t1k-config-core.json

registryVersion: 1 · priority: 10
Core layer — always available. No engine-specific context required.
Feature flags

Flag	Value
`agentFanOut`	`true`
`autoCommitKitSync`	`true`
`autoGlobalInstall`	`true`
`autoIssueSubmission`	`true`
`autoLessonSync`	`true`
`autoPushKitSync`	`true`
`autoUpdate`	`true`
`autoUpdateMajor`	`true`
`configTelemetry`	`true`
`contextBloatGuard`	`true`
`contextBudget`	`true`
`delegationDrift`	`true`
`delegationFloor`	`true`
`doctorSweepGuard`	`true`
`enforceAgentRouting`	`true`
`executionTrace`	`true`
`forkDepthGuard`	`true`
`hookLogging`	`true`
`imageAnalysisRouting`	`true`
`kitScopeSessionGuard`	`true`
`mainSessionReadStreakNudge`	`true`
`modelUsageTelemetry`	`true`
`sessionArchive`	`true`
`telemetry`	`true`
Raw JSON (ground truth)
{
  "autoIssueSubmission": {
    "dedupeTTLDays": 7,
    "dryRunEnv": "T1K_AUTO_ISSUE_DRY_RUN",
    "maxPerSession": 5
  },
  "autoLessonSync": {
    "dedupeTTLDays": 7,
    "dryRunEnv": "T1K_LESSON_SYNC_DRY_RUN",
    "maxPerSession": 5
  },
  "cli": {
    "npmPackage": "@the1studio/theonekit-cli",
    "repo": "The1Studio/theonekit-cli"
  },
  "cloudReleaseCostGate": {
    "cli": [
      {
        "bin": "wrangler",
        "subcommands": [
          "deploy",
          "d1 execute",
          "d1 migrations apply",
          "r2 object put",
          "r2 multi-object delete",
          "kv key put",
          "kv bulk put",
          "secret put",
          "queues create",
          "pages deploy"
        ]
      },
      {
        "bin": "terraform",
        "subcommands": [
          "apply"
        ]
      },
      {
        "bin": "gcloud",
        "subcommands": [
          "deploy",
          "functions deploy",
          "run deploy",
          "app deploy",
          "dns record-sets",
          "firestore",
          "datastore"
        ]
      },
      {
        "bin": "aws",
        "subcommands": [
          "s3 cp",
          "s3 sync",
          "s3 rb",
          "dynamodb put-item",
          "dynamodb batch-write-item",
          "dynamodb update-item",
          "lambda create-function",
          "lambda update-function-code",
          "rds create-db-instance"
        ]
      },
      {
        "bin": "flyctl",
        "subcommands": [
          "deploy",
          "volumes create"
        ]
      },
      {
        "bin": "fly",
        "subcommands": [
          "deploy",
          "volumes create"
        ]
      },
      {
        "bin": "vercel",
        "subcommands": [
          "deploy",
          "env add"
        ]
      },
      {
        "bin": "firebase",
        "subcommands": [
          "deploy"
        ]
      },
      {
        "bin": "netlify",
        "subcommands": [
          "deploy"
        ]
      },
      {
        "bin": "serverless",
        "subcommands": [
          "deploy"
        ]
      },
      {
        "bin": "sls",
        "subcommands": [
          "deploy"
        ]
      }
    ],
    "enabled": true,
    "enforce": false,
    "planCostSection": "## Cost Estimate",
    "planMarker": "t1k:cost-accounted",
    "planSignalFiles": [
      "plan.md",
      "phase-*.md",
      "*.md"
    ],
    "pricing": {
      "d1RowsReadPerM": 0.001,
      "d1RowsWrittenPerM": 1,
      "note": "Pricing display is advisory; the hook never computes a bill. Rates retrieved 2026-08-29 from the t1k-datastore-cost skill.",
      "r2ClassAPerM": 4.5,
      "r2ClassBPerM": 0.36
    },
    "promotionRatchet": "WARN-FIRST (2026-08-29). Promote enforce:true via minor bump when three consecutive weeks of disciplined deploy sessions are observed — no legitimate deploy blocked, and every gate-firing deploy is either cost-accounted or T1K_COST_ACCOUNTED=1. Delete this ratchet note when promoted.",
    "triStateMode": true
  },
  "context": {
    "description": "Core commands run in any context",
    "requiredFeatures": [],
    "requiredPaths": []
  },
  "contextBudget": {
    "autoCommitOnRoll": true,
    "autoResumeOnStart": true,
    "autoRoll": true,
    "thresholdPercent": 60
  },
  "delegationDrift": {
    "threshold": 5
  },
  "delegationFloor": {
    "sweepThreshold": 12
  },
  "delegationFloorGate": {
    "enabled": true,
    "exemptPrefixes": [
      "plans/",
      ".claude/",
      "docs/",
      "wiki/"
    ],
    "hardThreshold": 8,
    "smallEditChars": 1200
  },
  "description": "Core layer — always available. No engine-specific context required.",
  "features": {
    "agentFanOut": true,
    "autoCommitKitSync": true,
    "autoGlobalInstall": true,
    "autoIssueSubmission": true,
    "autoLessonSync": true,
    "autoPushKitSync": true,
    "autoUpdate": true,
    "autoUpdateMajor": true,
    "configTelemetry": true,
    "contextBloatGuard": true,
    "contextBudget": true,
    "delegationDrift": true,
    "delegationFloor": true,
    "doctorSweepGuard": true,
    "enforceAgentRouting": true,
    "executionTrace": true,
    "forkDepthGuard": true,
    "hookLogging": true,
    "imageAnalysisRouting": true,
    "kitScopeSessionGuard": true,
    "mainSessionReadStreakNudge": true,
    "modelUsageTelemetry": true,
    "sessionArchive": true,
    "telemetry": true
  },
  "forkDepth": {
    "budget": 3,
    "fanOutCapEnforce": true
  },
  "issueClaim": {
    "adminMerge": {
      "bypassReview": true,
      "enabled": false,
      "requireCiGreen": true
    },
    "bodyMarkerPrefix": "t1k-claim:",
    "enforcementMode": "hard-block",
    "inScopeRepos": [
      "The1Studio/theonekit-*",
      "The1Studio/t1k-*",
      "The1Studio/unity-mcp",
      "The1Studio/cocos-mcp-server"
    ],
    "labelName": "t1k:claim",
    "stalenessDays": 14
  },
  "kitName": "theonekit-core",
  "mainSessionReadStreak": {
    "threshold": 8
  },
  "mcp": {
    "optional": [
      {
        "installCmd": "claude mcp add playwright -- npx @playwright/mcp@latest --headless",
        "name": "playwright",
        "purpose": "Browser automation for E2E testing and visual regression",
        "verifyTool": "mcp__playwright__"
      },
      {
        "installCmd": "claude mcp add chrome-devtools -- npx -y chrome-devtools-mcp@latest",
        "name": "chrome-devtools",
        "purpose": "Browser DevTools for console, network, and performance analysis",
        "verifyTool": "mcp__chrome-devtools__"
      },
      {
        "_versionPinComment": "firebase-tools@15.28.2; verified 2026-08-28.",
        "installCmd": "~/.claude/skills/t1k-mcp-management/scripts/install-firebase-mcp.sh",
        "name": "firebase",
        "purpose": "Firebase CLI/console tooling from Claude — projects, Remote Config, Firestore rules, App Distribution. Developer tooling only; NOT the Unity client SDK (see the t1k-unity-mobile-3rd-integrate skill for that). Auth uses the operator's ambient `firebase login` CLI session; no credential is stored by this entry.",
        "scope": "user",
        "servedTools": [
          "firebase_login",
          "firebase_logout",
          "firebase_get_project",
          "firebase_list_apps",
          "firebase_list_projects",
          "firebase_get_sdk_config",
          "firebase_create_project",
          "firebase_create_app",
          "firebase_create_android_sha",
          "firebase_get_environment",
          "firebase_update_environment",
          "firebase_init",
          "firebase_get_security_rules",
          "firebase_read_resources",
          "firebase_deploy",
          "firebase_deploy_status",
          "developerknowledge_search_documents",
          "developerknowledge_answer_query",
          "developerknowledge_get_documents"
        ],
        "verifyTool": "mcp__firebase__"
      }
    ],
    "recommended": [],
    "required": [
      {
        "installCmd": "claude mcp add github",
        "name": "github",
        "purpose": "GitHub issue/PR management for triage, sync-back, issue reporting",
        "verifyTool": "mcp__github__"
      },
      {
        "installCmd": "claude mcp add context7 --transport http -- https://mcp.context7.com/mcp",
        "name": "context7",
        "purpose": "Library/framework documentation lookup for planning and implementation",
        "servedTools": [
          "resolve-library-id",
          "get-library-docs"
        ],
        "verifyTool": "mcp__context7__"
      },
      {
        "installCmd": "claude mcp add sequential-thinking -- npx -y @modelcontextprotocol/server-sequential-thinking",
        "name": "sequential-thinking",
        "purpose": "Structured step-by-step analysis for problem-solving when stuck",
        "servedTools": [
          "sequentialthinking"
        ],
        "verifyTool": "mcp__sequential-thinking__"
      },
      {
        "installCmd": "claude mcp add memory -- npx -y @modelcontextprotocol/server-memory",
        "name": "memory",
        "purpose": "Cross-session knowledge persistence via knowledge graph",
        "verifyTool": "mcp__memory__"
      },
      {
        "autoInstall": true,
        "installCmd": "~/.claude/skills/t1k-mcp-management/scripts/install-plane.sh",
        "name": "plane",
        "purpose": "Plane work-item / project tracking (issues, cycles, modules, pages)",
        "requiredEnv": [
          "PLANE_API_KEY"
        ],
        "scope": "user",
        "verifyTool": "mcp__plane__"
      }
    ]
  },
  "priority": 10,
  "registryVersion": 1,
  "repos": {
    "primary": "The1Studio/theonekit-core"
  },
  "scopeEnforcement": {
    "_readerNote": "Read ONLY through hooks/lib/scope-enforcement-config.cjs — readScopeEnforcement(claudeDir). Never hand-roll a second fragment scan, and never re-spell a default at a call site. Merge rule is override-by-priority: core is priority 10, so an engine kit at 90 CAN override this whole block — that is the intended escape hatch. There is deliberately NO bloatUnionTokens key: a union-token threshold fires on 78% of installs with zero duplication, so it was removed rather than re-tuned. features.contextBloatGuard is a features.* flag and is NOT part of this block.",
    "allowKits": [],
    "autoRemoveKits": [
      "core",
      "model-router"
    ],
    "bloatDoubleLoadedTokens": 8000,
    "enabled": true,
    "lockStaleMinutes": 15,
    "maxRemovalsPerRun": 2,
    "removalCooldownDays": 7,
    "unusedLookbackDays": 7
  },
  "sessionArchive": {
    "blobEndpoint": "https://t1k-telemetry.the1studio.org/ingest/session-archive/blob",
    "defaultOnNote": "features.sessionArchive ships ON by default as of 2026-08-14, by explicit maintainer decision, ahead of the authz gate this key previously guarded. Opt-out still works and is the supported control: set features.sessionArchive=false in ANY t1k-config-*.json fragment and readFeatureFlag() returns false immediately (a false anywhere wins). The hook's code-level fallback stays fail-closed on purpose — a machine whose config is absent or unreadable does NOT upload.",
    "denyProjectPaths": [
      "/contracts",
      "/legal",
      "/client-work",
      "/clients",
      ".env",
      "-contracts",
      "-legal",
      "-clients"
    ],
    "endpoint": "https://t1k-telemetry.the1studio.org/ingest/session-archive",
    "knownOpenRisks": [
      "R2 deletion is UNPROVEN (t1k-telemetry-worker#66): `wrangler r2 object delete` reports success unconditionally — it prints 'Delete complete.' for a bucket that does not exist — and one object survived three deletes with a subsequent read returning its full body. The OAuth session carries no r2 scope, so a permission failure would be invisible. Until a verifying delete path lands, treat the retention policy as a stated intention, not a demonstrated capability: we can write, and we have not yet shown we can erase.",
      "theonekit-service has no auth middleware and per-user scoping is structurally impossible — 0 of 162 users carry both an email and a GitHub login, so email<->GitHub linkage cannot be resolved. Session archives carry full transcript bodies, so anything that serves them is currently unscoped.",
      "The scrubber (hooks/lib/session-scrubber.cjs, shipped in t1k-base@2.47.0) is the ONLY control between a pasted credential and R2. Its /g+lastIndex regression suite is a CI gate and does NOT ship to consumers — __tests__/ is excluded from the release payload. Changes to the scrubber must be gated in CI, because nothing re-verifies it on a consumer machine."
    ],
    "maxBodyBytes": 12582912,
    "maxUploadsPerRun": 25,
    "r2KeyNote": "sessions/{user}/{session_id}.jsonl.gz — bound server-side from the verified GitHub token; the client-sent value is ignored.",
    "statusEndpoint": "https://t1k-telemetry.the1studio.org/ingest/session-archive/status"
  },
  "telemetry": {
    "cloud": {
      "auth": "github-token",
      "enabled": true,
      "endpoint": "https://t1k-telemetry.the1studio.org/ingest",
      "org": "The1Studio"
    }
  }
}