnpm config:set --key sidekick.default_list_limit --value 10
pnpm config:set --key campus.telemetry_sample_limit --value 100
pnpm config:set --key knowledge.ingestion.max_documents --value 1000
pnpm config:set --key knowledge.ingestion.max_total_bytes --value 1048576
pnpm config:get --key sidekick.default_priority
pnpm config:unset --key sidekick.default_priority

Unsetting an optional setting restores its omitted behavior. Use pack:install to manage pack entries and configuration commands to manage settings. Do not hand-edit the workspace YAML.

Initialize a complete pack configuration

An installed non-Software Delivery pack can require sibling fields that cannot be introduced one at a time while the complete schema is validated. In that case, pass its full configuration object to config:set:

pnpm config:set --key agent_runtime --json-value \
  '{"default_model":"default","models":{"default":{"provider":"openai_responses","model":"operator-configured","api_key_env":"OPERATOR_MODEL_KEY"}}}'

The installed manifest must declare the namespace and a readable config_schema. The command validates required and unknown fields before writing. Fields and profiles omitted from the replacement are removed. Whole-root replacement is limited to installed non-Software Delivery packs; the software_delivery section stays nested-only. Configuration does not infer permission scopes or provider access; supply execution grants separately through the owning workspace and lane configuration.

Sidekick

sidekick-task:create uses the configured priority when input omits priority; an explicit valid priority takes precedence. sidekick-task:list similarly uses the configured list limit when input omits limit. Explicit limits take precedence. Storage remains under .sidekick/, and existing scopes, audits, and destructive operation approvals continue to apply.

The current native subprocess sandbox accepts exact existing regular-file grants and refuses directory or wildcard grants. Native task creation is currently unsupported because it needs directory, lock, temporary-file, and audit writes. Configuration does not remove that restriction. Existing task listing can use an exact read grant for .sidekick/tasks/tasks.json. Launch the consumer from its workspace directory; Sidekick’s filesystem adapter resolves default storage from the process working directory. Library handler previews demonstrate priority defaults without proving native persistence or directory writes.

Campus

campus:pue_telemetry selects the newest samples by timestamp when a sample limit is configured, then returns that selection chronologically. total_samples counts all available samples and truncated reports whether the selection omitted any. Omitting the setting preserves unlimited results in their original persisted order. The limit does not change power-signal selection, read scopes, authorization, or facility control restrictions.

Campus state lives under the pack-owned .campus root, outside the kernel-reserved .lumenflow/** tree, so installed Campus tools dispatch through the kernel. The workspace, lane and task must grant the files a lane may read: the subprocess sandbox mounts exact existing files, so narrow the shipped .campus/** requirement to those files, as you would narrow .sidekick/**. Changing telemetry_sample_limit does not grant access to any file. State left at the earlier .lumenflow/state/campus location is still read when the new root lacks the file, but the sandbox does not expose that reserved tree, so move it (for example mv .lumenflow/state/campus .campus). Add .campus/ to your .gitignore: it holds tenant evidence and facility telemetry and must not be committed.

Knowledge: explicit library configuration

Knowledge ships no manifest tools (tools: []). Workspace configuration never implicitly reaches its ingestion library. Pass the budgets explicitly in your application:

await ingestLocalKnowledgeSource({
  sourceId: 'handbook',
  reader,
  embeddingProvider,
  ingestion: { max_documents: 1000, max_total_bytes: 1048576 },
});

The library strictly validates the explicit ingestion settings before reading. After the reader returns, it checks the complete batch’s document count and sum of UTF-8 document content bytes before invoking any embedding provider. Metadata and paths do not count toward content bytes. Exceeding either budget throws without partial embedding; equality is accepted. Each omitted budget is unlimited. Readers and embedding providers are caller-injected and determine processing location and data handling, including whether content leaves the machine. The adapter has no built-in filesystem, network, or embedding-vendor client. ACL, citation, and deletion behavior continue to apply. Retrieved content is kept separate from caller instructions; this does not guarantee prompt-injection immunity in a consuming agent.

The trusted handler field is context.pack_config; there is no standard context.policy field. Defaults are not an authorization mechanism.