Constraints

The defaults every product repository starts with. Generated from internal/config/defaults.toml, the configuration embedded in the binary, by go generate ./...; do not edit by hand. A repository changes them in .aayudha/config.toml, which is a protected path. The Quality Architect seat owns these thresholds; the AI Native Engineer executes verify against them. Changing a default regenerates this file, which is also a protected path.

Source: a WP means docs/BUILD-PLAN.md fixes the value there; "proposed (WP0.5)" means the plan names the key but not its value, and WP0.5 chose it.

Floors

Key	Default	Meaning	Source
`verify.dast`	`true`	Run the ZAP DAST floor against the running app when `[verify] platforms` has web or api. Its active cross-site scripting and injection rules run only against an app `[verify] seed` started on a loopback host (one that did not answer before the seed ran); any other URL gets a passive scan unless its environment sets `active_scan = true` (read only from `.aayudha/config.toml`). ZAP runs under Docker or Podman; with neither, a local run skips and a CI run is blocked.	founder decision 2026-10-17 (DAST)
`verify.red_on_base_blocking_from`	`"2026-11-13"`	Date (UTC) from which a Bug story whose mapped proving test passes on the base commit fails the merge gate (red-on-base, P5). Before it the check is advisory: four weeks after the founder decision of 2026-10-15.	0.2 (P5)
`verify.new_floors_blocking_from`	`"2026-11-14"`	Date (UTC) from which the floors and defaults of the founder decision of 2026-10-17 on proof floors fail the merge gate; before it a miss is advisory: four weeks after that decision.	founder decision 2026-10-17 (floors)
`verify.drift_blocking_from`	`"2026-11-13"`	Date (UTC) from which feature-map drift (`aayu verify --map`) fails the merge gate's feature-map floor. Before it drift is a warning: four weeks after the founder decision of 2026-10-16.	0.2 (WP4.5b)
`verify.floors.coverage.min_diff_percent`	`90.0`	Minimum coverage of changed lines (lcov, cobertura, or Go coverprofile). 89.9 fails, 90.0 passes.	WP4.3
`verify.floors.sast.max_critical`	`0`	Critical semgrep findings allowed.	WP4.4
`verify.floors.sast.max_high`	`0`	High semgrep findings allowed.	WP4.4
`verify.floors.secrets.max_findings`	`0`	gitleaks findings allowed.	WP4.4
`verify.floors.deps.max_critical`	`0`	Critical osv-scanner vulnerabilities allowed.	WP4.4
`verify.floors.deps.max_high`	`0`	High osv-scanner vulnerabilities allowed.	WP4.4
`verify.floors.a11y.standard`	`"WCAG 2.2 AA"`	Accessibility standard axe checks against.	WP4.5
`verify.floors.a11y.max_critical`	`0`	Critical axe violations allowed.	WP4.5
`verify.floors.a11y.max_serious`	`0`	Serious axe violations allowed.	WP4.5
`verify.floors.a11y.keyboard_only`	`true`	Every Completion Goal state must be reachable by keyboard alone.	WP4.5
`verify.floors.a11y.reduced_motion`	`true`	Every state is captured with reduced motion on.	WP4.5
`verify.floors.a11y.text_scale_percent`	`200`	Text scaling every state must survive.	WP4.5
`verify.floors.a11y.min_target_px`	`44`	Minimum touch target edge, in CSS pixels (44×44).	WP4.5
`verify.floors.screen_reader.layers`	`["L01"]`	Story footprints that run the VoiceOver and NVDA floor (on label or nightly).	WP4.7
`verify.floors.screen_reader.max_missing_phrases`	`0`	Expected phrases from the Ready snapshot that may be missing from the transcript.	WP4.7
`verify.floors.dast.max_high`	`0`	High-risk ZAP alerts allowed when DAST runs (passive baseline plus the active cross-site scripting and injection rules).	proposed (WP0.5)
`verify.floors.dast.skipped_blocks_ship`	`true`	A web or api story with no runnable target (no `[verify.environments.<env>] url`, or `dast = false`) records `skipped: dast`, which blocks `ship` unless a floor-waiver Decision exists. A run with no story, such as the security workflow's, records it without blocking.	founder decision 2026-10-17 (DAST)
`verify.floors.mobile.skipped_blocks_ship`	`true`	A `skipped: mobile` floor blocks `ship` unless a floor-waiver Decision exists.	WP4.9

Performance (Lighthouse CI) and API (k6) budgets are product-specific and have no default (WP4.5, WP4.6). Every floor miss blocks; no model disposition can override it (ground rule 7). A waiver is a recorded Decision (decide --waiver <floor>, WP5.6) that audit counts.

Autonomy

Key	Default	Meaning	Source
`autonomy.streak`	`20`	Consecutive correction-free merges on a layer before agents may merge on it without a human pass. Computed by the protected streak workflow from merged-PR history, never stored where an agent can write it (V4).	WP5.7
`autonomy.never`	`["L04", "L07", "L09"]`	Layers that always need a human CODEOWNER approval and an EM plan-time review, whatever the streak: domain/policy, operational data/state, and platform.	proposed (WP0.5)
`autonomy.approver`	`""`	GitHub login that gives the human pass in solo mode. Empty until `init` sets it.	WP5.5
`autonomy.correction_days`	`14`	Days after a merge in which a Bug or Incident that links the PR counts as a correction and resets the streak of every layer the PR touched.	proposed (WP5.7)
`autonomy.proof`	`false`	Merge a PR into the integration branch on proof alone: every required check green, the merge gate's pack verified with its floors holding, inspect at merge with a `proof_rungs` rung, and nothing in the narrow set. The streak, never layers and plan review then feed the sampled audit after merge instead of blocking.	WP5.7
`autonomy.proof_rungs`	`["A", "B", "C"]`	Review rungs at the head that let `ship` merge on proof.	WP5.7
`autonomy.always_person`	`[".github/CODEOWNERS", ".aayudha/config.json", ".aayudha/config.local.toml", ".aayudha/config.local.json", "loops/build-ready.toml"]`	The narrow set: paths whose change always needs a person per PR (a trailing `/` covers a directory; otherwise a glob). A workflow that holds a credential (a secret, the workflow token, an environment, or a write permission, or a job left to the default permissions) is in it by rule.	WP5.7
`autonomy.always_person_config`	`[".aayudha/config.toml"]`	Config files whose `always_person_sections` need a person per PR when they change.	WP5.7
`autonomy.always_person_sections`	`["identity", "approvals", "autonomy", "seats", "verify", "inspect", "review", "models", "branches", "decisions", "proof", "delegate", "notify", "integrations", "telemetry", "mcp", "hosts", "lfs", "measure", "budget", "scope", "build"]`	Config tables, by their first key and whatever their case, that decide who may approve or bypass, how a PR is verified, reviewed, and proven, or where a credential is sent.	WP5.7
`autonomy.budget.wall_hours`	`8`	Wall-clock hours one `build` may run before the story is marked `status:blocked` and the owner is paged.	proposed (WP0.5)
`autonomy.budget.cost_usd`	`60.0`	Metered model spend, in USD, one `build` may use before it is blocked. It applies only when aayu's own model calls are pay-as-you-go: a `[models.gateway]` endpoint or a direct provider's key (anthropic, openai, google, xai) is configured, or a host reports pay-as-you-go spend in `AAYU_COST_USD`. A lower `budget.per_story_usd` is the limit build reports and enforces, since the breaker would stop the story there. With neither there is no cost limit, because subscription use reports no cost; build and status say so.	proposed (WP0.5)
`autonomy.budget.attempts`	`3`	Failed checkpoint attempts before a story is blocked. A second failure on a never-layer blocks regardless.	proposed (WP0.5)

Budgets

Key	Default	Meaning	Source
`build.in_flight`	`1`	Items the build-ready loop (`aayu build --next`) has in progress at once, from claim to merge: its open pull requests and its claims with no pull request yet. 0 stops its picks.	proposed (build loop)
`budget.per_story_usd`	`60.0`	Model spend per story, in USD, before the circuit breaker pauses agent lanes (exit 6). At least `autonomy.budget.cost_usd`, so the breaker never stops a story before its build budget does.	proposed (WP0.5)
`budget.per_day_usd`	`100.0`	Model spend per repository per day, in USD, before the breaker trips.	proposed (WP0.5)
`budget.per_pr_inspect_max`	`5.0`	Model spend, in USD, for `inspect` on one PR across all its cycles.	proposed (WP0.5)
`budget.ci_minutes_month`	`2000`	GitHub Actions minutes per month that agent-started workflows may use.	proposed (WP0.5)

When a budget trips, the breaker pauses agent lanes and pages through [notify] once per day (WP1.6).

Release scope

Key	Default	Meaning	Source
`scope.budget_percent`	`20.0`	Drift a release may take after a person accepts its baseline, in percent of the baseline's effort points: items added, removed, or resized. Beyond it, `aayu scope` refuses the change until a person accepts it, through GitHub's device flow, against an accepted Decision.	0.3 (@rahulnakmol: 15 to 20 %)
`scope.effort_points`	`[1, 2, 3, 5, 8]`	Effort points of XS, S, M, L, and XL: the weight of each Story and Bug in a plan and in its drift. Initiatives and Features weigh nothing themselves; they count through their Stories and Bugs.	0.3

aayu scope stores each accepted baseline and its drift on the ledger branch under releases/<version>/. Accepting a baseline, and any change over budget, is a person's call.

Outcomes

Key	Default	Meaning	Source
`outcomes.session_gap_minutes`	`10`	A gap of more than this many minutes between two human-identity actions in the actions log on the `ledger` branch starts a new founder session.	0.4
`outcomes.action_minutes`	`2`	Minutes each founder session adds for its last action, on top of its span from its first action to its last.	0.4

aayu measure reads aayu:founder_minutes_per_pr as the sum of the founder sessions in the window divided by the pull requests merged into the integration branch in it. It is a proxy: it counts time in aayu's recorded human actions, not time spent elsewhere. Bot and human-fallback records never count; a window with no merged pull request has no value.

Design review

Key	Default	Meaning	Source
`review.figma_diff_max`	`2.0`	Largest share of pixels, in percent, a prototype screenshot may differ from its Figma frame after the anti-aliasing mask. Colour and typography token mismatches are counted separately and must be zero.	WP6.5
`review.baseline`	`["/"]`	URL paths on the `[verify.environments]` target that `baseline` captures for each commit.	proposed (WP6.6)

review runs lane A (the ui-review model) k = 3 times per state and counts a finding only when 2 of 3 runs report it at Nielsen severity 2 or more; lane B (impeccable, axe, focus-indicator and target-size probes) is deterministic, and its findings cannot be overridden by lane A (ground rule 7). These are fixed by the plan (WP6.6), not configuration.

Retention

Key	Default	Meaning	Source
`proof.media`	`""`	Optional private bucket for proof media beyond the merge gate's run artifact; `aayu ship` copies them there. Empty: proof media stay in the run artifact and never reach the `ledger` branch or Git LFS.	WP2.5
`proof.retention_days`	`90`	Days the merge gate keeps its `aayudha-pack` run artifact (media included), at most the repository's limit (GitHub: 90 public, 400 private); also the bucket's lifecycle rule. `pack.json` on the ledger is kept.	proposed (WP0.5)

Generated by aayu tell docs from CONSTRAINTS.md. Links to work items name only Features whose shipped stories all have authoritative proof packs. Agents: read this page as Markdown, or start from llms.txt.