Config reference

CE configuration is environment variables plus a single TOML manifest read at boot.

Environment variables

CE manifest schema (ce.toml)

version = 1

[fleet]
id                  = "c1b2-demo"     # ADR-004 format, required
seed_path           = "/path/to/seed" # raw bytes, ≥ 64; required
preset              = "balanced"      # OR explicit chaff_C + threshold_T
# chaff_C           = 16              # override individual fields if needed
# threshold_T       = 33              # width_N override is rejected (CE pins 64)
ratchet_interval_ms = 1000            # accepted but unused in CE first cut
sub_id_range        = [1, 1024]       # half-open [lo, hi); default [1, 1024]
criticality         = "standard"      # CE pins at "standard"
audit_tier          = "result"        # one of {silent, errors, result}

Required fields

• version: must equal 1. Future manifest schema bumps will preserve version = 1 as a long-supported alias.
• [fleet]: exactly one. The CE parser uses a singular [fleet] table; the Enterprise [[fleet]] array form is rejected with a CE-specific error and a #single-fleet pointer.
• fleet.id: 3–32 lowercase ASCII letters/digits/dashes, no leading or trailing dash (ADR-004).
• fleet.seed_path: absolute or relative to the manifest’s directory. Must exist at boot.
• Plasticity: either fleet.preset (one of high-security / balanced / high-resilience) or all three of fleet.width_N, fleet.chaff_C, fleet.threshold_T.

Optional fields

• fleet.ratchet_interval_ms: validated to be ≥ 100 but not consumed in the CE first cut (the ratchet driver is Enterprise-only). Carrying the field through lets you reuse the same manifest under the Enterprise binary unchanged.
• fleet.sub_id_range: [lo, hi). Defaults to [1, 1024). Max hi is SUB_ID_MAX + 1 = 65536.
• fleet.criticality: defaults to "standard". Any other value is rejected — CE doesn’t ship the Tier-2 sliding window or Tier-3 response chain.
• fleet.audit_tier: defaults to "result". "trace" and "merkle" are explicitly rejected with the #audit pointer.

Fields that reject the manifest

• [fleet.swarm] (any content): F-03 is Enterprise.
• [fleet.relay] with role ∈ {peer, anchor}: only edge-only is CE-compatible.
• width_N set to anything other than 64 (whether as a preset override or a standalone field).
• Any unknown field that serde doesn’t accept silently.

Examples

Minimal

version = 1
[fleet]
id        = "demo"
seed_path = "fleet.seed"
preset    = "balanced"

Silent audit, custom sub-ID range

version = 1
[fleet]
id           = "prod-quiet"
seed_path    = "fleet.seed"
preset       = "high-security"
audit_tier   = "silent"
sub_id_range = [1, 8]

Explicit plasticity (override the preset’s defaults)

version = 1
[fleet]
id          = "prod-aggressive"
seed_path   = "fleet.seed"
preset      = "balanced"
threshold_T = 38       # +5 from balanced's 33; tighter margin