Configuration

Every key in .patcharc/config.yaml, its default, and whether the 0.2.0 CLI reads it.

validated against patcharc 0.2.0 · 2026-08-22

patcharc init writes .patcharc/config.yaml. A missing file is treated as defaults; unknown keys are preserved across saves.

# PatchArc configuration, schema version 1
version: 1

workspace:
  mode: auto            # declared; not read in 0.2.0
  root: ""              # declared; not read

scopes: []              # explicit scopes win over detection
cross_cutting: []       # globs matched before any scope

redact:
  rules:                # empty list = every built-in detector
    - aws_access_key
    - private_key_pem
    - bearer_jwt
    - high_entropy
    - env_file
    - connection_string
  forbidden_paths: []
  email_mask: false
  user_regex: []

share:
  default: private      # validated; `share --visibility` still defaults to public
  expires: 30d          # declared; the server applies 30 days
  no_ai: false          # declared; not read
  public_index: false   # declared; not read

ai:
  default_provider: ""
  providers: []         # see AI summaries and BYOK

limits:
  max_capsule_bytes: 209715200   # 200 MB, enforced at seal
  max_files: 200000              # enforced at seal
  max_diff_bytes: 10485760       # declared; not read
  max_compression_ratio: 1000    # verify uses 1000 regardless
  ignore_binary: true            # declared; not read

Keys

Key	Default	Read in 0.2.0	Meaning
`version`	`1`	yes	Schema version; must be at least 1
`scopes[]`	`[]`	yes	Explicit scopes: `id`, `title`, `kind`, `paths`, `owners`, `depends_on`, `test_targets`
`cross_cutting[]`	`[]`	yes	Globs bucketed as cross-cutting before scope matching
`redact.rules[]`	six ids	written to the capsule	Rule ids to enable; empty enables all. Unknown ids are an error
`redact.forbidden_paths[]`	`[]`	engine only	Globs whose files are replaced wholesale
`redact.email_mask`	`false`	engine only	Mask email addresses
`redact.user_regex[]`	`[]`	engine only	Custom RE2 patterns
`share.default`	`private`	validated	Must be `public`, `private`, `team`, `capability`, or `local`; the `share` command does not read it yet
`ai.providers[]`	`[]`	validated	`name` and `kind` required; `mode` must be `local`
`limits.max_capsule_bytes`	200 MB	yes	Seal refuses larger capsules
`limits.max_files`	200000	yes	Seal refuses more entries

"Engine only" means the redaction engine honours the key, but the engine is not invoked at stop in 0.2.0 (Redaction).

Scope entries

scopes:
  - id: payments          # [a-z0-9_-]+, unique
    title: Payments       # required
    kind: service         # free text; detectors use package|service|module|project
    paths:                # required, at least one glob
      - "services/payments/**"
    owners: ["@payments-team"]
    depends_on: ["shared"]
    test_targets: ["services/payments/..."]

Validation errors

config.yaml is validated on every load. Typical messages:

scopes[2].id "Payments" is invalid (uppercase)
scopes[0].paths must not be empty
ai.providers[0].mode "cloud" not supported in OSS build (only 'local' is permitted)
unknown redaction rule "slack" (the id is slack_token)

Files next to the config

File	Purpose
`keys/arc-signing.ed25519`	Ed25519 private key, hex, 0600
`session.db`	SQLite: sessions, commits, file changes, checkpoints, events
`capsules/`	Sealed `.parc` files
`repo_id`, `worktree_id`	Stable identifiers written by `init`
`observer.pid`, `observer.log`	Detached observer state