Operator configuration (config.yaml)

Agor reads ~/.agor/config.yaml as deployment-owned, immutable runtime input. agor init creates it once with mode 0600. After initialization Agor does not silently rewrite it, preserving comments, formatting, key order, YAML anchors, read-only ConfigMaps, and infrastructure-as-code ownership.

Change operator settings in the file (or its Helm/Terraform/Ansible/secret-manager source), then restart the daemon. Settings needed before the database is reachable—database/bootstrap, tenant routing, filesystem, listener, executor, and security settings—belong here or in deployment env.

The agentic-tool package set can be declaratively deployment-owned:

agentic_tools:
  installed:
    - claude-code
    - codex

After editing this list, run agor install --sync. It installs the exact matching package version, removes unconfigured tools and packages from older Agor versions, and leaves config.yaml untouched. The packaged daemon fails before listening if any configured integration is missing or misaligned. Tenant administrators may disable an installed tool but cannot install packages or enable a tool absent from this deployment list.

If agentic_tools.installed is absent, local CLI installs instead use a host-local managed manifest. Run interactive agor install to create or change it. The manifest is never exposed for mutation through API, UI, or MCP. Headless deployments should use an explicit YAML list, including [].

Environment precedence

Supported environment overrides still win over YAML. Important examples are PORT, DAEMON_HOST, DAEMON_URL, AGOR_JWT_SECRET, AGOR_MASTER_SECRET, AGOR_TELEMETRY, AGOR_RBAC_ENABLED, AGOR_UNIX_USER_MODE, AGOR_EXECUTOR_USERNAME, and AGOR_DAEMON_UNIX_USER. They are resolved in memory and never written back.

JWT and master secrets must be stable. Prefer a deployment secret manager. If neither env nor YAML provides one, the daemon fails closed rather than silently rotating it.

Inspecting and materializing effective configuration

agor config shows the effective result after defaults and supported environment overrides are applied. agor config --yaml emits machine-readable YAML with secrets redacted. Use --yaml --show-secrets only when redirecting to a protected destination and intentionally materializing a complete replacement file. Agor provides no config set/get/unset mutation commands; edit the deployment-owned source explicitly.

Ownership

• Deployment-global: YAML/environment (agentic-tool packages, database, tenancy, static tenant, listener, secrets, filesystem, executor, security, global telemetry).
• Tenant-owned: database-backed workspace settings such as agentic tools and Knowledge policy.
• User-owned: database-backed preferences, credentials, and defaults.

Tenant administrators cannot mutate deployment-global settings. The accepted structure is defined by AgorConfig in packages/core/src/config/types.ts; unknown/removed keys fail validation. Init stamps the stable operational defaults needed for a working deployment, but deliberately does not materialize every optional long-tail field. Leaving those absent preserves their documented default-following semantics across upgrades.