config.example.yaml

# vcon-vac-adapter configuration
# All ${ENV_VAR} placeholders are substituted at startup.

adapter:
  name: vac
  # One of: claude_code | anthropic | openai_responses | openai_agents
  source_platform: claude_code

# Source platform configuration
source:
  # Claude Code: daemon mode watches this directory of session .jsonl files.
  # REQUIRED (no default) for the daemon watcher to run at all -- it never
  # falls back to the real ~/.claude/projects. Point it at the directory you
  # actually want watched, e.g. via an env var:
  claude_code:
    watch_dir: ${VAC_ADAPTER_WATCH_DIR}
  # Anthropic / OpenAI Responses: directory of {request, response} JSON pairs
  anthropic:
    logs_dir: /var/log/agent/anthropic
  openai_responses:
    logs_dir: /var/log/agent/openai
  # OpenAI Agents SDK: live trace processor (set live=true and import the
  # processor module in your agent process)
  openai_agents:
    live: false

# vCon construction
vcon:
  syntax: "0.4.0"
  # Extensions this adapter always emits
  extensions:
    - agent_session
  # VAC record encoding
  vac_encoding: json          # json | cbor
  # Trace granularity: one per session (default) or one per tool call
  granularity: session        # session | per_tool_call
  # Add "agent_session" to vCon critical[] if downstream MUST honor it
  critical_agent_session: false
  # Whether to attempt a lawful_basis attachment at all. Even when true, no
  # attachment is written unless LAWFUL_BASIS (or lawful_basis.lawful_basis
  # below) is actually set -- never defaulted.
  include_lawful_basis: true
  # Optional: driven by LAWFUL_BASIS* env vars, this block, or both (env
  # wins per-field). Leave unset entirely to build vCons with no
  # lawful_basis attachment.
  # lawful_basis:
  #   lawful_basis: consent   # consent | contract | legal_obligation |
  #                           # vital_interests | public_task | legitimate_interests
  #   purposes: [recording]
  #   jurisdiction: US-MA
  # Optional: JWS signing
  signing:
    enabled: false
    private_key_path: ${VCON_SIGNING_KEY_PATH}
    key_id: ${VCON_SIGNING_KEY_ID}

# Delivery: pick webhook (generic, HMAC-signed, fans out to N endpoints) or
# conserver (POST directly to a vcon-server /vcon endpoint).
delivery:
  mode: webhook   # webhook | conserver

# Webhook delivery (delivery.mode: webhook)
webhook:
  endpoints:
    - url: ${VCON_WEBHOOK_URL}
      hmac_secret: ${VCON_WEBHOOK_HMAC_SECRET}
      timeout_seconds: 30
  retry:
    max_attempts: 5
    initial_backoff_seconds: 1
    max_backoff_seconds: 60
  dead_letter_path: /app/vcons/dlq

# Conserver-direct delivery (delivery.mode: conserver); shares webhook.retry
# and webhook.dead_letter_path above.
conserver:
  base_url: ${CONSERVER_BASE_URL}
  token: ${CONSERVER_API_TOKEN}
  token_header: x-conserver-api-token
  ingress_lists: []
  timeout_seconds: 30

# Local filesystem storage (optional)
storage:
  enabled: true
  path: /app/vcons
  filename_pattern: "{uuid}.vcon.json"

# Observability
server:
  host: 0.0.0.0
  port: 8000

logging:
  level: INFO
  format: json