Configuration

Surfil is designed to need almost no configuration - install detects your agents and wires sensible defaults. This page covers what is configurable, where credentials live, and what is deliberately not a setting.

Credentials

There is no API key to place in a config file. Authentication is the Ed25519 device token issued by surfil login, stored in the OS keychain - not in a dotfile, not in an environment variable. This is a security property, not a preference.

What you can configure

• Guard mode - simulate or enforce, plus per-rule toggles and sandbox scope. See enforce a policy.
• Cap tuning - context-pruning aggressiveness and model routing. Prefix-cache preservation is locked on and cannot be disabled - it protects the provider cache.
• Mind rules - never-remember patterns that are dropped before any write.

What is deliberately not configurable

• The pipeline stage order (security → cost → quality → observability → memory) is an invariant - a reordered pipeline could let an unsafe call past Guard.
• Byte-exact interception. Passthrough preserving provider prefix hashes is enforced, not optional.
• Zero-trace. Source never leaves the device; there is no "send source" setting to turn on.