.env.template

# Copy to .env and fill in. NEVER commit .env.

# LLM — fill either Anthropic or OpenAI. Base URLs are optional proxy overrides.
LLM_PROVIDER=auto
ANTHROPIC_API_KEY=
ANTHROPIC_BASE_URL=
OPENAI_API_KEY=
OPENAI_BASE_URL=
AGENT_MODEL=claude-sonnet-5
OPENAI_MODEL=gpt-5.6
REVIEWER_MODEL=
INTENT_MODEL=
# Dual-path (双路径) model tiers for agent reasoning. The run's tier is chosen
# from intent — eco by default, performance only when the user explicitly asks
# for the high-performance model (or --performance).
#
# Each tier is EITHER fully unset (eco inherits AGENT_MODEL on the shared
# backend; performance requests then FAIL UPFRONT — never a silent fallback),
# OR model-only (a different model on the selected shared backend), OR
# model+base_url+api_key all three (an independent backend). Partial URL/key
# combos are startup errors. Every response's served model is checked against
# the request (MODEL_MISMATCH_POLICY=fail by default — endpoints that silently
# map foreign model names, e.g. claude-* on api.deepseek.com, kill the run
# with an exact message instead of mislabeling it). Verify with:
#   ./infermatrix-copilot doctor --probe
ECO_MODEL=
ECO_BASE_URL=
ECO_API_KEY=
PERFORMANCE_MODEL=
PERFORMANCE_BASE_URL=
PERFORMANCE_API_KEY=
# MODEL_MISMATCH_POLICY=warn   # explicit opt-down: accept substitutions loudly
# MODEL_ALIASES='{"requested-name": "served-name"}'  # audited equivalences only
CLAUDE_CODE_ATTREBUTION_HEADER=0

# Strict execution backend (doc/RFC-provider-registry.md). REQUIRED for Strict
# runs — they refuse to start while this is unset (CLI runs default to api).
#   api         = the raw-API keys above
#   cursor      = Cursor subscription via the cursor-agent CLI (no API key;
#                 the CLI must be installed and logged in)
#   claude-code = Claude subscription/API via the claude CLI (M2, shipped)
#   codex       = ChatGPT subscription via the codex CLI (M3; needs a login)
STRICT_BACKEND=api
# STRICT_BACKEND_MODEL=          # model id inside the harness (optional)
# STRICT_BACKEND_CONCURRENCY=2   # concurrent harness sessions
# STRICT_BACKEND_CLI=            # binary path override (else PATH lookup)
# STRICT_BACKEND_TIMEOUT_S=1800  # per-session wall-clock ceiling

# --- Review model routing (measured on the wave-4/5 gates; see
# --- eval/dataset/results/model_comparison.md before changing these) -------
# Cheap seats: the planner's gray-zone call and the tool-less coverage/
# residue promotion do not carry the precision result, so a cheap model is
# the right default. NOTE a reasoning model needs headroom — the planner
# silently failed for two campaigns at a 400-token ceiling because thinking
# consumed it before any JSON appeared.
# REVIEW_PLANNER_MODEL=deepseek-v4-flash
# REVIEW_PROMOTION_MODEL=deepseek-v4-flash
#
# Per-pass backends: map a review pass to "provider:model" to run that seat
# on a different engine. Measured configurations (same gate, same judge):
#   (unset)  — all-DS "v15": the precision-leaning config, ~$1/item.
#   adversary+round2 on claude-code — "v16": the recall-leaning config; the
#     only one that reproduced the GOLD latent-gap catch inside the pipeline.
#     Costs 2 harness sessions/item on top of the DS core.
#   investigator/docs/round2 on cursor — subscription-priced breadth; it
#     measured WORSE precision and no recall gain. Not recommended.
# REVIEW_LENS_BACKENDS={"adversary": "claude-code:claude-fable-5", "round2": "claude-code:claude-fable-5"}

# Repos: JSON map of repo name -> local path (machine-specific; .env is gitignored,
# which is why absolute paths belong HERE and never in a committed file).
REPO_PATHS={"vllm-omni": "/path/to/vllm-omni", "afd-plugin": "/path/to/afd-plugin"}
DEFAULT_REPO=vllm-omni

# alias -> "owner/repo" GitHub identity, used to route pasted GitHub URLs to a
# configured repo. Optional when the checkout's origin remote already points at
# that owner/repo; without either, URL commands cannot route to the alias
# (`doctor` warns about this).
REPO_FULL_NAMES={"vllm-omni": "vllm-project/vllm-omni", "afd-plugin": "vllm-project/afd-plugin"}

# MCP defaults to DEFAULT_REPO only. Add afd-plugin explicitly when this server
# should expose its read-only knowledge/review workflows.
MCP_REPO_ALLOWLIST=["vllm-omni", "afd-plugin"]

# Fallback used by adapters/<repo>/manifest.yaml when no .env is in reach; the
# manifest references these as ${VLLM_OMNI_REPO} / ${VLLM_UPSTREAM_REPO} /
# ${AFD_PLUGIN_REPO} so the
# committed manifest stays portable. REPO_PATHS above takes precedence.
VLLM_OMNI_REPO=/path/to/vllm-omni
VLLM_UPSTREAM_REPO=/path/to/vllm
VLLM_OMNI_VENV=/path/to/vllm-omni-venv
AFD_PLUGIN_REPO=/path/to/afd-plugin

# Push safety: pushes are dry-run unless this is 1
ALLOW_PUSH=0

# Optional learning/feedback is OFF until a named human accepts the actual
# agreement in a TTY: infermatrix-copilot learning agreement show / accept.
# No environment setting, agent, MCP or SDK action signs it for the person.
# Extra host-model tokens/time/quota and sensitive selected evidence are disclosed.
# Local is the default publication mode. Use a dedicated writable checkout, never the
# installed package or the task's source checkout. Paths stay machine-local.
KNOWLEDGE_LEARNING_STATE_DIR=
KNOWLEDGE_LEARNING_WORKSPACE=
KNOWLEDGE_LEARNING_REPOSITORY=JiusiServe/InferMatrixCopilot
KNOWLEDGE_LEARNING_BASE=main
KNOWLEDGE_LEARNING_PUBLICATION=local
# draft_pr additionally needs current human agreement and both write gates:
# KNOWLEDGE_LEARNING_PUBLICATION=draft_pr
# ALLOW_PUSH=1
ALLOW_POST=0

# Optional team knowledge-quality collection. Configuration alone is not consent:
# selected metadata/reasons/evidence upload only after current human agreement.
# Use HTTPS outside loopback; token comes from the service operator, >=32 chars.
# Changed terms/publication/collector destinations require renewed acknowledgement.
# Revoke with: infermatrix-copilot learning agreement revoke
# Revocation gates future operations; it does not erase prior data or stop all inflight work.
KNOWLEDGE_FEEDBACK_URL=
KNOWLEDGE_FEEDBACK_TOKEN=
KNOWLEDGE_FEEDBACK_TIMEOUT_SECONDS=5
# Collector process only (separate environment from provider clients):
KNOWLEDGE_FEEDBACK_SERVER_TOKEN=
KNOWLEDGE_FEEDBACK_SERVER_STATE_DIR=

# repo-rebase-v3 remote CI (rebase_mode=remote_ci/full): pushes authenticate
# with GITHUB_TOKEN (header auth; no credential helper is consulted) and the
# Buildkite provider client needs BUILDKITE_API_TOKEN (write_builds scope).
# REBASE_CI_TIMEOUT_SEC bounds the per-build monitor (default 10800 = 3h;
# raise it when the pipeline's agent queue is slow).
GITHUB_TOKEN=
BUILDKITE_API_TOKEN=
# REBASE_CI_TIMEOUT_SEC=18000

# Parent-agent knowledge stores (read-only compat layers; optional)
# REBASE_AGENT_ROOT=/path/to/vllm-omni-rebase-agent

# Escalation email (optional; Resend first, SMTP fallback)
NOTIFY_EMAIL=
RESEND_API_KEY=
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASSWORD=

# (empty -> single-shot reviewer fallback). Requires the claude CLI.

# Mixture-of-Agents (optional, design W6). JSON, SINGLE-QUOTED. Members need a
# MODEL_PRICES-known model; api_key_env NAMES an env var (preferred over raw
# api_key). MoA runs on full-depth PR reviews / performance-mode issue answers
# (MOA_WHEN=off|full|performance|always), capped by MOA_MAX_USD per run.
# LLM_MIXTURE='{"members": [{"model": "deepseek-chat"}, {"model": "claude-sonnet-5", "api_key_env": "MOA_KEY_B"}]}'