Configuration (stratus.toml)
The kernel reads stratus.toml at boot. Local overrides go in stratus.local.toml (see stratus.local.toml.example in the repo root).
| Key | Default | Description |
|---|---|---|
auth_token |
— | Shared API token (X-Imara-Token / bearer; also the X-Admin-Token value) |
[profile].active |
local |
LLM profile: local (Ollama) or cloud (OpenAI-compatible) |
ear_model / brain_model |
per profile | Fast classification / heavy reasoning models |
chat_enforcement |
sync |
Pre-LLM policy on chat: sync or audit_only |
policy_file |
policy.toml |
Runtime token→role→capability policy |
ledger_dsn / registry_dsn |
(empty — bbolt) | PostgreSQL DSNs |
[runtime].isolation_mode |
goroutine |
subprocess gives heap isolation + hard kill |
[sandbox].enabled |
false |
Landlock + seccomp-BPF for agent subprocesses (Linux 5.13+) |
[agent_broker].enabled / .port |
true / 4222 |
Embedded NATS broker |
agent_token_budget |
100000 |
Default per-session token budget |
[audit_replication] |
disabled | Cloud WORM replica (s3/gcs/azure/minio, or kafka + audit-consumer) |
[snapshot] |
disabled | Periodic encrypted ledger backups to S3 |
[[ledger_webhooks]] |
— | Push commits to SIEM/Slack, filterable by status |
[metadata] |
./data/meta.db |
Regulator metadata index + fintech ID |
[cognis] |
disabled | Supervise Cognis verticals as governed child processes |