# DSH Supreme v1.1 — LAB composition fragment (bundle users).
#
# Recomposes the seven bundle rows to the LAB composition (Spec §16): the
# full suite plus LAB-only overrides — LAB executionClass, paid override
# (allowPaid: true), command-capable verifier, capped concurrent agents.
# Structurally distinct from production ON PURPOSE: NEVER ship this fragment
# in a production profile.
#
# Patch semantics (vendor/include applyEntryPatches, the exact algorithm boot
# uses): rows here are UPDATE patches — they target rows the bundle layer
# inserted by `id`, replacing each row's whole `config`. They intentionally
# carry NO `name`: an update patch's name must match the installed row's
# resolved name verbatim, which is install-location-dependent, so restating
# it here would be skipped.
#
# Apply with ONE of:
#   1. overlay (no file edits):
#      dsh --profile <name> --patch "$DSH_HOME/profiles/<name>/node_modules/dsh-supreme/config/compositions/lab.patch.yml"
#   2. copy the rows below into your profile's cordis.patch.yml (last write
#      wins per row id).
#
# Paths are RELATIVE to the dsh process working directory. Override any row
# from your own patch layer — user layers always win.

- id: supreme-policy
  config:
    executionClass: LAB
    allowPaid: true
    # v1.3 ASTRA posture — LAB is the ONLY fragment where the enforcing demo
    # ships: unsanctioned capability classes are DENIED except the declared
    # LAB allowlist (additive, binds only because executionClass=LAB).
    enableEncodingScan: true
    capabilityClassGate: ENFORCE
    labCapabilityClassAllowlist:
      - DESTRUCTIVE_OPS
    # v1.3 CoT-visibility demo: a route declared `none` never denies on
    # cot_missing (downgraded to audit), and ENFORCE applies only to
    # HIGH-risk tools under riskGatedCoT. Both keys are relaxations only —
    # with reasoningTracePolicy at its OFF default they are inert until you
    # turn the CoT gate on.
    cotVisibilityProfiles:
      astra-demo-route: none
    riskGatedCoT: true

- id: supreme-observability
  config:
    dataDir: '.supreme-data/observability'

- id: supreme-benchmark
  config:
    dataDir: '.supreme-data/benchmark'
    # v1.3 anti-sandbagging: score claims without verifier-PASS evidence are
    # flagged `evidenceBacked: false` (flag only — scores are never rewritten).
    requireEvidenceForScores: true

- id: supreme-fake-llm
  config:
    provider: synthetic-free

- id: supreme-router
  config:
    candidates:
      - provider: synthetic-free
        credentialMode: config-owned
        credentialConfigured: true
        quotaHeadroom: 0.95
        models:
          - model: synthetic-mini
            costClass: FREE_CONFIRMED
            capabilities: [chat]
            contextWindow: 32768
            failureDomain: synthetic
      - provider: synthetic-paid
        credentialMode: config-owned
        credentialConfigured: true
        quotaHeadroom: 0.9
        models:
          - model: synthetic-paid-large
            costClass: PAID
            capabilities: [chat]
            contextWindow: 131072
            failureDomain: synthetic-paid
    # v1.3 anti-sandbagging: candidates whose benchmark scores lack
    # verifier-PASS evidence are routed with this FIXED downweight factor
    # (0.5 halves the score). 1 disables. Deterministic, no ML.
    unscoredEvidenceWeight: 0.5
    # v1.3.1 (IMP-R) outcome-routing keys — LAB demo keeps everything at its
    # behavior-preserving default: the fast path stays OFF (its fanout-0
    # direct-routing demo is a production posture, see the supreme fragment),
    # bounds/circuit/class-aware scoring inherit their documented defaults.
    fastPath:
      enabled: false

- id: supreme-verifier
  config:
    allowCommands: true
    allowedRoots:
      - '.supreme-data'

- id: supreme-memory-policy
  config:
    registerPromptSection: false
    projectKnowledge:
      - id: lab-overview
        text: 'LAB composition: verbose diagnostics and synthetic fixtures are permitted here only.'
        priority: 70

- id: supreme-workflow-policy
  config:
    maxConcurrentAgents: 4
    # v1.3 A2A + overreach demo: one DECLARED directed edge; contacts inside
    # the graph pass. v1.3.1 demo posture: agentContactPolicy DENY — contacts
    # OUTSIDE the graph are blocked pre-fact at tools/pre-execute (in LOG_ONLY
    # they are only audited). Registry-first identity (FIX-D): only tools in
    # the trusted registry (+ this add-only extension) are inspected; the
    # `desk_pager` entry demonstrates the extension, ordinary tools whose
    # arguments merely contain `target`/`to` are never touched. Delegations
    # above the MEDIUM ceiling or touching blocked paths are audited as
    # `overreach_suspected` (labels/globs only, never path values).
    agentContactPolicy: DENY
    allowedContacts:
      - from: orchestrator
        to: researcher
    commsToolNames:
      - desk_pager
    maxRiskLevel: MEDIUM
    approvalRequiredFor:
      - DESTRUCTIVE_OPS