# OpenVibe.Codes — environment (production: /etc/openvibe/codes.env). Names only; never commit values.

NODE_ENV=production
PORT=4900
HOST=127.0.0.1
BASE_URL=https://openvibe.codes
TRUST_PROXY=2
# PostgreSQL (ADR-035), written by OpenVibe.Host roles/data/add-service.sh codes: the runtime role through PgBouncer,
# the owner on a direct connection (migrations), and Valkey (shared limit counters).
# Without DATABASE_URL, development uses an embedded PGlite database in data/pglite.
DATABASE_URL=
DATABASE_DIRECT_URL=
VALKEY_URL=
VALKEY_PREFIX=
# Per-actor limits (server/http/actor-limits.js): reads one caller (a person, else an address) may make to the
# API per minute and per hour; past them 429 rate_limited with Retry-After. The router has its own number
# (README). The per-address limits stay.
#CODES_LIMITS_MINUTE=120
#CODES_LIMITS_HOUR=3000

# OpenVibe.Network: SSO (OAuth client `codes`, PKCE S256) and its JWKS.
OV_NETWORK_URL=https://openvibe.network
OV_NETWORK_INTERNAL_URL=http://127.0.0.1:4000
# OV_NETWORK_ISSUER=https://openvibe.network        # defaults to OV_NETWORK_URL
OV_OAUTH_CLIENT_ID=codes
OV_OAUTH_CLIENT_SECRET=
# OV_OAUTH_REDIRECT_URI=https://openvibe.codes/auth/callback
# OV_SESSION_AUDIENCE=openvibe.network                # audience a Network session token must carry to be a Codes session

# optional: defaults to true in production
# COOKIE_SECURE=true

# OpenVibe.Events (AL5): Codes subscribes to run.job.* and, when PR follows are on, github.* at boot, and reads
# the signed deliveries at POST /internal/events (CODES_EVENTS_SECRET verifies them; 32 characters or more,
# comma-separated while rotating). Codes publishes codes.task.* here.
#CODES_EVENTS_URL=https://openvibe.events
#CODES_EVENTS_SECRET=
# A ticket follows its pull request (AL5), off by default: with 1, a finished task that pushed a PR is bound to it
# and a red check, a merge conflict or a review comment wakes a follow-up on the PR branch (at most 3 automatic
# fixes per PR; a person's "stop" ends it; the worker never merges). Also requires the Events secret above.
#CODES_PR_FOLLOW_ENABLED=0

# OpenVibe.AI (Codes C3). CODES_AI_URL is what a harness on a person's machine calls; without a values file it is
# https://ai.openvibe.services.
#CODES_AI_URL=https://ai.openvibe.services
# AI Exchange P9: read OpenVibe.AI's real model catalog (GET /v1/models) into the pickers, behind this flag (off by
# default). AI's own AI_MODEL_CATALOG must be on for the answer to be more than the legacy `openvibe` model; with
# either off, the pickers are exactly as before. The answer is cached five minutes.
#CODES_AI_CATALOG=0
#CODES_AI_CATALOG_TTL_MS=300000
# Model plans: saved account/project choices, repository models: config and per-task roles use AI routing.
# Leave off until the Contracts and SDK model-plan releases are pinned.
#CODES_MODEL_PLANS=0

# OpenVibe.Exchange's compatible API: the deepseek harness's default path (a run token names the person; the same
# chat-completions API and model ids as OpenVibe.AI). CODES_EXCHANGE_URL overrides https://api.openvibe.exchange.
#CODES_EXCHANGE_URL=https://api.openvibe.exchange
# Hosted CLI runs use Exchange by default with their task-scoped run token. Set CODES_CLI_EXCHANGE=0 to roll back to AI.
#CODES_CLI_EXCHANGE=1

# Goals and the independent verifier (AL1), off by default. With CODES_GOALS_ENABLED=1 a task may carry a goal and a
# typed check; the harness runs the check in the task's workspace and a cheap fast model on OpenVibe.AI accepts or
# rejects with a reason. CODES_GOALS_MODEL names that rung (default deepseek-chat).
#CODES_GOALS_ENABLED=0
#CODES_GOALS_MODEL=deepseek-chat
#CODES_GOALS_TIMEOUT_MS=120000

# Know (the shared lessons store): on a Node, the portal's know/lessons.js. Its path is configuration, never a
# hard-coded home; without it a job gets no lessons. Never a secret.
#CODES_KNOW_LESSONS=/home/openvibe/agents/know/lessons.js

# Chat plays sandbox workers (Agent Streams S6): the secret a worker signs its heartbeat with
# (POST /internal/sandbox-workers/heartbeat), a comma list during a rotation, and how long a worker that stopped
# checking in still counts. Without a secret no worker can check in and /internal/sandbox-workers/health says not ready.
# The worker's own settings (CODES_SANDBOX_* on its host) are in deploy/sandbox/sandbox-worker.env.example.
#CODES_SANDBOX_WORKER_SECRET=
#CODES_SANDBOX_STALE_MS=90000