Sweep src/ for hardcoded literals that should migrate to operational_config.yaml (ADR-040)

[DariuszNewecki]

ADR-040's principle — every runtime-behavior knob out of src/ literals and into .intent/enforcement/config/operational_config.yaml, read via IntentRepository — is a direction, not a finished state. T2.3 (66cf731) found split_confidence_threshold living outside it (in governance_paths.yaml, read raw); more literals surely remain in src/. Run a verification sweep for magic numbers / hardcoded thresholds that should become governed knobs, and migrate them. Origin: external-review session, governor's founding config-out-of-code idea.

[DariuszNewecki]

Ran a recon sweep (Explore agent) across `src/body`, `src/will`, `src/mind`, `src/api`, `src/cli`, `src/shared` for real ADR-040 violations not already covered by `operational_config.yaml` (481 lines, 41 sections — already comprehensive). Full findings: 28 real candidates (14 Tier-1 high-confidence, 14 Tier-2 lower-priority), 13 checked and correctly ruled out (rule-mapping fallbacks, constitutional thresholds requiring a proposal to change, dead code, env-var layer — documented so a future pass doesn't re-litigate them), plus 3 notable secondary bugs the sweep caught incidentally.

Fixed this pass (6 commits, `9e4ded9b..2b93b82`)

• `health_log_service.py` — `_CONVERGENCE_ROLLING_WINDOW` moved to `health_log.convergence_rolling_window` (was declared right next to the file's own `_CFG = load_operational_config()...`, just never moved in).
• `daemon.py` — `_STARTUP_JITTER_CAP_SEC` moved to `daemon.startup_jitter_cap_sec`, same pattern.
• `daemon_runner.py` — `_SYSTEMCTL_TIMEOUT_SECONDS` was worse than unwired: it was dead, never applied anywhere (`run_command_async` has no native timeout param, and nothing wrapped the call). `systemctl --user start|stop core-daemon` had zero timeout protection — a hang would have blocked forever. Now wired to `daemon.systemctl_timeout_sec` via `asyncio.wait_for`, matching the pattern already used in `ceremony.py`. 6 new tests, including one proving a mocked never-returning subprocess is now actually bounded.
• `ceremony.py` — `workers.violation_remediator.ceremony_timeout_sec` existed in both the YAML and the loader dataclass but was never read anywhere; the hardcoded `timeout=30` numerically matched it by coincidence. Now actually wired.
• `check_commands.py` + `gaps_analyzer.py` — this was a real bug, not just cleanliness: both duplicated `coverage.{gap_threshold_pct,low_bucket_pct,warn_pct}` as local constants, and one had drifted — `check_commands.py`'s `_WARN_PCT_DEFAULT = 80.0` vs. the governed `warn_pct: 75`. Three different values for one knob. Both now read from config; 6 new tests including one that explicitly pins `warn_pct != 80.0`.

22 new/updated tests total, all passing via scoped `pytest`. Two pre-existing tests (`test_daemon_startup_jitter.py`, `test_health_log_service__convergence_artifact.py`) imported the removed constants directly and needed a one-line source change to keep passing.

Not addressed — still open

Remaining Tier 1 (9): LLM retry backoff (`shared/infrastructure/llm/client.py`), `sameconcern.py`/`r1_scoped.py` duplicated+unwired cosine thresholds, `runtime_gate.py`'s hardcoded `LIMIT 2000` (referenced by name in the YAML's own comments but never actually put there), `var_tmp_janitor.py`/`canary_janitor.py` (both explicitly commented "governor-tunable dial," neither wired), `internal_corpus.py` chunk-size duplication/drift risk, `log_actions.py` partition retention, `enrichment_service.py`'s `LIMIT 200`, `crawl_service/orchestrator.py`'s self-acknowledged "Hard-coded for v1" cluster.

Tier 2 (14): scattered CLI timeouts (`api/cli/*`, 7 duplicate `timeout=300.0` call sites), an unwired "3 retries" pattern duplicated across 7 `self_healing` files, various `LIMIT N` SQL literals, subprocess timeouts, sampling bounds.

Secondary findings not yet acted on:

1. `sameconcern.py`/`r1_scoped.py` duplicate the exact same three threshold constants verbatim across two files — a DRY problem independent of the governance question.
2. The CLI layer (`api/cli/`, `cli/commands/inspect/refusals.py`) was deliberately cut off from `shared.infrastructure.intent.operational_config` to avoid a layering violation (the `core-cli` PyPI package can't depend on `core-runtime`'s `shared.`). Fixing those needs a CLI-reachable config path, not just "move the literal into the existing YAML" — a design question, not a quick patch.

Leaving this open — today's pass took the highest-confidence, lowest-risk items (including a real bug fix and a real dead-timeout fix), not the full sweep.

[DariuszNewecki]

Progress + remaining candidates (session 2026-07-14)

Migrated this pass (clean literal → operational_config.yaml → governed alias + guard test)

• cbeb151b — janitor retention rails (var_tmp_janitor, canary_janitor) → workers.{var_tmp_janitor,canary_janitor}
• 4f441962 — log_actions.py partition policy (ADR-052) → new log_maintenance section
• e9006ff9 — enrich-symbols batch cap → misc.enrichment_symbols_batch_limit (bound as SQL param)
• (earlier this issue: 2b93b82e coverage drift, plus health_log, daemon ×2, ceremony dead key)

Remaining candidates — deliberately not auto-migrated (each carries a judgment call, not a mechanical move)

These are documented rather than swept because ADR-040 is about governing operational knobs, and each of these first needs a decision that a literal→YAML transcription would silently bake in:

File	Literal(s)	Why it's not a clean sweep
src/body/services/internal_corpus.py	chunk sizes	Dedup, not migration — 2 of 3 constants duplicate the existing embedding.chunk_size/chunk_overlap knobs; correct fix points them at the existing config. Only _MAX_CHUNK_CHARS is genuinely new.
src/mind/.../sameconcern.py + r1_scoped.py	cosine thresholds	DRY + semantic — same threshold literal duplicated across two files. Migrating means choosing one governed key and deciding whether the two thresholds are meant to be identical.
src/body/services/crawl_service/orchestrator.py	7-constant cluster	Constants are explicitly commented "hard-coded for v1" — may be intentional deferral. Needs a read to distinguish debt from scoping before governing.
src/mind/.../runtime_gate.py	LIMIT 2000 + interval multipliers	Mind layer — reads config via IntentRepository (OK), but Mind pulling operational values wants a look against the no_execution_semantics boundary first.
src/shared/.../client.py (LLM)	backoff [1.0, 2.0, 4.0]	List-typed knob — the generic loader handles scalars/tuples; a retry schedule needs the tuple path or a small rethink.

CLI-layer literals — out of scope for this issue

src/cli/**, refusals.py etc. can't import shared.* config without crossing the layering boundary; not ADR-040 targets.

Suggest keeping #774 open for the five judgment-laden items above, or splitting them into follow-ups if you'd rather close the mechanical sweep.