Configuration Reference

MemorySmith configuration is rooted under MemorySmith in appsettings and is split across three operator surfaces:

1. Base app settings in MemorySmith.App/appsettings.json.
2. Admin-edited overrides in appsettings.LocalOverrides.json or the file referenced by MemorySmith:SettingsOverridePath.
3. Structured model profile management in /admin on the Models tab.

This page is the operator and agent-oriented map of the configuration groups, where they are edited, and how to verify the running result. It is intentionally grouped for readability rather than an exhaustive per-key table; TSK-0158 tracks a generated inventory/coverage check for every editable admin setting key.

Editing Rules

Configuration Storage Model

• Base defaults live in MemorySmith.App/appsettings.json.
• The admin UI writes edited settings into appsettings.LocalOverrides.json beside the running app unless MemorySmith:SettingsOverridePath points somewhere else.
• Sensitive values are write-only in the admin UI. The app reports Configured or Not configured instead of echoing secrets, and configured secrets are cleared through the explicit Clear secret action rather than a blank replacement field.
• List settings are edited one value per line.
• Nullable integers such as MemorySmith:Chat:OllamaContextWindowTokens accept a blank value to clear the override.

Group Map

Core Paths

Agent note: if behavior looks wrong across multiple routes, check the effective path set first. Path drift is the fastest way to end up testing the wrong wiki.

Security And Remote API

Recommended dogfood default: leave explicit settings in their secure-local posture, or set MemorySmith:SecurityProfile=secure-local when you want the preset recorded in configuration.

Safe default: keep AllowRemoteApi=false unless the instance is intentionally exposed and an API key plus transport/auth posture are already in place. With AllowRemoteApi=true and no API key, guarded non-loopback /api and /mcp requests are blocked until the key is configured. Browser-facing auth/setup routes remain exempt so LAN UI sign-in and first-admin bootstrap can still reach their existing auth/bootstrap checks.

Runtime note: MemorySmith:SecurityProfile=local-dev and ASPNETCORE_ENVIRONMENT=LocalDevelopment are related but not identical. The security profile applies a small preset under any environment; the LocalDevelopment environment also runs MemorySmithLocalDevelopmentPostConfigure, which applies additional dogfood-friendly defaults only when those keys are not already overridden in appsettings.LocalOverrides.json or the configured SettingsOverridePath file.

Representative LocalDevelopment post-configuration defaults when keys are missing:

Operator check: when environment behavior does not match the intended profile, verify both the active ASP.NET Core environment and whether the key is explicitly present in the override file. TSK-0181 tracks the current malformed-override caveat in this path.

Database

Authentication And Providers

Clamp rule: Admin access is not granted by broad anonymous/default-role settings. Admin routes still require an authenticated Admin claim.

Current runtime note: startup currently registers GitHub OAuth at /signin-github. Google and Microsoft credentials can still be stored for future rollout, but /admin marks those providers as unsupported and /login plus /profile do not treat them as active sign-in methods until matching auth handlers and callback routes are registered.

Audit, History, And Pages

Search, Governance, And Maintenance

Current semantic behavior: embeddings are optional. If model assets are missing or unusable, the app falls back to local token scoring and reports provider status.

Source Links

Deny roots take precedence over allow roots and unrestricted mode.

MCP Tools

Existing MCP tools default on unless they are listed in DisabledTools; DisabledTools takes precedence if a tool appears in both lists.

Chat

Important exception: Chat:ModelProfiles, DefaultModelProfileId, and maintenance-agent model assignment IDs are edited from the Models tab, not the generic settings table.

Maintenance Agent

Logging And Telemetry

Telemetry defaults are local-first: telemetry is enabled, exporter is off, sampling is low, and noisy request paths are excluded.

Verification Checklist

1. Check /health for path state, semantic provider status, maintenance state, and runtime configuration clues.
2. Check /api/diagnostics for effective paths, source-link roots, telemetry config visibility, configured URLs, and warnings.
3. Check /chat, /maintenance, /proposals, /tags, /tasks, and /variables when the suspected drift is feature-specific.
4. Inspect appsettings.LocalOverrides.json or the configured override file when UI behavior and expected values disagree.
5. If LocalDevelopment behavior looks unexpectedly permissive, validate that the override file parses cleanly. Current known risk TSK-0181 tracks malformed or unreadable override files being treated like missing overrides during LocalDevelopment post-configuration.

Agent Assistance Notes

• Start with runtime verification, not only file inspection. MemorySmith reloads config after admin saves, so /api/diagnostics is often the fastest truth surface.
• Treat AllowRemoteApi=true with no API key as a blocked remote-readiness state, not just a warning.
• Remember that model profiles and generic settings are intentionally split.
• When a setting looks missing from /admin, check whether it is intentionally file-managed rather than assuming the docs are stale.

Related Pages

• System Setup Guide
• Search and Chat
• Operations
• Agent and Model Configuration
• Wiki Health and Validation