Settings

Everything LengoAI may do is set in lengo.yml. Saving here never writes the file: it opens a merge request, an owner approves it, and Core applies it once merged.

in force: 3e76baffa394

lengo.yml

comments explain each setting

Edit the file, then preview the change.

# LengoAI settings. Every field is validated by core/lengo_core/policy/schema.py and
# documented in docs/settings.md (JSON Schema: docs/settings.schema.json).
# This file is a protected path: change it through a merge request. The dashboard's
# settings editor opens that MR for you.
version: 1

autonomy:
  preset: hands_off            # assisted | supervised | hands_off | custom
  # Per-stage mode: suggest | approve | automatic. With a named preset these are
  # derived from the preset; set preset: custom to use them as written.
  stages:
    plan: automatic
    create: automatic
    verify: automatic
    secure: automatic
    package: automatic
    release: automatic
    configure: automatic
    monitor: automatic
    govern: automatic
  merge: automatic             # approve | automatic
  production_expand: automatic # approve | approve_final_step | automatic
  kill: automatic              # automatic | alert_only

goals:
  sources: [tickets, feedback, errors, issues]
  listener_auto_create: false
  listener_schedule: "0 */6 * * *"
  min_evidence_items: 5
  max_open_goals: 3

rollout:
  steps: [1, 10, 50, 100]
  # Demo timings for the live smoke tests, evaluation and video (2026-10-24): 30 and 10 in
  # normal use. The statistics' evidence thresholds are unchanged; only waiting is shorter.
  min_dwell_minutes: 5
  max_dwell_minutes: 1440
  stickiness: userId
  staging_soak_minutes: 2
  environment_scope: production

proof:
  method: msprt                # msprt | bayesian | fixed_horizon
  alpha: 0.05
  min_samples_per_arm: 500
  msprt_tau: auto              # auto (from memory priors) or a positive number
  srm_alpha: 0.001
  srm_min_detectable_shift: 0.02  # split error the SRM check must be able to catch before 100%
  min_practical_effect: 0.10   # relative improvement required to call a goal proven

guardrails:
  - metric: http_5xx_rate
    harmful_direction: increase
    hard_limit_abs: 0.02
    max_relative_increase: 0.10
    alpha: 0.01
  - metric: p95_latency_ms
    harmful_direction: increase
    max_relative_increase: 0.20
    alpha: 0.01

kill:
  mode: automatic              # automatic | alert_only
  eval_interval_seconds: 10
  actions: [disable_flag, open_incident, reopen_goal]
  cooldown_minutes: 60
  max_kills_per_goal: 2

code:
  # Agents may change only apps/pesalite/app/ (not the ledger) and apps/pesalite/tests/
  # (AGENTS.md section 2). Everything else is protected, including Core, the CI check that
  # judges the MR, the agents' prompts, CODEOWNERS and dependencies. "*" is every root file.
  protected_paths: ["*", "lengo.yml", ".gitlab-ci.yml", ".gitlab/**", "apps/pesalite/app/db.py",
                    "apps/pesalite/Dockerfile", "apps/pesalite/pyproject.toml",
                    "apps/pesalite/uv.lock", "ci/**", "core/**", "docs/**", "infra/**",
                    "loadgen/**", "memory/**", "scripts/**", "templates/**"]
  max_files_changed: 8
  max_lines_changed: 400
  require_flag_guard: true
  require_tests: true

memory:
  store: [outcomes, incidents, decisions, runbooks, conventions, feedback_summaries]
  retention_days: 365
  pii_redaction: strict        # strict | standard
  embedding_provider: vertex   # vertex | local_plugin | fake
  top_k: 8
  recency_half_life_days: 90

freeze:
  # Demo period (2026-10-24): the weekend freeze is lifted so the live smoke tests, evaluation
  # and video can run. Normal setting, to restore after the video:
  #   windows:
  #     - cron: "0 18 * * FRI"
  #       duration_hours: 62
  #       timezone: Africa/Nairobi
  windows: []
  allow_kill_during_freeze: true

budget:
  daily_flow_sessions: 40
  per_goal_flow_sessions: 15
  on_exhausted: pause_and_alert

handoff:
  stage_timeout_minutes: 20
  max_retries: 2
  max_hops_per_goal: 30

notifications:
  channels: [issue_note, email]
  notify_on: [awaiting_approval, killed, stuck, proven]

Change

Preview a change to see the diff and what it means.

Open a merge request

Why Admin token

lengo.yml is a protected path: CODEOWNERS must approve, and Lengo's agents can never change it.

Every setting in force

68 values, after defaults

Setting	Value
version	1
autonomy.preset	hands_off
autonomy.stages.plan	automatic
autonomy.stages.create	automatic
autonomy.stages.verify	automatic
autonomy.stages.secure	automatic
autonomy.stages.package	automatic
autonomy.stages.release	automatic
autonomy.stages.configure	automatic
autonomy.stages.monitor	automatic
autonomy.stages.govern	automatic
autonomy.merge	automatic
autonomy.production_expand	automatic
autonomy.kill	automatic
goals.sources	tickets, feedback, errors, issues
goals.listener_auto_create	False
goals.listener_schedule	0 /6 * *
goals.min_evidence_items	5
goals.max_open_goals	3
rollout.steps	1, 10, 50, 100
rollout.min_dwell_minutes	5.0
rollout.max_dwell_minutes	1440.0
rollout.stickiness	userId
rollout.staging_soak_minutes	2.0
rollout.environment_scope	production
proof.method	msprt
proof.alpha	0.05
proof.min_samples_per_arm	500
proof.msprt_tau	auto
proof.srm_alpha	0.001
proof.srm_min_detectable_shift	0.02
proof.min_practical_effect	0.1
guardrails[0].metric	http_5xx_rate
guardrails[0].harmful_direction	increase
guardrails[0].hard_limit_abs	0.02
guardrails[0].max_relative_increase	0.1
guardrails[0].alpha	0.01
guardrails[1].metric	p95_latency_ms
guardrails[1].harmful_direction	increase
guardrails[1].hard_limit_abs	None
guardrails[1].max_relative_increase	0.2
guardrails[1].alpha	0.01
kill.mode	automatic
kill.eval_interval_seconds	10.0
kill.actions	disable_flag, open_incident, reopen_goal
kill.cooldown_minutes	60.0
kill.max_kills_per_goal	2
code.protected_paths	, lengo.yml, .gitlab-ci.yml, .gitlab/, apps/pesalite/app/db.py, apps/pesalite/Dockerfile, apps/pesalite/pyproject.toml, apps/pesalite/uv.lock, ci/, core/, docs/, infra/, loadgen/, memory/, scripts/, templates/*
code.max_files_changed	8
code.max_lines_changed	400
code.require_flag_guard	True
code.require_tests	True
memory.store	outcomes, incidents, decisions, runbooks, conventions, feedback_summaries
memory.retention_days	365
memory.pii_redaction	strict
memory.embedding_provider	vertex
memory.top_k	8
memory.recency_half_life_days	90.0
freeze.windows
freeze.allow_kill_during_freeze	True
budget.daily_flow_sessions	40
budget.per_goal_flow_sessions	15
budget.on_exhausted	pause_and_alert
handoff.stage_timeout_minutes	20.0
handoff.max_retries	2
handoff.max_hops_per_goal	30
notifications.channels	issue_note, email
notifications.notify_on	awaiting_approval, killed, stuck, proven

Settings

Autonomy

lengo.yml

Change

Open a merge request

Every setting in force