Source: docs/manual/config-env.md

This page is generated by site/scripts/sync-manual-docs.mjs.

Configuration and Environment

All Cruvero configuration is via environment variables with a CRUVERO_* prefix. There are no configuration files. Variables are loaded at startup by internal/config/config.go and can be set in .env files for local development.

This reference is organized by subsystem. For phase-specific rollout guides, see the sections below the core reference.

Source: internal/config/config.go, .env.example, charts/cruvero/values.yaml, cmd/ui/main.go, internal/auth/provider.go

Core Environment Variables

Temporal

• CRUVERO_TEMPORAL_ADDRESS (default temporal-grpc.dev.gchinfo.com:443)
• CRUVERO_TEMPORAL_NAMESPACE (default default)
• CRUVERO_TEMPORAL_TLS (auto or false)

Database

• CRUVERO_POSTGRES_URL
• CRUVERO_DRAGONFLY_ADDR
• CRUVERO_DRAGONFLY_POOL_SIZE (default 50)
• CRUVERO_DRAGONFLY_MIN_IDLE_CONNS (default 5)
• CRUVERO_DRAGONFLY_DIAL_TIMEOUT (default 5s)
• CRUVERO_DRAGONFLY_READ_TIMEOUT (default 3s)
• CRUVERO_DRAGONFLY_WRITE_TIMEOUT (default 3s)
• CRUVERO_DB_MAX_OPEN_CONNS (default 25)
• CRUVERO_DB_MAX_IDLE_CONNS (default 10)
• CRUVERO_DB_CONN_MAX_LIFETIME (default 5m)
• CRUVERO_DB_CONN_MAX_IDLE_TIME (default 1m)

Events and NATS

• CRUVERO_EVENTS_BACKEND (nats, log, or none; default nats)
• CRUVERO_EVENTS_SUBJECT_PREFIX (default cruvero)
• CRUVERO_EVENTS_TENANT_ISOLATION (default false; recommend true for noisy multi-tenant production environments)
• CRUVERO_NATS_URL (default nats://localhost:4222)
• CRUVERO_NATS_CLUSTER_ID (default cruvero)
• CRUVERO_NATS_CREDS_FILE (optional)
• CRUVERO_NATS_TLS (auto or false; default auto)
• CRUVERO_NATS_CONNECT_TIMEOUT (default 5s)
• CRUVERO_NATS_RECONNECT_WAIT (default 2s)
• CRUVERO_NATS_MAX_RECONNECTS (default -1; infinite reconnect)
• CRUVERO_NATS_STREAM_REPLICAS (default 1; use 3 for HA production clusters)
• CRUVERO_NATS_SUBSCRIBER_BUFFER (default 256)
• CRUVERO_NATS_CIRCUIT_ENABLED (default true)
• CRUVERO_NATS_CIRCUIT_FAILURE_THRESHOLD (default 8)
• CRUVERO_NATS_CIRCUIT_COOLDOWN (default 5s)
• CRUVERO_NATS_CONSUMER_MAX_DELIVER (default 5; dead-letter cutoff for JetStream consumers)

LLM Providers

• CRUVERO_LLM_PROVIDER (openrouter, azure, openai, or google)
• CRUVERO_LLM_TIMEOUT (default 60s)
• CRUVERO_LLM_FAILOVER_CHAIN (comma-separated provider order, e.g. openrouter,google,openai,azure)
• CRUVERO_LLM_FAILOVER_THRESHOLD (default 3)
• CRUVERO_LLM_FAILOVER_RECOVERY_INTERVAL (default 5m)
• CRUVERO_LLM_FAILOVER_LATENCY_THRESHOLD (default 0s, disabled)
• CRUVERO_OPENROUTER_API_KEY
• CRUVERO_OPENROUTER_MODEL
• CRUVERO_AZURE_OPENAI_ENDPOINT
• CRUVERO_AZURE_OPENAI_API_KEY
• CRUVERO_AZURE_OPENAI_API_VERSION
• CRUVERO_AZURE_OPENAI_DEPLOYMENT
• CRUVERO_OPENAI_CHAT_API_KEY
• CRUVERO_OPENAI_API_KEY (non-chat OpenAI key; also used by embedding provider flows)
• CRUVERO_OPENAI_CHAT_MODEL (default gpt-4.1)
• CRUVERO_OPENAI_CHAT_BASE_URL (default https://api.openai.com/v1)
• CRUVERO_OPENAI_EMBEDDING_BASE_URL (optional override for embedding endpoint base URL)
• CRUVERO_ANTHROPIC_API_KEY
• CRUVERO_ANTHROPIC_MODEL
• CRUVERO_ANTHROPIC_VERSION
• CRUVERO_ANTHROPIC_MAX_TOKENS
• CRUVERO_GOOGLE_API_KEY (used by embeddings and direct Gemini chat provider)
• CRUVERO_GOOGLE_MODEL (default gemini-2.5-flash)
• CRUVERO_GOOGLE_BASE_URL (default https://generativelanguage.googleapis.com/v1beta)
• CRUVERO_GOOGLE_PROJECT_ID (optional, for provider-specific project scoping)
• CRUVERO_GOOGLE_LOCATION (optional, for provider-specific location scoping)
• CRUVERO_GOOGLE_MAX_TOKENS (default 8192)
• CRUVERO_OLLAMA_BASE_URL (optional local/provider-compatible endpoint for Ollama-backed setups)
• CRUVERO_AZURE_PRICING_JSON (optional, for models-refresh --source azure)
• CRUVERO_AZURE_CONTEXT_JSON (optional, for models-refresh --source azure)

Agent Runtime

• CRUVERO_METACOGNITIVE_ENABLED (default false)
• CRUVERO_METACOGNITIVE_CHECK_INTERVAL (default 3)
• CRUVERO_METACOGNITIVE_MAX_REPETITION (default 3)
• CRUVERO_METACOGNITIVE_ESCALATION_MODEL (optional escalation model id)
• CRUVERO_TEMPORAL_REASONING_ENABLED (default false)
• CRUVERO_DEFAULT_FAST_MODEL (optional fast model id for deadline pressure)
• CRUVERO_DEADLINE_ACTION (escalate or halt; default escalate)
• CRUVERO_PROVENANCE_ENABLED (default false; enable execution provenance DAG persistence/query)
• CRUVERO_PROMPT_QUALITY_ENABLED (default true; enable low-context LLM prompt quality scoring)
• CRUVERO_PROMPT_QUALITY_TIMEOUT (default 2s; timeout per prompt quality evaluation call)
• CRUVERO_PROMPT_QUALITY_MAX_INPUT_BYTES (default 2048; max evaluator payload bytes)
• CRUVERO_PROMPT_QUALITY_MODEL (optional; overrides evaluator model, defaults to decision model)

Memory

• CRUVERO_MEMORY_EPISODIC_STORE (postgres or redis)
• CRUVERO_MEMORY_REDIS_TTL
• CRUVERO_SALIENCE_ENABLED (default true)
• CRUVERO_MEMORY_SALIENCE_RELEVANCE (default 0.4)
• CRUVERO_MEMORY_SALIENCE_RECENCY (default 0.3)
• CRUVERO_MEMORY_SALIENCE_CONFIDENCE (default 0.2)
• CRUVERO_MEMORY_SALIENCE_USAGE (default 0.1)
• CRUVERO_MEMORY_SALIENCE_FRESHNESS (default 0.0)
• CRUVERO_MEMORY_SALIENCE_HALFLIFE (default 24h)
• CRUVERO_CONTEXT_BUDGET_ENABLED (default false)
• CRUVERO_CONTEXT_BUDGET_TOKENS (default 8000)
• CRUVERO_CONTEXT_SYSTEM_TOKENS (default 1000)
• CRUVERO_EMBEDDING_FAILURE_MODE (fail, warn, or hash; default fail)
• CRUVERO_EMBEDDING_PROVIDER (openai, google, mock; deployment default commonly openai)
• CRUVERO_EMBEDDING_MODEL (deployment default commonly text-embedding-3-small)
• CRUVERO_EMBEDDING_DIMENSIONS (optional explicit embedding dimension override)
• CRUVERO_EMBEDDING_TIMEOUT (provider call timeout)
• CRUVERO_EMBEDDING_BATCH_SIZE (provider batch sizing hint)
• CRUVERO_EMBEDDING_MAX_RETRIES (provider retry cap)
• CRUVERO_EMBEDDING_CACHE_ENABLED (default true)
• CRUVERO_EMBEDDING_CACHE_TTL (default 720h)
• CRUVERO_EMBEDDING_CACHE_EPOCH (default empty; bump to invalidate stale embedding cache keys)
• CRUVERO_EMBED_MODE (direct, sync, or async; default direct)
• CRUVERO_EMBED_BATCH_SIZE (JetStream consumer batch size for embed-worker)
• CRUVERO_EMBED_FLUSH_MS (batch flush interval in milliseconds)
• CRUVERO_EMBED_DLQ_MAX_RETRIES (dead-letter cutoff for embedding jobs)
• CRUVERO_EMBED_WORKER_CONCURRENCY (parallel embed worker execution units)
• CRUVERO_EMBED_RECONCILE_ENABLED (default true; embed-worker pending-fact reconciler loop)
• CRUVERO_EMBED_RECONCILE_INTERVAL (default 30s; cadence for pending-fact reconciliation passes)
• CRUVERO_EMBED_RECONCILE_BATCH_SIZE (default 64; pending rows processed per worker pass)
• CRUVERO_EMBED_RECONCILE_MAX_ATTEMPTS (default 5; terminally mark as failed after this many attempts)
• CRUVERO_EMBED_RECONCILE_WORKERS (default 1; parallel reconciliation workers per pass)
• CRUVERO_EMBED_RECONCILE_STALE_AFTER (default 10m; backlog age threshold for stale warning metric/logs)
• CRUVERO_EMBED_SYNC_TIMEOUT (default 10s; sync-mode wait before falling back)
• CRUVERO_VECTOR_STORE (pgvector, qdrant, or composite; default pgvector)
• CRUVERO_QDRANT_URL (default http://localhost:6334)
• CRUVERO_QDRANT_API_KEY (optional)
• CRUVERO_QDRANT_COLLECTION_PREFIX (default cruvero_)
• CRUVERO_QDRANT_ON_DISK (default true; on-disk payload storage for safer memory usage)
• CRUVERO_QDRANT_GRPC_POOL_SIZE (default 2; concurrent gRPC client connections)
• CRUVERO_QDRANT_UPSERT_BATCH_SIZE (default 500; max points per upsert request)
• CRUVERO_QDRANT_TLS_CA_CERT (optional custom CA bundle path)
• CRUVERO_QDRANT_TLS_INSECURE (default false; skip TLS verification)
• CRUVERO_QDRANT_MEMORY_LIMIT (deployment/runtime setting for Qdrant container memory cap; recommended in production)

Tools and Registry

• CRUVERO_COMPOSITE_MAX_DEPTH (default 8; max nested composite invocation depth, 0 disables limit)
• CRUVERO_COMPOSITE_MAX_STEPS (default 64; max steps allowed per composite execution, 0 disables limit)
• CRUVERO_TOOL_CONTRACT_POSTCONDITION_MODE (enforce or warn; default enforce)
• CRUVERO_TOOL_SELECTION_MODE (llm_only or registry_ranked; default registry_ranked)
• CRUVERO_TOOL_SELECTION_TOP_K (default 10; max candidate tools for registry-ranked selection)
• CRUVERO_TOOL_SELECTION_MIN_CONFIDENCE (default 0.45; minimum route confidence to apply tool hint/override)
• CRUVERO_TOOL_SELECTION_REQUIRE_ROUTE (default false; if true, halt when required route cannot be satisfied)
• CRUVERO_LOOP_EFFICIENCY_GUARD_DISABLED (default false; set true to disable conservative duplicate-loop auto-halt)
• CRUVERO_TOOL_QUALITY_ENABLED (enable tool quality scoring lifecycle)
• CRUVERO_TOOL_QUALITY_DEGRADE_THRESHOLD (quality score threshold for degraded classification)
• CRUVERO_TOOL_QUALITY_QUARANTINE_AFTER (degrade window before auto-quarantine)
• CRUVERO_TOOL_QUALITY_RATING_TIMEOUT (timeout for feedback/rating persistence pipeline)
• CRUVERO_TOOL_SEARCH_SEMANTIC (enable semantic tool retrieval)
• CRUVERO_TOOL_SEARCH_COLLECTION (vector collection used by tool search)
• CRUVERO_TOOL_SEARCH_K (top-k semantic retrieval width)
• CRUVERO_TOOL_SEARCH_RESULT_LIMIT (final ranked result cap)
• CRUVERO_TOOL_SEARCH_W_SIMILARITY
• CRUVERO_TOOL_SEARCH_W_QUALITY
• CRUVERO_TOOL_SEARCH_W_RECENCY

Prompt Library and Evaluation

• CRUVERO_PROMPTLIB_EVAL_ENABLED
• CRUVERO_PROMPTLIB_EVAL_TIMEOUT
• CRUVERO_PROMPTLIB_EVAL_MAX_CONCURRENT
• CRUVERO_PROMPTLIB_EXPERIMENTS_ENABLED
• CRUVERO_PROMPTLIB_EXPERIMENT_MAX_VARIANTS
• CRUVERO_PROMPTLIB_BLUEPRINT_ENABLED
• CRUVERO_PROMPTLIB_SNIPPETS_ENABLED
• CRUVERO_PROMPTLIB_SNIPPET_MAX_DEPTH
• CRUVERO_PROMPTLIB_ENVS_ENABLED
• CRUVERO_PROMPTLIB_DEFAULT_ENVS
• CRUVERO_PROMPTLIB_ANALYTICS_RETENTION
• CRUVERO_PROMPTLIB_DIFF_CONTEXT_LINES
• CRUVERO_PROMPTLIB_NATS_CACHE_ENABLED
• CRUVERO_PROMPTLIB_NATS_SUBJECT

Supervisor and Trust

• CRUVERO_TRUST_ENABLED (default false; enable supervisor trust-based delegation and trust score updates)
• CRUVERO_TRUST_REVIEW_THRESHOLD (default 0.3; reviewer fallback threshold for low-trust delegates)
• CRUVERO_TRUST_WEIGHT_SUCCESS (default 0.5; success-rate weight in trust scoring)
• CRUVERO_TRUST_WEIGHT_QUALITY (default 0.3; quality-score weight in trust scoring)
• CRUVERO_TRUST_WEIGHT_RECENCY (default 0.2; recency-factor weight in trust scoring)
• CRUVERO_TRUST_RECENCY_DECAY (default 0.1; recency decay coefficient in trust scoring)

Immune System

• CRUVERO_IMMUNE_ENABLED (default false)
• CRUVERO_IMMUNE_QUARANTINE_THRESHOLD (default 5)
• CRUVERO_IMMUNE_QUARANTINE_TTL (default 0s, disabled)
• CRUVERO_IMMUNE_CLEANUP_ENABLED (default true)
• CRUVERO_IMMUNE_CLEANUP_INTERVAL (default 24h)
• CRUVERO_IMMUNE_RETENTION_DAYS (default 90)
• CRUVERO_IMMUNE_TOOL_THRESHOLDS (optional CSV tool:threshold, e.g. sim_git_pr:3,bash_exec:2)
• CRUVERO_IMMUNE_TOOL_NO_AUTO (optional CSV tool list excluded from auto-quarantine)
• CRUVERO_IMMUNE_ALERT_ENABLED (default true)
• CRUVERO_IMMUNE_ALERT_INTERVAL (default 5m)
• CRUVERO_IMMUNE_ALERT_ANOMALY_DELTA (default 20)
• CRUVERO_IMMUNE_ALERT_QUARANTINE_DELTA (default 3)
• CRUVERO_IMMUNE_ALERT_BLOCKED_DELTA (default 10)
• CRUVERO_IMMUNE_SNAPSHOT_ENABLED (default true)
• CRUVERO_IMMUNE_SNAPSHOT_DIR (default backups/immune)
• CRUVERO_IMMUNE_SNAPSHOT_BATCH (default 1000)

Quota and Cost

• CRUVERO_QUOTA_ENABLED (default true)
• CRUVERO_QUOTA_STORE (postgres or dragonfly)
• CRUVERO_QUOTA_DEFAULT_RPM (default 60)
• CRUVERO_QUOTA_DEFAULT_RPH (default 1000)
• CRUVERO_QUOTA_DEFAULT_TPD (default 1000000)
• CRUVERO_QUOTA_DEFAULT_COST_USD (default 100.0)
• CRUVERO_QUOTA_WARNING_THRESHOLD (default 0.8)
• CRUVERO_QUOTA_CRITICAL_THRESHOLD (default 0.95)
• CRUVERO_QUOTA_DOWNGRADE_MODEL
• CRUVERO_QUOTA_CLEANUP_ENABLED (default true)
• CRUVERO_QUOTA_CLEANUP_INTERVAL (default 6h)
• CRUVERO_QUOTA_USAGE_RETENTION (default 168h)

Tenant Runtime

• CRUVERO_TENANT_MODE (single or multi; controls tenant bootstrap/policy behavior)
• CRUVERO_TENANT_STORE (postgres default; store backend for tenant metadata)
• CRUVERO_TENANT_DEFAULT_NAMESPACE (override default Temporal namespace for bootstrap tenant)
• CRUVERO_TENANT_WORKER_MODE (worker-side tenant execution mode controls)

Audit

• CRUVERO_AUDIT_ENABLED (default false)
• CRUVERO_AUDIT_BUFFER (postgres or nats; runtime buffer backend selector)
• CRUVERO_AUDIT_BATCH_SIZE (writer batch size)
• CRUVERO_AUDIT_FLUSH_MS (writer flush interval in milliseconds)
• CRUVERO_AUDIT_STREAM_RETENTION (NATS stream retention duration)
• CRUVERO_AUDIT_PII_DETECTION (default false)
• CRUVERO_AUDIT_PII_TYPES (default email,phone,ssn,cc,ip)
• CRUVERO_AUDIT_STORE_ORIGINALS (default true)
• CRUVERO_AUDIT_BUFFER_SIZE (default 50)
• CRUVERO_AUDIT_RETENTION_DAYS (default 365)
• CRUVERO_AUDIT_EXPORT_FORMAT (soc2, hipaa, json, csv; default json)
• CRUVERO_AUDIT_POSTGRES_URL (optional dedicated audit-writer DSN; falls back to CRUVERO_POSTGRES_URL)

PII Detection

• CRUVERO_PII_ENABLED (global PII detection toggle)
• CRUVERO_PII_MODE (runtime policy mode)
• CRUVERO_PII_CLASSES (comma-separated classes to evaluate)
• CRUVERO_PII_CONFIDENCE_THRESHOLD (minimum confidence for findings)
• CRUVERO_PII_POLICY_JSON (inline JSON or path for policy override)
• CRUVERO_PII_ALLOWLIST (allowlisted token patterns)
• CRUVERO_PII_CHALLENGE_ENABLED (enable challenge/hold flow)
• CRUVERO_PII_CHALLENGE_TIMEOUT (challenge timeout)
• CRUVERO_PII_CHALLENGE_HOLD_STEPS (hold duration in workflow steps)
• CRUVERO_PII_NER_ENABLED (enable NER-based pass)
• CRUVERO_PII_MODEL_URL, CRUVERO_PII_MODEL_NAME, CRUVERO_PII_MODEL_DIR (external/local model controls)
• CRUVERO_PII_HMAC_KEY (required for deterministic token hashing in redaction/audit)

Security and Sandboxing

• CRUVERO_SANDBOX_MODE (process, gvisor, nsjail; default process)
• CRUVERO_INPUT_SANITIZATION (default false)
• CRUVERO_INPUT_SANITIZATION_MODE (block, warn, passthrough; default warn)
• CRUVERO_OUTPUT_PII_REDACTION (default true)
• CRUVERO_OUTPUT_CREDENTIAL_SCAN (default true)
• CRUVERO_OUTPUT_FILTER_MODE (redact, block; default redact)
• CRUVERO_NETWORK_POLICY_ENABLED (default false)
• CRUVERO_NETWORK_DEFAULT_POLICY (deny or allow; default deny)
• CRUVERO_MCP_STRICT_ENDPOINTS (default true; enforce MCP endpoint allowlists)
• CRUVERO_CSRF_SECRET (CSRF HMAC secret for UI/API mutating route protection)
• CRUVERO_VAULT_ADDR
• CRUVERO_VAULT_TOKEN
• CRUVERO_VAULT_SECRET_PATH_PREFIX (default secret/cruvero)
• CRUVERO_PYTHON_ALLOW_ALL_IMPORTS (default false)
• CRUVERO_PYTHON_BLOCK_IMPORTS (comma-separated import blocklist)
• CRUVERO_PYTHON_MAX_CPU_SECS (default 2)
• CRUVERO_PYTHON_MAX_MEM_MB (default 256)
• CRUVERO_PYTHON_MAX_OUTPUT_KB (default 64)
• CRUVERO_PYTHON_MAX_FILE_KB (default 256)
• CRUVERO_BASH_ALLOWED_CMDS (comma-separated command allowlist)
• CRUVERO_BASH_ALLOW_NETWORK (default false)
• CRUVERO_BASH_MAX_OUTPUT_KB (default 64)
• CRUVERO_BASH_MAX_FILE_KB (default 256)

Observability

• CRUVERO_LOG_LEVEL
• CRUVERO_HEALTH_CHECK_INTERVAL (default 30s)
• CRUVERO_WORKER_PROBE_ADDR (default :8082, worker health probe HTTP server)
• CRUVERO_STREAM_HEARTBEAT_INTERVAL (stream health heartbeat cadence in UI stream monitor)
• CRUVERO_STREAM_HEARTBEAT_TIMEOUT (stream heartbeat timeout)
• CRUVERO_STREAM_LAG_THRESHOLD (lag threshold for unhealthy stream classification)
• CRUVERO_STREAM_STALE_THRESHOLD_EVENTS (staleness threshold for events stream)
• CRUVERO_STREAM_STALE_THRESHOLD_AUDIT (staleness threshold for audit stream)
• CRUVERO_TELEMETRY_NATS (enable telemetry publication over NATS)

Backup

• CRUVERO_BACKUP_DIR (default backups)
• CRUVERO_BACKUP_PG_DUMP_BIN (default pg_dump)
• CRUVERO_BACKUP_PG_RESTORE_BIN (default pg_restore)
• CRUVERO_BACKUP_PG_DUMP_FORMAT (default custom)
• CRUVERO_BACKUP_S3_BUCKET (required for S3 upload/download)
• CRUVERO_BACKUP_S3_PREFIX (default cruvero)
• CRUVERO_BACKUP_S3_REGION (default us-east-1)
• CRUVERO_BACKUP_S3_ENDPOINT (optional S3-compatible endpoint)
• CRUVERO_BACKUP_S3_FORCE_PATH_STYLE (default false; often required for MinIO)
• CRUVERO_BACKUP_S3_ACCESS_KEY_ID / CRUVERO_BACKUP_S3_SECRET_ACCESS_KEY / CRUVERO_BACKUP_S3_SESSION_TOKEN (optional static credentials)
• CRUVERO_BACKUP_AUDIT_ARCHIVE_DAYS (default 30)
• CRUVERO_BACKUP_AUDIT_ARCHIVE_BATCH_CAP (default 250000; max rows exported per archive run)

Flow Builder and Git Integration

• CRUVERO_FLOW_GITHUB_TOKEN (GitHub token used for flow commit/PR integration)
• CRUVERO_FLOW_GITHUB_REPO (default target repository for flow commits)
• CRUVERO_FLOW_GITHUB_BRANCH (default branch for flow commit operations)
• CRUVERO_FLOW_GITHUB_PR_MODE (controls PR behavior for flow commits)
• CRUVERO_SEARCH_AUTOCOMPLETE_ENABLED (enable search autocomplete endpoints)
• CRUVERO_SEARCH_AUTOCOMPLETE_MAX_RESULTS (autocomplete result cap)
• CRUVERO_SEARCH_AUTOCOMPLETE_MIN_SIMILARITY (similarity floor for autocomplete)

UI

• CRUVERO_AUTH_PROVIDER (default none; provider used by the UI auth middleware)
• CRUVERO_UI_MODE (react or htmx; default react)
• CRUVERO_UI_AUTH (none, keycloak, oidc; runtime auth mode)
• CRUVERO_UI_JWKS_URL (JWT/JWKS endpoint)
• CRUVERO_UI_ISSUER (expected JWT issuer)
• CRUVERO_UI_AUDIENCE (expected JWT audience)
• CRUVERO_UI_OIDC_CLIENT_ID
• CRUVERO_UI_OIDC_CLIENT_SECRET
• CRUVERO_UI_OIDC_AUTH_URL
• CRUVERO_UI_OIDC_TOKEN_URL
• CRUVERO_UI_OIDC_LOGOUT_URL
• CRUVERO_UI_OIDC_REDIRECT_URI
• CRUVERO_UI_OIDC_SCOPES
• CRUVERO_UI_SESSION_TIMEOUT (OIDC session max age)
• CRUVERO_UI_STATIC_DIR (override static assets directory)
• CRUVERO_UI_DEV_PROXY (frontend dev proxy target)
• CRUVERO_UI_COST_CACHE_TTL (default 30s)
• CRUVERO_UI_ADMIN_TOKEN (required for POST /api/quota/reset and POST /api/quota/override)
• CRUVERO_FLOW_COLLAB_ENABLED (enable collaborative flow editing mode)
• CRUVERO_FLOW_COLLAB_WS_BACKEND (websocket backend endpoint for collaboration transport)
• CRUVERO_FLOW_COLLAB_WS_URL (browser-facing collaboration websocket URL override)

Production API (cmd/api)

Variable	Default	Description
CRUVERO_API_PORT	8900	API listen port
CRUVERO_API_READ_TIMEOUT	30s	HTTP read timeout
CRUVERO_API_WRITE_TIMEOUT	60s	HTTP write timeout
CRUVERO_API_IDLE_TIMEOUT	120s	HTTP idle timeout
CRUVERO_API_SHUTDOWN_TIMEOUT	15s	Graceful shutdown timeout
CRUVERO_API_AUTH	none	Auth mode: none, keycloak, apikey
CRUVERO_API_JWKS_URL	—	JWKS endpoint for JWT verification
CRUVERO_API_ISSUER	—	Expected JWT issuer
CRUVERO_API_AUDIENCE	—	Expected JWT audience
CRUVERO_API_API_KEYS	—	Comma-separated static API keys for apikey auth mode
CRUVERO_API_RATE_LIMIT	1000	Requests per minute per tenant
CRUVERO_API_RATE_LIMIT_BURST	50	Per-tenant burst allowance (requests per second limiter)
CRUVERO_API_CORS_ORIGINS	*	Comma-separated CORS allowlist
CRUVERO_API_CORS_MAX_AGE	3600	CORS preflight cache max-age (seconds)
CRUVERO_OTEL_ENDPOINT	—	OTLP trace exporter endpoint
CRUVERO_OTEL_INSECURE	false	Use insecure OTLP transport

MCP Variables

See MCP Integration.

• CRUVERO_MCP_SERVERS (server definitions string used for static MCP bootstrap)
• CRUVERO_MCP_DISCOVERY (static|nats|both)
• CRUVERO_MCP_TRANSPORT (stdio|http|sse|gateway)
• CRUVERO_MCP_GATEWAY_URL (gateway endpoint for gateway transport)
• CRUVERO_MCP_GATEWAY_AUTH (gateway auth mode/credential source)
• CRUVERO_MCP_GATEWAY_INIT_REQUIRE_AUTH (fail startup if gateway auth is missing/invalid)
• CRUVERO_MCP_HTTP_TIMEOUT
• CRUVERO_MCP_HTTP_MAX_CONNS
• CRUVERO_MCP_RETRY_MAX
• CRUVERO_MCP_RETRY_BACKOFF
• CRUVERO_MCP_CACHE_ENABLED
• CRUVERO_MCP_CACHE_ADDR
• CRUVERO_MCP_CACHE_TTL
• CRUVERO_MCP_CIRCUIT_ENABLED
• CRUVERO_MCP_CIRCUIT_FAILURE_THRESHOLD
• CRUVERO_MCP_CIRCUIT_FAILURE_WINDOW
• CRUVERO_MCP_CIRCUIT_HALF_OPEN_INTERVAL
• CRUVERO_MCP_CIRCUIT_SUCCESS_THRESHOLD
• CRUVERO_MCP_HEARTBEAT_INTERVAL
• CRUVERO_MCP_STALE_THRESHOLD
• CRUVERO_MCP_REGISTRY_ENABLED (publish discovered MCP tools into runtime registry)
• CRUVERO_MCP_TLS_ENABLED
• CRUVERO_MCP_TLS_CA_CERT
• CRUVERO_MCP_TLS_CERT
• CRUVERO_MCP_TLS_KEY
• CRUVERO_MCP_VAULT_ENABLED
• CRUVERO_MCP_VAULT_PATH
• CRUVERO_MCP_ENDPOINTS_<SERVER> (comma-separated allowed endpoint URLs for server-specific MCP endpoint pinning)
• CRUVERO_CODE_EXEC_MCP_REQUIRED (default false; when true, python_exec/bash_exec fail closed if MCP mcp-code-exec route is unavailable in http|gateway mode)

Gateway Integration

• CRUVERO_MCPGW_ENABLED (default false; enables MCP gateway integration)
• CRUVERO_MCPGW_GATEWAY_ID (default default; gateway instance ID for NATS subject scoping, mcpgw.{gateway_id}.events.* and mcpgw.{gateway_id}.config.*)
• CRUVERO_MCPGW_TENANT_ID (default default; tenant ID used by MCPGW subscriber/publisher store operations)
• CRUVERO_MCPGW_POLICY_JSON (default empty; gateway policy profiles as inline JSON or file path)
• CRUVERO_MCPGW_AUTH_MODE (default jwt; auth mode jwt|oidc|apikey|none)
• CRUVERO_MCPGW_AUTH_ALLOW_NONE (default false; explicit opt-in required before CRUVERO_MCPGW_AUTH_MODE=none is accepted)
• CRUVERO_MCPGW_OIDC_ISSUER (OIDC issuer URL for CRUVERO_MCPGW_AUTH_MODE=oidc)
• CRUVERO_MCPGW_OIDC_AUDIENCE (OIDC audience for CRUVERO_MCPGW_AUTH_MODE=oidc)
• CRUVERO_MCPGW_OIDC_JWKS_URL (OIDC JWKS URL for CRUVERO_MCPGW_AUTH_MODE=oidc)
• CRUVERO_MCPGW_AUTO_REGISTRY_REFRESH_ENABLED (auto-refresh local MCP registry on gateway changes)
• CRUVERO_MCPGW_AUTO_REGISTRY_REFRESH_DEBOUNCE (debounce window for repeated refresh triggers)
• CRUVERO_MCPGW_AUTO_REGISTRY_REFRESH_INTERVAL (periodic reconcile interval; default 15m, set 0 to disable)
• CRUVERO_MCPGW_AUTO_REGISTRY_REFRESH_REGISTRY_ID (target registry id for MCPGW-driven refresh)

Behavior notes:

• Startup validation fails if CRUVERO_MCPGW_AUTH_MODE=none and CRUVERO_MCPGW_AUTH_ALLOW_NONE is not true.
• Gateway config publication always targets gateway-scoped subjects only (mcpgw.{gateway_id}.config.{scope}).
• Store reads and writes in MCPGW subscriber/publisher paths use CRUVERO_MCPGW_TENANT_ID; avoid hardcoding tenant IDs in runtime code.

Phase 10: Neuro-Inspired Intelligence

10A Metacognitive Monitoring

• CRUVERO_METACOGNITIVE_ENABLED (default false)
• CRUVERO_METACOGNITIVE_CHECK_INTERVAL (default 3)
• CRUVERO_METACOGNITIVE_MAX_REPETITION (default 3)
• CRUVERO_METACOGNITIVE_ESCALATION_MODEL (optional)

10B Salience and Context Budget

• CRUVERO_SALIENCE_ENABLED (default true)
• CRUVERO_MEMORY_SALIENCE_RELEVANCE (default 0.4)
• CRUVERO_MEMORY_SALIENCE_RECENCY (default 0.3)
• CRUVERO_MEMORY_SALIENCE_CONFIDENCE (default 0.2)
• CRUVERO_MEMORY_SALIENCE_USAGE (default 0.1)
• CRUVERO_MEMORY_SALIENCE_FRESHNESS (default 0.0)
• CRUVERO_MEMORY_SALIENCE_HALFLIFE (default 24h)
• CRUVERO_CONTEXT_BUDGET_ENABLED (default false)
• CRUVERO_CONTEXT_BUDGET_TOKENS (default 8000)
• CRUVERO_CONTEXT_SYSTEM_TOKENS (default 1000)

10C Temporal Reasoning

• CRUVERO_TEMPORAL_REASONING_ENABLED (default false)
• CRUVERO_DEFAULT_FAST_MODEL (optional)
• CRUVERO_DEADLINE_ACTION (default escalate, allowed escalate|halt)

10D Agent Immune System

• CRUVERO_IMMUNE_ENABLED (default false)
• CRUVERO_IMMUNE_QUARANTINE_THRESHOLD (default 5)
• CRUVERO_IMMUNE_QUARANTINE_TTL (default 0s)
• CRUVERO_IMMUNE_CLEANUP_ENABLED (default true)
• CRUVERO_IMMUNE_CLEANUP_INTERVAL (default 24h)
• CRUVERO_IMMUNE_RETENTION_DAYS (default 90)
• CRUVERO_IMMUNE_TOOL_THRESHOLDS (optional CSV tool:threshold)
• CRUVERO_IMMUNE_TOOL_NO_AUTO (optional CSV tool list)
• CRUVERO_IMMUNE_ALERT_ENABLED (default true)
• CRUVERO_IMMUNE_ALERT_INTERVAL (default 5m)
• CRUVERO_IMMUNE_ALERT_ANOMALY_DELTA (default 20)
• CRUVERO_IMMUNE_ALERT_QUARANTINE_DELTA (default 3)
• CRUVERO_IMMUNE_ALERT_BLOCKED_DELTA (default 10)
• CRUVERO_IMMUNE_SNAPSHOT_ENABLED (default true)
• CRUVERO_IMMUNE_SNAPSHOT_DIR (default backups/immune)
• CRUVERO_IMMUNE_SNAPSHOT_BATCH (default 1000)

10E Compositional Tools and Contracts

• CRUVERO_COMPOSITE_MAX_DEPTH (default 8)
• CRUVERO_COMPOSITE_MAX_STEPS (default 64)
• CRUVERO_TOOL_CONTRACT_POSTCONDITION_MODE (default enforce, allowed enforce|warn)

10F Trust-Based Delegation

• CRUVERO_TRUST_ENABLED (default false)
• CRUVERO_TRUST_REVIEW_THRESHOLD (default 0.3)
• CRUVERO_TRUST_WEIGHT_SUCCESS (default 0.5)
• CRUVERO_TRUST_WEIGHT_QUALITY (default 0.3)
• CRUVERO_TRUST_WEIGHT_RECENCY (default 0.2)
• CRUVERO_TRUST_RECENCY_DECAY (default 0.1)

10G Provenance Graph

• CRUVERO_PROVENANCE_ENABLED (default false)

Phase 10 Rollout Guide

Use staged enablement so each capability can be validated independently and rolled back quickly.

Stage 0: Baseline Validation

• Keep all optional Phase 10 flags disabled (10A, 10C, 10D, 10F, 10G).
• Run:
  • go test ./...
  • go test -tags integration ./internal/agent ./internal/supervisor -count=1
• Confirm worker startup is clean with defaults.

Stage 1: Cognitive Features

• Enable:
  • CRUVERO_METACOGNITIVE_ENABLED=true
  • CRUVERO_SALIENCE_ENABLED=true (default)
  • CRUVERO_CONTEXT_BUDGET_ENABLED=true
  • CRUVERO_TEMPORAL_REASONING_ENABLED=true
• Keep CRUVERO_IMMUNE_ENABLED=false, CRUVERO_TRUST_ENABLED=false, CRUVERO_PROVENANCE_ENABLED=false.
• Validate prompt quality/latency and verify no unexpected escalation loops.

Stage 2: Runtime Safety

• Enable:
  • CRUVERO_IMMUNE_ENABLED=true
• Keep trust/provenance disabled initially.
• Validate anomaly, quarantine, and cleanup behavior in staging before production.

Stage 3: Delegation Policy

• Enable:
  • CRUVERO_TRUST_ENABLED=true
• Set policy knobs explicitly:
  • CRUVERO_TRUST_REVIEW_THRESHOLD
  • CRUVERO_TRUST_WEIGHT_SUCCESS
  • CRUVERO_TRUST_WEIGHT_QUALITY
  • CRUVERO_TRUST_WEIGHT_RECENCY
  • CRUVERO_TRUST_RECENCY_DECAY
• Validate trust score drift and reviewer fallback rates.

Stage 4: Provenance and Forensics

• Enable:
  • CRUVERO_PROVENANCE_ENABLED=true
• Validate provenance node/edge persistence, subgraph retrieval, and run-diff behavior.

Rollback Order

• Disable in reverse order to minimize operational risk:
  1. CRUVERO_PROVENANCE_ENABLED=false
  2. CRUVERO_TRUST_ENABLED=false
  3. CRUVERO_IMMUNE_ENABLED=false
  4. CRUVERO_TEMPORAL_REASONING_ENABLED=false
  5. CRUVERO_CONTEXT_BUDGET_ENABLED=false
  6. CRUVERO_METACOGNITIVE_ENABLED=false

Temporal TLS

• If TLS enabled and address ends with :443, uses system CA (no mTLS).

Templates

• Agent scaffold includes .env.example and docker-compose.override.yml.

Related Docs

• Templates and Scaffolding