# Configuration Reference

The `totem.config.ts` file is the heart of your project's governance.

## Full Schema Overview

```typescript
export default {
  // Core Paths
  totemDir: '.totem', // Directory for local storage, lessons, and cache

  // Vector Database Settings
  embedding: {
    provider: 'gemini', // 'openai', 'gemini', 'ollama'
    model: 'gemini-embedding-2-preview',
  },

  // AI Orchestrator Settings
  orchestrator: {
    provider: 'anthropic', // 'shell', 'openai', 'ollama', 'gemini', 'anthropic'
    defaultModel: 'claude-sonnet-4-6',
    options: {
      temperature: 0.1,
      // Provider-specific options like maxTokens or num_ctx
    },
    overrides: {
      // Route specific commands to different models
      spec: 'anthropic:claude-3-7-sonnet-latest',
    },
  },

  // Command-Specific Options
  compileOptions: {
    concurrency: 4, // Max parallel lesson compilations
    cloudFallback: true, // Whether to fall back to the Totem cloud worker if local compile fails. Local Sonnet 4.6 is the golden path; cloud is still routed to Gemini until #1221 ships.
  },

  // Review configuration. `TotemConfigSchema` reads only the `review` key
  // (a flat `reviewOptions` is not in the schema). All review-related
  // settings live here.
  review: {
    // Stage 4 verification baseline (mmnto-ai/totem#1683)
    stage4Baseline: {
      // Globs added to the default baseline (test/fixture patterns).
      // Files matching these globs are treated as out-of-scope when a
      // compiled rule fires on them — same semantics as the default
      // `**/*.test.*` / `**/__tests__/**` / `**/fixtures/**` set.
      extend: ['**/legacy/**', 'tools/scripts/**'],

      // Globs removed from the default baseline. Use this when your
      // project legitimately treats one of the default baseline paths
      // as production code (e.g. a project where `tests/` ships at
      // runtime).
      exclude: ['**/tests/**'],
    },
  },

  // The `.totemignore` file at the repo root supports a parallel directive
  // syntax: lines of the form `# stage4-baseline: <glob>` are appended to
  // the resolved Stage 4 baseline at compile time. Use this for globs
  // that semantically belong with `.totemignore` content rather than
  // with config (e.g. patterns generated by tooling). Naming: use
  // `baseline`. The schema rejects an `allowlist` key at config-parse
  // time per ADR-091 Deferred Decisions.

  // Tier System (Lite | Standard | Full)
  // Defines the baseline level of strictness and overhead.
  tier: 'Standard',

  // Self-Healing Loop
  shieldAutoLearn: true, // Auto-triggers lesson extraction on FAIL verdicts

  // Targets Configuration
  // Defines how specific files are processed for the knowledge index
  targets: [
    { glob: 'packages/**/*.ts', type: 'code', strategy: 'typescript-ast' },
    { glob: 'README.md', type: 'spec', strategy: 'markdown-heading' },
    { glob: '.totem/lessons/*.md', type: 'lesson', strategy: 'markdown-heading' },
  ],

  // Exporters for IDE/Agent Integration
  exports: {
    junie: '.junie/guidelines.md',
    copilot: '.github/copilot-instructions.md',
  },
};
```

## Secrets Management

Totem uses a local `.totem/secrets.json` file to mask sensitive strings during execution and LLM ingestion. Secrets are **never** committed and are explicitly ignored by `.gitignore`.

You can manage this list using the CLI:

```bash
totem add-secret "sk_live_..."
totem add-secret --pattern "(?i)password[=:]\s*\w+"
```

(See [CLI Reference](cli-reference.md) for details on ReDoS protection for secret patterns).
