version: 1
policy:
  default_mode: dry_run
  require_explicit_root: true
  allow_external_uploads: false
  allow_mutations: false
  log_raw_text: false
  include_full_paths_default: false
  npu_proof_path: /sys/class/accel/accel0/device/npu_busy_time_us

# Copy to config/triage-roots.local.yaml and approve exactly one narrow,
# lane-specific staging root. The committed template is intentionally
# unapproved/fail-closed; do not point any lane at broad home, Downloads,
# vault, screenshot, photo-library, or historical audio roots without explicit
# approval for that exact lane/root.
roots:
  screenshots:
    approved: false
    root: null
    allowed_extensions: [.png, .jpg, .jpeg, .webp, .heic]
    max_files: 50
    max_file_mb: 25
  receipts:
    approved: false
    root: null
    allowed_extensions: [.png, .jpg, .jpeg, .pdf, .webp]
    max_files: 50
    max_file_mb: 25
  downloads:
    approved: false
    root: null
    allowed_extensions: [.pdf, .png, .jpg, .jpeg, .webp]
    max_files: 50
    max_file_mb: 25
  obsidian_attachments:
    approved: false
    root: null
    allowed_extensions: [.pdf, .png, .jpg, .jpeg, .webp, .mp3, .m4a, .wav, .ogg]
    max_files: 50
    max_file_mb: 50
  voice_memos:
    approved: false
    root: null
    allowed_extensions: [.mp3, .m4a, .wav, .ogg, .opus]
    max_files: 25
    max_file_mb: 100
  meeting_snippets:
    approved: false
    root: null
    allowed_extensions: [.mp3, .m4a, .wav, .ogg, .opus]
    max_files: 25
    max_file_mb: 200