Splits a %BaseAgentConfig{} into a serializable, secret-free template (persisted via SessionStore.save_config_template/3) and reconstructs a full config on any node from template + node-local supplement + credential token.

Excluded from the template (resolved node-locally instead): client (built from the token), toolset and before/after_hooks (from the supplement), and mcp_servers (from the supplement; the template records only that it was set, and rebuild/3 raises if the supplement lacks it). current_user_input and resolved_context_window are transient and not kept.

Everything else travels in the template: model and sampling settings, tool limits, prompt, schemas, memory cap, initial_memory, the retry and circuit_breaker options (the breaker itself is the node's shared breaker for that key, BaseAgentConfig.circuit_breaker_key/1), JSON retry settings, guardrails, tool_context, behaviour module refs and hook entries (Normandy.Behaviours.Hooks; their opts must be plain data and hold no secrets). These must be plain data: from_config/2 raises on a function or pid (e.g. a :retry_if fun). tool_context must hold no secrets: the template is stored in plaintext.

Templates saved by Normandy 1.0

rebuild/3 reads templates written by Normandy 1.0.0 and by 2.0. A 1.0 template lacks the fields 2.0 added (they rebuild with their defaults) and differs in three ways, which rebuild/3 translates:

• max_tokens: nil (the agent set none) rebuilds with BaseAgentConfig.default_max_tokens/0;
• behaviours_refs carries session_store and session_registry, slots 1.0 never read; they are dropped;
• a Normandy.Behaviours.Compactor.WindowManager ref pins the window with :max_tokens, which 2.0 calls :context_window. A custom compactor's opts are left as they are.

Any other field, a behaviours_refs slot or a node_local_fields entry that neither version writes, and a missing required field, raise ArgumentError naming it. Templates written by unreleased 2.0 builds are not translated.

Trust boundary

The session store is as trusted as your code. Whoever can write it (a shared Redis, a Postgres role another service uses) decides, on the next rehydrate on any node:

• the policy, budget, compactor and model catalog modules and their opts, the guardrails and the hooks (removing them, or PolicyEngine.AllowAll);
• the credential provider and its opts (Turn.Server calls it to get a token);
• tool_context, so another tenant's memory namespace;
• template_id, so which node-local supplement, and so which toolset, is used;
• the saved server options (on_approval_timeout, the timeouts);
• the turn state, including the input of a call parked for approval, and the conversation history.

Keep the store single-tenant, or give Normandy's role its own database or ACL'd key prefix. Postgres and Redis decode stored bytes with binary_to_term(_, [:safe]), which still builds local functions.

Normandy checks what it can without keys. check_loaded!/1 runs on every template Turn.Server loads, before anything in it is used, and in rebuild/3: it refuses a function, pid, reference or port anywhere in the template, a behaviour ref whose module does not implement its behaviour (policy a Normandy.Behaviours.PolicyEngine, budget a BudgetTracker, credential a CredentialProvider, compactor a Compactor, model_catalog a ModelCatalog) and a guard module that does not implement Normandy.Guardrails.Guard. A supplement's :pinned fixes security settings on the node: with pinned: [policy: ref, guardrails: g, credential: ref] a template whose policy, guardrails or credential differs raises, before the credential provider is called. :pinned takes :policy, :budget, :credential, :compactor, :model_catalog, :hooks and :guardrails; tool_context, template_id, turn state and history cannot be pinned. Templates are not signed (a known limit).