Env Reference

This is the canonical list of every ROBOCO_* setting. They are all read by a single Pydantic-Settings class (roboco/config.py), loaded from the process environment and .env, prefixed with ROBOCO_, and case-insensitive. Most have a working default; the few that don't, and the ones the orchestrator refuses to start without, are flagged below.

You rarely set most of these

For a working deploy you set the two required secrets, the host paths, and maybe a feature flag or two. The long tables here exist so that when you do need to tune a timeout or a window, you can find it. The defaults shown are RoboCo's config defaults; a few compose-only defaults differ and are called out.

A feature flag set in .env takes effect on the next backend restart. The env-gated subsystems can also be toggled from the panel's Settings → Feature Flags card, which persists to the settings store and overrides the env default; an unset toggle falls back to the env/config default. See the Optional capabilities section for what each subsystem does.

Required secrets

Variable	Default	Purpose
`ROBOCO_ENCRYPTION_KEY`	(empty — required)	Fernet key encrypting every per-project git token at rest. The orchestrator refuses to start without it (compose `:?` guard). Generate with `python -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())'`. Keep it stable — losing it makes stored tokens undecryptable.
`ROBOCO_AGENT_AUTH_SECRET`	(empty — required for compose)	HMAC secret signing the per-agent `X-Agent-Token`. Generate with `python -c 'import secrets; print(secrets.token_hex(32))'`.
`ROBOCO_CLOUD_AUTH_SECRET`	(empty — required when cloud auth is on)	Signs the session cookie's JWT. The orchestrator refuses to start if `ROBOCO_CLOUD_AUTH_ENABLED=true` and this is unset. Generate with `python -c 'import secrets; print(secrets.token_hex(32))'`. Irrelevant while cloud auth is off.

Security & auth

Variable	Default	Purpose
`ROBOCO_AGENT_AUTH_REQUIRED`	`false`	Fail-closed secure mode. When `true`, every API call must carry a valid token. Requires `ROBOCO_PANEL_AGENT_TOKEN` to keep the panel working. On a trusted LAN, leave `false` (header-trust mode).
`ROBOCO_PANEL_AGENT_TOKEN`	(empty)	The CEO token nginx injects as `X-Agent-Token` on `/api` and `/ws` in secure mode, so the panel works without the browser holding the signing secret. Generate with `make panel-token`.

Application & API server

Variable	Default	Purpose
`ROBOCO_APP_VERSION`	`0.29.0`	Reported app version.
`ROBOCO_DEBUG`	`false`	Debug mode.
`ROBOCO_ENVIRONMENT`	`development`	One of `development` / `staging` / `production`. Selects the JSON log renderer (prod) vs console renderer. The compose stack sets `production`.
`ROBOCO_HOST`	`127.0.0.1`	Bind address. Use `0.0.0.0` in containers.
`ROBOCO_PORT`	`8000`	API port.
`ROBOCO_API_URL`	(unset)	Override base URL for containerized agents (e.g. `http://roboco-orchestrator:8000`); otherwise built from host/port.
`ROBOCO_CORS_ORIGINS`	`["http://localhost:3000","http://localhost:5173"]`	Allowed CORS origins. The single-origin nginx setup means you rarely change this.
`ROBOCO_CORS_ALLOW_CREDENTIALS`	`true`	Whether CORS allows credentials.
`ROBOCO_PUBLIC_BASE_URL`	`http://127.0.0.1:8000`	Reachable base URL embedded in commit-trailer links — set to your LAN IP or domain so the links resolve.

Database

Variable	Default	Purpose
`ROBOCO_DATABASE_HOST`	`localhost`	Postgres host (`roboco-postgres` in compose).
`ROBOCO_DATABASE_PORT`	`5432`	Postgres port.
`ROBOCO_DATABASE_USER`	`roboco`	Postgres user.
`ROBOCO_DATABASE_PASSWORD`	`roboco`	Postgres password — change it for any real deployment.
`ROBOCO_DATABASE_NAME`	`roboco`	Database name.
`ROBOCO_DATABASE_ECHO`	`false`	Log every SQL statement.
`ROBOCO_DATABASE_POOL_SIZE`	`10`	Connection pool size.
`ROBOCO_DATABASE_MAX_OVERFLOW`	`20`	Extra connections beyond the pool.
`ROBOCO_DATABASE_POOL_TIMEOUT`	`10`	Seconds to wait for a pooled connection.
`ROBOCO_DATABASE_POOL_RECYCLE`	`1800`	Recycle a connection after this many seconds.

A daily pg_dump of this database runs automatically via an always-on sidecar — no flag, no env var here to set. See Backups.

Redis

Variable	Default	Purpose
`ROBOCO_REDIS_HOST`	`localhost`	Redis host (`roboco-redis` in compose).
`ROBOCO_REDIS_PORT`	`6379`	Redis port.
`ROBOCO_REDIS_DB`	`0`	Redis logical DB.
`ROBOCO_REDIS_PASSWORD`	(unset)	Optional Redis password.

RAG, embeddings & Ollama

Variable	Default	Purpose
`ROBOCO_RAG_PERSIST_DIR`	`.roboco`	Local RAG persistence dir.
`ROBOCO_RAG_CHUNK_STRATEGY`	`fixed`	One of `fixed` / `semantic` / `hierarchical` / `contextual`. `fixed` recommended; `semantic` loads an extra model.
`ROBOCO_RAG_CHUNK_SIZE`	`512`	Base chunk size.
`ROBOCO_RAG_CHUNK_SIZE_DOCS`	`1536`	Chunk size for docs.
`ROBOCO_RAG_CHUNK_SIZE_JOURNALS`	`1024`	Chunk size for journals/reflections.
`ROBOCO_RAG_CHUNK_OVERLAP`	`128`	Chunk overlap.
`ROBOCO_RAG_AUTO_UPDATE_ENABLED`	`true`	Whether the RAG index auto-refreshes.
`ROBOCO_RAG_AUTO_UPDATE_INTERVAL`	`300`	Seconds between auto-updates.
`ROBOCO_ANTHROPIC_API_KEY`	(unset)	Optional Anthropic key. Agents use the mounted Claude Code auth, not a metered key.
`ROBOCO_DEFAULT_EMBEDDING_MODEL`	`qwen3-embedding:0.6b`	Embedding model (1024-dim).
`ROBOCO_EMBEDDING_DIMENSIONS`	`1024`	Embedding dimensions — must match the model.
`ROBOCO_LOCAL_LLM_MODEL`	`glm-5:cloud`	Local LLM for RAG answer synthesis.
`ROBOCO_LOCAL_LLM_BASE_URL`	`http://roboco-ollama:11434/v1`	Ollama OpenAI-compatible endpoint.
`ROBOCO_OLLAMA_BASE_URL`	`http://roboco-ollama:11434`	Ollama native endpoint (embeddings, model management).

Workspaces & git timeouts

Variable	Default	Purpose
`ROBOCO_WORKSPACES_ROOT`	`/data/workspaces`	Root for all agent git clones.
`ROBOCO_WORKSPACE_AUTO_CLONE`	`true`	Auto-clone a repo on first workspace access.
`ROBOCO_WORKSPACE_CLONE_TIMEOUT`	`300`	Seconds for a `git clone`.
`ROBOCO_WORKSPACE_REFRESH_FETCH_TIMEOUT_SECONDS`	`60`	Timeout for the best-effort `git fetch` on re-entry into a healthy clone.
`ROBOCO_WORKSPACE_INSTALL_DEV_DEPS`	`true`	After cloning, install the project's dev dependencies into the workspace so `make quality` runs without re-downloading tooling.
`ROBOCO_WORKSPACE_DEP_INSTALL_TIMEOUT_SECONDS`	`600`	Timeout for that post-clone dependency install.
`ROBOCO_GIT_COMMAND_TIMEOUT_SECONDS`	`30`	Timeout for a single local git subprocess (status, log, checkout).
`ROBOCO_GIT_COMMIT_TIMEOUT_SECONDS`	`180`	Timeout for staging + committing a changeset.
`ROBOCO_GIT_NETWORK_TIMEOUT_SECONDS`	`120`	Timeout for git ops that talk to origin (fetch / pull / push).
`ROBOCO_PROTECTED_GIT_URLS`	(empty)	Repo URL substrings a project may not point at — blocks agent commits/merges from reaching a protected repo.

Agent images (spawn source)

Variable	Default	Purpose
`ROBOCO_AGENT_IMAGE_REGISTRY`	(empty)	Registry namespace for pre-built agent images (e.g. `ghcr.io/rennf93`). Empty = build locally. The registry compose wires this to `ROBOCO_REGISTRY`.
`ROBOCO_AGENT_IMAGE_TAG`	(empty)	Tag for pre-built agent images (e.g. `0.9.0`). Empty = implicit `:latest`. The registry compose wires this to `ROBOCO_VERSION`.

Deploy-time variables (compose, not config.py)

A few variables are consumed by the compose files and host-mount wiring rather than by config.py: ROBOCO_REGISTRY, ROBOCO_VERSION, ROBOCO_DATA_DIR, ROBOCO_HOST_PROJECT_DIR, ROBOCO_HOST_CLAUDE_DIR / CLAUDE_AUTH_DIR, ROBOCO_HOST_DATA_DIR, ROBOCO_HOST_GROK_DIR, ROBOCO_HOST_CODEX_DIR, ROBOCO_HOST_GEMINI_DIR, ROBOCO_HOST_KIMI_DIR, and ROBOCO_BACKUP_MIRROR_DIR. They are documented in the production deploy reference and Backups.

Transcript retention

Variable	Default	Purpose
`ROBOCO_TRANSCRIPT_RETENTION_DAYS`	`14`	Days to keep agent Claude Code transcripts. A stored panel setting overrides this default.
`ROBOCO_TRANSCRIPT_PRUNE_ENABLED`	`true`	Whether the background sweep prunes old transcripts.
`ROBOCO_TRANSCRIPT_PRUNE_INTERVAL_SECONDS`	`3600`	Minimum seconds between prune passes.

Notifications

Variable	Default	Purpose
`ROBOCO_NOTIFICATION_ACK_TTL_HOURS`	`48`	Hours until an ack-required notification's deadline is stamped at creation. Past that deadline, still unacknowledged, it re-escalates one level up on the backoff schedule below. `0` disables stamping — the legacy behavior, where a notification never expires. Informational (non-ack-required) notifications never get a deadline regardless of this setting. See Notifications.
`ROBOCO_NOTIFICATION_REESCALATION_BASE_SECONDS`	`3600`	Base interval for the re-escalation backoff: the first re-escalation fires at expiry, each one after that doubles the wait from this base (1h, 2h, 4h, 8h, ...) capped at 24h between attempts — instead of re-firing every ~60s sweep tick forever.
`ROBOCO_NOTIFICATION_MAX_REESCALATIONS`	`5`	Hard cap on re-escalations per notification. Past this many attempts, a still-unacked notification is logged once as permanently-unacked and left alone for good.

Spawn pacing, SLAs & reaper windows

The orchestrator's dispatcher uses these to pace spawns, detect loops, and reclaim stuck work. Defaults are tuned for real LLM latency — raise the reaper windows (not lower) if long agent tasks are being reaped mid-work.

Variable	Default	Purpose
`ROBOCO_AGENT_TOOL_CALL_WARN`	`100`	Soft warning threshold for per-session tool calls.
`ROBOCO_AGENT_TOOL_CALL_HALT`	`300`	Hard cap on per-session tool calls; the orchestrator stops the container. Raised from 150 — that ceiling repeatedly halted legitimate multi-file work seconds after a real commit, burning a spawn and the resumed agent's re-verification turns.
`ROBOCO_AGENT_LOOP_THRESHOLD`	`3`	Identical tool+args repeats in the window that flag a loop.
`ROBOCO_AGENT_LOOP_WINDOW`	`10`	How many recent tool calls to inspect for loop detection.
`ROBOCO_AGENT_STOP_ATTEMPT_ALLOWANCE`	`1`	Stop-without-terminal attempts before auto-substitute.
`ROBOCO_AGENT_SLA_DEVELOPER_IN_PROGRESS`	`7200`	SLA (s) for a developer in `in_progress`.
`ROBOCO_AGENT_SLA_DEVELOPER_VERIFYING`	`1800`	SLA (s) for a developer in `verifying`.
`ROBOCO_AGENT_SLA_QA_CLAIMED`	`1800`	SLA (s) for QA on a claimed review.
`ROBOCO_AGENT_SLA_DOCUMENTER_CLAIMED`	`3600`	SLA (s) for a documenter on a claimed task.
`ROBOCO_AGENT_SLA_CELL_PM_CLAIMED`	`14400`	SLA (s) for a cell PM on a claimed task.
`ROBOCO_CLAIM_STALE_SECONDS`	`180`	Claim-heartbeat staleness used by the spawn trigger filter.
`ROBOCO_STALE_CLAIM_REAP_SECONDS`	`600`	Reaper-only stale-claim threshold before releasing a claim back to pending.
`ROBOCO_PM_CLOSURE_RECENTLY_PAUSED_SECONDS`	`45`	Debounce before respawning a PM to close a recently paused parent.
`ROBOCO_GROK_IDLE_KILL_SECONDS`	`900`	Idle-container kill threshold for Grok agents (they emit no SDK heartbeat).
`ROBOCO_GROK_MAX_COST_USD`	`0.0`	Per-agent Grok cost ceiling (USD) before kill; `0` disables.
`ROBOCO_INTERACTIVE_IDLE_REAP_SECONDS`	`1800`	Idle-reap threshold for live intake/secretary chats; `0` disables.
`ROBOCO_CLAIMED_NO_AGENT_GRACE_SECONDS`	`120`	Grace window before respawning/releasing a claimed task with no running agent.
`ROBOCO_PM_DECISION_WINDOW_SECONDS`	`300`	Recency window for a PM `journal:decision` to satisfy gating verbs.
`ROBOCO_SPAWN_COOLDOWN_SECONDS`	`60`	Per-task spawn-rate cooldown.
`ROBOCO_ROLE_SPAWN_RATE_PER_MINUTE`	`6`	Per-role spawn-rate limit per minute.

Gateway: manifests & tracing-gate minimums

Variable	Default	Purpose
`ROBOCO_MANIFEST_HOST_DIR`	`/app/manifests`	Orchestrator dir where per-agent tool manifests are written; must be a host-bind-mounted path so the daemon can mount each manifest into its agent.
`ROBOCO_QA_NOTES_MIN_CHARS`	`80`	Minimum characters for QA notes.
`ROBOCO_DOCS_NOTES_MIN_CHARS`	`20`	Minimum characters for docs notes.
`ROBOCO_DEV_NOTES_MIN_CHARS`	`40`	Minimum characters for a developer's `dev_notes`.
`ROBOCO_PR_REVIEWER_NOTES_MIN_CHARS`	`40`	Minimum characters for a PR reviewer's notes.
`ROBOCO_QUICK_CONTEXT_MIN_CHARS`	`30`	Minimum characters for a PM's `quick_context` resumption section.
`ROBOCO_COMMIT_SUBJECT_MIN_CHARS`	`20`	Minimum characters for a commit subject.
`ROBOCO_COMMIT_BANNED_WORDS`	`wip,tmp,asdf,oops,fix,update,change,stuff,things`	Banned single-word commit subjects.

Grok runtime

Only relevant if you run any agent on Grok. See the models section for the full runtime.

Variable	Default	Purpose
`ROBOCO_HOST_GROK_DIR`	`/home/renzof/.grok` (compose)	Host `~/.grok` SuperGrok auth dir; mounted read-write into the orchestrator (token auto-refresh) and read-only into Grok agents. The same value is both the source and target path.
`ROBOCO_GROK_AGENT_IMAGE`	`roboco-agent-grok:latest`	Image the orchestrator spawns for Grok agents.
`ROBOCO_GROK_CLI_MODEL`	`grok-build`	Grok CLI model id.
`ROBOCO_GROK_REASONING_EFFORT`	(empty)	`low`/`medium`/`high`/`xhigh`/`max` for all Grok agents; empty keeps the model default.
`ROBOCO_GROK_MAX_TURNS`	`200`	Hard ceiling on agentic turns per Grok run (loop guard).
`ROBOCO_GROK_IDLE_KILL_SECONDS`	`900`	(see reaper table) Idle-kill window for a wedged Grok container.
`ROBOCO_GROK_MAX_COST_USD`	`0.0`	(see reaper table) Per-agent Grok cost ceiling.

Codex runtime

Only relevant if you run any agent on Codex. V1: delivery roles only, not Intake/Secretary. See the models section for the full runtime.

Variable	Default	Purpose
`ROBOCO_HOST_CODEX_DIR`	`~/.codex`	Host `~/.codex` ChatGPT-subscription auth dir (from `codex login`), mounted read-only as a directory into each Codex agent.
`ROBOCO_CODEX_CLI_MODEL`	`gpt-5.3-codex`	Codex CLI model id — Codex has no reliable default, so this is always set explicitly.
`ROBOCO_CODEX_OAUTH_CLIENT_ID`	(unset — built-in default)	Override the OIDC client id used for the token-refresh grant, if the default is wrong for your account. A bad refresh never mutates `auth.json` — worst case is a parked provider.

Gemini runtime

Only relevant if you run any agent on Gemini. V1: delivery roles only, not Intake/Secretary. See the models section for the full runtime.

Variable	Default	Purpose
`ROBOCO_HOST_GEMINI_DIR`	`~/.gemini`	Host `~/.gemini` OAuth login dir (from the interactive `gemini` login), mounted read-only; each container copies it into a writable local dir and refreshes its own copy in-process — no orchestrator refresh daemon needed.
`ROBOCO_GEMINI_CLI_MODEL`	`gemini-2.5-pro`	Gemini CLI model id — also accepts `gemini-2.5-flash` / `gemini-2.5-flash-lite`.
`ROBOCO_GEMINI_MAX_TURNS`	`200`	Hard ceiling on agentic turns per Gemini run (loop guard, Grok parity).
`ROBOCO_GEMINI_RATE_LIMIT_RETRY_AFTER_SECONDS`	`60.0`	Base park-and-retry delay after a quota/rate-limit exit.
`ROBOCO_GEMINI_AUTH_RETRY_AFTER_SECONDS`	`60.0`	Park-and-retry delay after a missing/invalid OAuth credential (entrypoint preflight failure).

Kimi runtime

Only relevant if you run any agent on Kimi. V1: delivery roles only, not Intake/Secretary. See the models section for the full runtime.

Variable	Default	Purpose
`ROBOCO_HOST_KIMI_DIR`	`~/.kimi-code`	Host `~/.kimi-code` Kimi-subscription auth dir (from `kimi login`), mounted read-write and shared into every Kimi agent plus the orchestrator — Moonshot's refresh token rotates with only a short reuse grace, so every container redeems the same chain instead of an independent copy.
`ROBOCO_KIMI_CLI_MODEL`	`kimi-code/k3`	Kimi CLI model alias — also accepts `kimi-code/kimi-for-coding` (K2.7) as a cheaper lever.

OpenRouter runtime

Only relevant if you run any agent on OpenRouter. The fleet default is whatever model you picked from the live catalog. See the models section for the full runtime.

Variable	Default	Purpose
`ROBOCO_OPENROUTER_BASE_URL`	`https://openrouter.ai/api/v1`	API base for the OpenRouter provider.

Nebius runtime

Only relevant if you run any agent on Nebius Token Factory. See the models section for the full runtime.

Variable	Default	Purpose
`ROBOCO_NEBIUS_BASE_URL`	`https://api.tokenfactory.nebius.com/v1`	Token Factory OpenAI-compatible API base.
`ROBOCO_NEBIUS_CLI_MODEL`	`nvidia/nemotron-3-super-120b-a12b`	Default Nebius model id (Nemotron 3 Super) used when the mode or role has no other assignment.
`ROBOCO_NEBIUS_RATE_LIMIT_RETRY_AFTER_SECONDS`	`60.0`	Park-and-retry delay after a 429.
`ROBOCO_NEBIUS_AUTH_RETRY_AFTER_SECONDS`	`60.0`	Park-and-retry delay after an auth preflight failure.

Hummin runtime (GLM)

Only relevant if you run any agent on the hummin GLM CLI. See the models section for the full runtime.

Variable	Default	Purpose
`ROBOCO_HUMMIN_CLI_MODEL`	`glm-5.3-flash:high`	Default GLM model id. Applying hummin mode seeds role tiers from it: board/reviewer/PM roles on `:high`, delivery roles on `:low`.
`ROBOCO_HUMMIN_RATE_LIMIT_RETRY_AFTER_SECONDS`	`60.0`	Park-and-retry delay after a GLM rate limit.
`ROBOCO_HUMMIN_AUTH_RETRY_AFTER_SECONDS`	`60.0`	Park-and-retry delay after the hummin auth preflight fails.
`ROBOCO_HUMMIN_MAX_CONCURRENT`	(uncapped)	Cap on concurrent hummin sessions, if you want one.

Token Factory Sandboxes

Flags for the run_sandbox_tests gateway verb (QA test runs inside a Nebius Token Factory Sandbox microVM). Everything is inert while the flag is off; see Run on Nebius.

Variable	Default	Purpose
`ROBOCO_TOKEN_FACTORY_SANDBOXES_ENABLED`	`false`	Master switch (also on the Feature Flags card). Requires a saved Nebius key; spawn permission must be granted console-side.
`ROBOCO_TOKEN_FACTORY_SANDBOXES_BASE_URL`	`https://api.tokenfactory.nebius.com/sandboxes`	Sandboxes API base (the client appends `/v1`).
`ROBOCO_TOKEN_FACTORY_SANDBOXES_IMAGE`	`tag:python:3.12`	Default sandbox image; a verb call may override it.
`ROBOCO_TOKEN_FACTORY_SANDBOXES_TIMEOUT_SECONDS`	`900`	Default run deadline; a verb call may pass its own (30 to 3600s), and the instance is cancelled best-effort at the deadline.
`ROBOCO_TOKEN_FACTORY_SANDBOXES_MAX_ARCHIVE_BYTES`	64 MiB	Upload ceiling for the archived workspace.

Optional subsystem flags (default-off unless noted)

These gate the env-toggled capabilities. Each is inert when off. See Optional capabilities.

Web research — default on

Variable	Default	Purpose
`ROBOCO_RESEARCH_ENABLED`	`true`	Master switch for web research. When `false`, the search MCP is not mounted into any agent.
`ROBOCO_RESEARCH_PROVIDER`	`tavily`	`tavily` / `brave` / `exa` / `null`.
`ROBOCO_RESEARCH_API_KEY`	(unset)	Provider key — server-side only, never reaches an agent. Unset = empty-result null provider.
`ROBOCO_RESEARCH_MAX_RESULTS`	`5`	Cap on results per search (1–20).
`ROBOCO_RESEARCH_FETCH_MAX_CHARS`	`20000`	Cap on extracted characters per fetch.
`ROBOCO_RESEARCH_TIMEOUT_SECONDS`	`15.0`	Per-request outbound timeout.
`ROBOCO_RESEARCH_DAILY_QUOTA_PER_AGENT`	`50`	Search+fetch calls per agent per UTC day.

GitHub repo provisioning — default on (inert without token/org)

Creating brand-new repos from an approved pitch is GitHub-only — see Pitch provisioning. This is distinct from a project's per-project Forge selection (GitHub, Gitea, or GitLab), which routes PR/CI/review operations against a repo that already exists — that part works on all three forges. See Choosing a forge.

Variable	Default	Purpose
`ROBOCO_PROVISIONING_ENABLED`	`true`	Master switch for pitch auto-provisioning. Inert with no token/org regardless.
`ROBOCO_PROVISIONING_TOKEN`	(empty)	GitHub PAT (repo + org admin) used to create repos — server-side only.
`ROBOCO_PROVISIONING_ORG`	(empty)	GitHub org where new repos are created.
`ROBOCO_GITHUB_API_BASE_URL`	`https://api.github.com`	Override for GitHub Enterprise — used both for provisioning and, per-project, whenever a project's Forge is set to GitHub / GitHub Enterprise. Gitea and GitLab need no equivalent variable: their API base is derived from the project's own Git URL host. See Choosing a forge.
`ROBOCO_PROVISIONING_TIMEOUT_SECONDS`	`30.0`	Per-request provisioning timeout.
`ROBOCO_PROVISIONING_REPO_PRIVATE`	`true`	Whether provisioned repos are private.

Architectural conventions — off (config) / on (compose)

Variable	Default	Purpose
`ROBOCO_CONVENTIONS_ENABLED`	`false` (config) / `true` (compose)	Master switch for the per-project conventions standard (scaffold, ambient injection, baseline constraints, gate enforcement). The compose orchestrator block defaults this on (left off in `docker-compose.registry.yml`); fully inert when off.

Toolchain matching — default off

Variable	Default	Purpose
`ROBOCO_TOOLCHAIN_MATCH_ENABLED`	`false` (config) / `true` (compose)	Provision the agent workspace with the target project's Python and block delivery gates when the suite can't run. The compose orchestrator block defaults this on.

Provider overload break — default on

Variable	Default	Purpose
`ROBOCO_OVERLOAD_BREAK_ENABLED`	`true`	Park a provider on a persistent overload (HTTP 529/500/503) the way a 429 is parked, instead of crash-retrying.
`ROBOCO_GATEWAY_HEALTH_ENABLED`	`true`	Probe a stale-heartbeat-but-live agent's gateway and kill + respawn it when the gateway is broken (a corrupted `/app` venv firing no verb), instead of the reaper protecting it forever. Off => spare live containers on verb-heartbeat liveness alone.
`ROBOCO_GATEWAY_HEALTH_GRACE_SECONDS`	`180`	How long an agent gateway may probe as broken before recovery — tolerates a transient probe miss.
`ROBOCO_IMAGE_PRUNE_ENABLED`	`true`	Background sweep prunes dangling (`<none>`) Docker images left by agent-image rebuilds, throttled ~6h. Only dangling images are removed — a tagged image or one backing a running container is never touched. Not a feature flag; disable to manage image cleanup yourself.

PR-gate turn cut — default on

Not a subsystem toggle — a delivery-flow behavior. See the merge model.

Variable	Default	Purpose
`ROBOCO_PR_GATE_AUTO_SUBMIT_ENABLED`	`true`	When every child of an assembled parent is terminal, run the PM's `submit_up` / `submit_root` to the in-path PR gate system-side (as the owning PM) instead of spawning the PM just to press submit — the submit's substance (freshness rebase, integrity check, PR open) is deterministic gate code. A gate rejection falls back to the classic PM closure spawn, and the PM keeps its judgment turns (merge, revision). Off => every closure spawns the PM to submit.

Strategy engine — default off

Variable	Default	Purpose
`ROBOCO_STRATEGY_ENGINE_ENABLED`	`false`	Master switch for the autonomous strategy engine (notify-only). When off the loop never runs.
`ROBOCO_STRATEGY_ENGINE_INTERVAL_SECONDS`	`1800`	Seconds between assessment passes.
`ROBOCO_STRATEGY_STRANDED_BLOCKED_MINUTES`	`120`	A task blocked longer than this is surfaced as stranded.

Possibilities matrix — default off

Variable	Default	Purpose
`ROBOCO_POSSIBILITIES_MATRIX_ENABLED`	`false`	Master switch for the `i_am_done` fast path. Off: every task follows the standard multi-turn plan/verify/submit flow regardless of how complete it looks. On: a task with commits, an open PR, full acceptance-criteria coverage, and no open findings can submit to QA in one call, with PR CI-green standing in for the local quality gate (falling back to the local gate + toolchain check when no CI signal exists). Conventions and findings enforcement are never skipped.

Task & project cost budgets — default off (config) / on in the NAS compose

Project monthly_budget_usd and task budget_usd are project/task fields set in the panel, independent of this flag; the flag decides whether either is ever consulted. See Task & project cost budgets.

Variable	Default	Purpose
`ROBOCO_TASK_BUDGETS_ENABLED`	`false` (config) / `true` (`docker-compose.yml`) / `false` (`docker-compose.registry.yml`)	Master switch. Off: neither cap is ever consulted regardless of field values. On: a work-starting claim is refused once a project's monthly spend cap is reached (review/doc/gate/inbound-PR claims are exempt), and a background sweep blocks an over-budget task (falling back to a per-`TaskType` default when `budget_usd` is null), notifying the CEO.

External / internal PR review — default off

Variable	Default	Purpose
`ROBOCO_EXTERNAL_PR_ENABLED`	`false` (config) / `true` (compose)	Master switch for inbound external/fork PR review. The compose orchestrator block defaults this on.
`ROBOCO_EXTERNAL_PR_POLL_INTERVAL_SECONDS`	`300`	Seconds between inbound external-PR discovery passes.
`ROBOCO_EXTERNAL_PR_AUTHOR_ALLOWLIST`	(empty)	GitHub usernames auto-trusted. Empty = every external PR needs human confirmation.
`ROBOCO_EXTERNAL_PR_REQUIRE_HUMAN_CONFIRM`	`true`	Require explicit human confirmation before any agent fetches/checks-out/executes external code.
`ROBOCO_INTERNAL_PR_ENABLED`	`false`	Also review org-repo (non-fork) PRs not tied to an active task.

Self-healing CI loop — default off

Variable	Default	Purpose
`ROBOCO_SELF_HEAL_ENABLED`	`false`	Master switch for the self-heal loop (detect + notify the CEO). When off the loop never runs.
`ROBOCO_SELF_HEAL_PROJECT_SLUG`	(empty) / `roboco-api` (compose)	The registered project that is RoboCo itself — the only repo the loop watches/originates into.
`ROBOCO_SELF_HEAL_CI_WORKFLOW`	`ci.yml`	GitHub Actions workflow file to scope the CI signal to.
`ROBOCO_SELF_HEAL_ORIGINATE_ENABLED`	`false`	Second opt-in: on a regression, also open a fix task and dispatch it to the Main PM automatically (no manual start). The loop never merges or deploys — the fix ships through the normal gates (QA, PR review, your merge).
`ROBOCO_SELF_HEAL_INTERVAL_SECONDS`	`1800`	Seconds between telemetry passes.
`ROBOCO_SELF_HEAL_MAX_OPEN_TASKS`	`3`	Rolling cap on concurrently-open self-heal tasks.
`ROBOCO_SELF_HEAL_MAX_PER_CYCLE`	`1`	Max self-heal tasks originated in one cycle.

Multi-repo CI-watch — default off

The global switch arms the engine; each project opts in via ci_watch_enabled (+ optional ci_watch_workflow) on its settings page.

Variable	Default	Purpose
`ROBOCO_CI_WATCH_ENABLED`	`false`	Master switch for watching opted-in projects' CI. When off the engine never runs and no CI telemetry is fetched.
`ROBOCO_CI_WATCH_DEFAULT_WORKFLOW`	`ci.yml`	Workflow file to scope the CI signal to when a project sets no `ci_watch_workflow` of its own.
`ROBOCO_CI_WATCH_INTERVAL_SECONDS`	`1800`	Seconds between CI-watch passes.
`ROBOCO_CI_WATCH_MAX_OPEN_TASKS`	`3`	Rolling cap on concurrently-open CI-watch fix tasks per repo.
`ROBOCO_CI_WATCH_MAX_PER_CYCLE`	`1`	Max CI-watch fix tasks opened in one cycle.

Dependency-update bot — default off

The global switch arms the engine; each project opts in via dep_update_command (+ optional dep_update_paths) on its settings page. Detection is read-only — the command runs in a throwaway clone and only the lockfiles are diffed; the real repo is never mutated.

Variable	Default	Purpose
`ROBOCO_DEP_UPDATE_ENABLED`	`false`	Master switch for the dependency-update bot. When off nothing runs and no throwaway clone is made.
`ROBOCO_DEP_UPDATE_INTERVAL_SECONDS`	`604800`	Seconds between dependency-update passes (default weekly).
`ROBOCO_DEP_UPDATE_MAX_OPEN_TASKS`	`3`	Rolling cap on concurrently-open update-dependencies tasks per repo.
`ROBOCO_DEP_UPDATE_MAX_PER_CYCLE`	`1`	Max update-dependencies tasks opened in one cycle.

Environment branches & EnvSync — default off

A project's environment ladder (an ordered list of {name, branch} rungs) is project configuration, set on its settings page — always available regardless of this flag. ROBOCO_ENV_SYNC_ENABLED only arms the automatic cascade between rungs. See Environment Branches & EnvSync.

Variable	Default	Purpose
`ROBOCO_ENV_SYNC_ENABLED`	`false`	Master switch for the ladder auto-cascade. Off: a project's ladder still resolves the PR-target branch and the release branch, but nothing syncs the middle rungs automatically. On: a periodic pass merges each rung down into the next; a clean merge auto-pushes, a conflict opens one sync PR + one coordination task and stops that project's cascade for the cycle. Never pushes to the last (release) rung.
`ROBOCO_ENV_SYNC_INTERVAL_SECONDS`	`1800`	Seconds between cascade passes.
`ROBOCO_ENV_SYNC_MAX_OPEN_TASKS`	`3`	Rolling cap on concurrently-open env-sync conflict tasks across all repos.
`ROBOCO_ENV_SYNC_MAX_PER_CYCLE`	`1`	Max projects cascaded in one cycle.

Docs-Sync — default off

No polling interval — triggered directly off the gated release manager's publish step, not a background loop. Requires the docs site itself to be registered as a RoboCo project with a git token. See Docs-Sync.

Variable	Default	Purpose
`ROBOCO_DOCS_SYNC_ENABLED`	`false`	Master switch. Off: publishing a release never opens a docs-update task. On: a publish checks the registered docs-site project for drift and, if found, opens one task that rides the normal delivery flow (dev → QA → PR-review gate → your merge); never auto-merges. With no docs-site project registered, it skips silently regardless of this flag.
`ROBOCO_DOCS_SYNC_MAX_OPEN_TASKS`	`3`	Rolling cap on concurrently-open docs-sync tasks.
`ROBOCO_DOCS_SYNC_MAX_PER_CYCLE`	`1`	Max docs-sync tasks opened per release publish.

HTTP security guard (fastapi-guard) — off (config) / active on the NAS compose

Not a panel flag — see HTTP security. The registry compose omits this whole trio and stays off.

Variable	Default	Purpose
`ROBOCO_GUARD_ENABLED`	`false`	Master switch. Off: `create_app` never mounts the middleware; the request path is byte-for-byte unchanged.
`ROBOCO_GUARD_PASSIVE_MODE`	`true` (config) / `false` (NAS compose)	`true` detects and logs only, never blocking. `false` actually blocks a matching request. The NAS compose flips this to enforce once passive-mode calibration reviewed clean.
`ROBOCO_GUARD_FAIL_SECURE`	`true` (config) / `true` (NAS compose, as of v0.29.0)	What happens when a security check itself errors: `true` fails closed (blocks). As of v0.29.0 the NAS compose also enforces fail_secure — the earlier `false` relaxation was a holdover from the passive-mode calibration phase.
`ROBOCO_GUARD_EMERGENCY`	`false`	Kill-switch: blocks every non-whitelisted IP, flippable without a redeploy during an active attack.
`ROBOCO_GUARD_EMERGENCY_WHITELIST`	(empty)	Comma-separated IPs exempted from the emergency lockdown above.
`ROBOCO_GUARD_TELEMETRY_ENABLED`	`false`	Reports security events/metrics to a guard-core platform via guard-agent. No data leaves the box while off. As of v0.29.0, telemetry payloads exclude HMAC/session headers via `agent_sensitive_headers`.
`ROBOCO_GUARD_AGENT_API_KEY`	(empty)	guard-agent API key — required when telemetry is enabled.
`ROBOCO_GUARD_PROJECT_ID`	(empty)	guard-core project id — required when telemetry is enabled.
`ROBOCO_GUARD_TRUSTED_CHAIN_PEERS`	(empty)	Comma-separated exact IP address(es) — never a CIDR range — of a host-proxy hop (e.g. Tailscale Serve's docker-bridge gateway) in front of nginx, trusted to appear as a recorded proxy hop in `X-Forwarded-For` when resolving the real client behind it. Empty: only a loopback rightmost hop peels.
`ROBOCO_GUARD_SCAN_RESPONSE_BODY`	`false`	Lets `return_pattern` rules read response bodies, not just status codes. Default off — Roboco's own rules never need it.
`ROBOCO_GUARD_LOG_SUSPICIOUS_LEVEL`	`WARNING`	Log level for suspicious-request entries.

Gated release manager (default-off)

Variable	Default	Purpose
`ROBOCO_RELEASE_MANAGER_ENABLED`	`false`	Master switch for the gated release manager. When off the loop never runs and no release is proposed. Even on it only PROPOSES — the CEO approves before any publish.
`ROBOCO_RELEASE_MIN_COMMITS`	`8`	Minimum unreleased commits since the last tag before a release is proposed (a feat/security change also qualifies).
`ROBOCO_RELEASE_MANAGER_INTERVAL_SECONDS`	`3600`	Seconds between release-readiness assessment passes.
`ROBOCO_RELEASE_GIT_NAME`	`RoboCo Release Manager`	Committer name on the release commit created by `ReleaseExecutor`.
`ROBOCO_RELEASE_GIT_EMAIL`	`release-manager@roboco.local`	Committer email on the release commit.
`ROBOCO_RELEASE_SIGN_COMMITS`	`false`	Set to `true` to GPG-sign the release commit. The executor only signs when this is explicitly enabled; the default is unsigned.

Organizational memory loop (default-off)

Variable	Default	Purpose
`ROBOCO_ORG_MEMORY_ENABLED`	`false`	Master switch for the org-memory loop. When off: legacy completion capture, no auto-inject, no playbook curation verbs.
`ROBOCO_ORG_MEMORY_TOP_K`	`3`	Max institutional-memory items injected into a briefing on claim.
`ROBOCO_ORG_MEMORY_MIN_SCORE`	`0.6`	Cosine-similarity floor for injected memory; below it, nothing is injected.

Sandboxed dev DB/Redis/Mongo — default off

Per-project opt-in (sandbox_services column, postgres/redis/mongo); see Sandboxed dev DB/Redis/Mongo.

Variable	Default	Purpose
`ROBOCO_SANDBOX_DB_ENABLED`	`false`	Master switch. When off, `request_sandbox` refuses every call and spawning is unaffected (the legacy prod-creds gate-env injection, itself gated by `ROBOCO_TOOLCHAIN_MATCH_ENABLED`, is what an opted-in project falls back to). Only projects with `sandbox_services` set participate even when on — and provisioning happens on-demand via the `request_sandbox` do-verb, not at spawn.

DB network isolation — default off (config) / on in all 3 tracked composes

Not a panel flag — it must travel with the compose networks: topology. See DB network isolation.

Variable	Default	Purpose
`ROBOCO_DB_NETWORK_ISOLATED`	`false` (config) / `true` (all 3 tracked composes)	True when postgres/redis sit on a data-only `roboco_data` network agent containers never join. Suppresses the legacy prod-creds gate-env injection (unreachable creds are worse than none).

Cloud auth — default off

Not a panel flag — changes authentication behavior, so it's environment-only. See Cloud auth.

Variable	Default	Purpose
`ROBOCO_CLOUD_AUTH_ENABLED`	`false`	Master switch. Off: `get_agent_context` behaves byte-for-byte as today (header-trust). On: a valid session cookie or agent HMAC token is required for the CEO role; a spoofed `ceo` header is rejected. Requires TLS — the cookie is secure-only.
`ROBOCO_CLOUD_AUTH_EMAIL`	(unset)	Email for the single seeded CEO login user. Required when the flag is on.
`ROBOCO_CLOUD_AUTH_PASSWORD`	(unset)	Password for the single seeded CEO login user. Hashed at startup; required when the flag is on.
`ROBOCO_CLOUD_AUTH_SECRET`	(unset — required when enabled)	Signs the session JWT. Startup fails loud if the flag is on and this is unset.
`ROBOCO_CLOUD_AUTH_COOKIE_MAX_AGE`	`2592000` (30 days)	Sliding session cookie lifetime in seconds — every authenticated request re-mints the cookie, so only genuine inactivity past this window logs out.

Fable + Ponytail doctrine — default off

Variable	Default	Notes
`ROBOCO_FABLE_MODE_ENABLED`	`false`	Composes the Fable (outcome-first communication) and Ponytail (build-lazy) doctrine layers into every spawned agent's prompt, plus guard hooks on the Claude runtime. Off: the spawn path is byte-for-byte unchanged.
`ROBOCO_PONYTAIL_INTENSITY`	`full`	Developer-ladder aggressiveness: `lite` / `full` / `ultra`. A string value, not a flag; only read when fable-mode is on. Non-developer roles ignore it.

Telegram notifications — default off

The bot token and chat id are entered in the collapsible under the Telegram notifications flag row in Settings → Feature Flags, Fernet-encrypted at rest — never set via environment. The Mini App's own switch is environment-only, like cloud auth itself, and requires ROBOCO_CLOUD_AUTH_ENABLED=true. See Telegram bridge.

Variable	Default	Purpose
`ROBOCO_TELEGRAM_ENABLED`	`false`	Master switch. Off: no Telegram API call is ever made. On (with credentials stored): sends one best-effort DM — subject plus a panel deep-link, never the body — on a CEO escalation, on task completion, and whenever any of the four held-draft queues — a release proposal, an X post, a video, or a roadmap review cycle — originates a new item.
`ROBOCO_TELEGRAM_INBOUND_ENABLED`	`false`	Sub-switch on top of the master switch. Off: the bot only sends the three DMs above, never polls, and the escalation DM and every held-draft-origination DM carry no buttons. On (with `ROBOCO_TELEGRAM_ENABLED` and credentials both set): polls for `/status`, `/queue`, `/task`, `/agents`, `/blocked`, `/usage`, `/secretary`, `/newtask`, and button taps, and the escalation DM and every held-draft-origination DM gain an Approve/Reject/Open row.
`ROBOCO_TELEGRAM_TIMEOUT_SECONDS`	`10.0`	Per-request timeout for the outbound Bot API `sendMessage` call.
`ROBOCO_TELEGRAM_POLL_INTERVAL_SECONDS`	`5.0`	Floor between `getUpdates` long-poll re-issues (each call itself blocks server-side up to the poll timeout below, so this isn't the effective latency).
`ROBOCO_TELEGRAM_POLL_TIMEOUT_SECONDS`	`25`	The `getUpdates` long-poll `timeout` param, in seconds.
`ROBOCO_TELEGRAM_MAX_UPDATES_PER_CYCLE`	`50`	Max inbound updates (messages + button taps) processed in one poll cycle.
`ROBOCO_TELEGRAM_PENDING_REPLY_TTL_SECONDS`	`300.0`	How long a "reply with your reason" prompt (e.g. after tapping Reject) stays live before it expires and you have to tap the button again.
`ROBOCO_TELEGRAM_MINIAPP_ENABLED`	`false`	Master switch for the Mini App (`POST /api/telegram/webapp-auth`), the `/tg` phone cockpit. Environment-only — not on the panel's Feature Flags card. Requires `ROBOCO_CLOUD_AUTH_ENABLED=true`; the orchestrator refuses to start if this is on without that.
`ROBOCO_TELEGRAM_INITDATA_MAX_AGE_SECONDS`	`600`	Max age, in seconds, of a Telegram-signed initData payload before Mini App sign-in refuses it as stale.

X (Twitter) engine — default off

Credentials (the 4 OAuth 1.0a secrets) are entered in Settings → X (Twitter) Credentials in the panel, Fernet-encrypted at rest — never set via environment. See X (Twitter) engine.

Variable	Default	Purpose
`ROBOCO_X_ENGINE_ENABLED`	`false`	Master switch. Off: no draft is ever originated and no X API call is made.
`ROBOCO_X_REPLIES_ENABLED`	`false`	Sub-switch for the mention-reply half specifically (needs a paid X API tier to read mentions). Off: only release-announcement posts draft, even with the master switch on.
`ROBOCO_X_MENTIONS_INTERVAL_SECONDS`	`1800`	Seconds between mentions-poll passes.
`ROBOCO_X_MENTIONS_MAX_PER_CYCLE`	`5`	Max held reply drafts the mentions poll may originate in one cycle.
`ROBOCO_X_MENTIONS_MIN_ENGAGEMENT`	`0`	Minimum combined like+reply+retweet count for a mention to count as worth replying to.
`ROBOCO_X_MAX_OPEN_POSTS`	`10`	Rolling cap on concurrently-open held posts/replies (both sources combined).
`ROBOCO_X_ACCOUNT_USER_ID`	(unset)	Numeric X user id of the account's own account. Empty resolves it once per mentions cycle via `GET /2/users/me`.
`ROBOCO_X_REQUEST_TIMEOUT_SECONDS`	`15.0`	Per-request timeout for outbound X API calls.
`ROBOCO_X_FEATURE_SPOTLIGHT_ENABLED`	`false`	A third, independent sub-switch: periodically spawns the Head of Marketing to investigate RoboCo's own shipped, under-publicized capabilities and draft a spotlight post about one. Off: the master switch above only ever drafts release posts and mention replies — this half never spawns an agent. Unlike those two (local-model-only), this is a real cloud-LLM spawn per cycle, so it's a deliberate, costlier opt-in.
`ROBOCO_X_FEATURE_SPOTLIGHT_INTERVAL_SECONDS`	`86400`	Base seconds between feature-spotlight exploration cycles. A quiet-week guard stretches the effective cadence to 3× this when nothing has shipped since the last spotlight, so it doesn't fire daily against a stale codebase.

Board Programs — default off, no master flag

See Board Programs. Unlike every other subsystem on this page, arming is entirely per-program on the Business → Programs panel tab (board_program.<key>.enabled in the settings store) — there is no ROBOCO_BOARD_PROGRAMS_ENABLED. The variable below is the only environment-level knob a new program reads; Roadmap and the X feature spotlight (ROBOCO_X_ENGINE_ENABLED + ROBOCO_X_FEATURE_SPOTLIGHT_ENABLED, in the X (Twitter) engine section above) additionally keep their own pre-registry flags as the default their Programs-tab switch falls back to.

Variable	Default	Purpose
`ROBOCO_PEST_REWORK_THRESHOLD`	`0.3`	7-day rework rate (0-1) above which the Pest Control program opens a cycle off-schedule, on top of its weekly cron.

Board roadmap engine — default off

Variable	Default	Purpose
`ROBOCO_ROADMAP_ENGINE_ENABLED`	`false`	Master switch. Off: no exploration cycle is originated and the Product Owner is never spawned for it. Even on, nothing auto-starts — approved items land in BACKLOG for normal PM activation. Doubles as the default for the `roadmap` program's switch on Business → Programs.
`ROBOCO_ROADMAP_INTERVAL_SECONDS`	`604800`	Seconds between roadmap-exploration cycles (default weekly).
`ROBOCO_ROADMAP_MIN_ITEMS_PER_CYCLE`	`3`	Minimum roadmap item drafts a themed cycle must propose.
`ROBOCO_ROADMAP_MAX_ITEMS_PER_CYCLE`	`7`	Maximum roadmap item drafts a themed cycle may propose.

Obsidian vault — default off

Not a panel flag — see Obsidian vault.

Variable	Default	Purpose
`ROBOCO_OBSIDIAN_VAULT_ENABLED`	`false`	Master switch. Off: no note is ever written, `python -m roboco.vault` refuses to run, and every event seam is a no-op.
`ROBOCO_VAULT_PATH`	`/data/vault`	Root directory the vault materializes into. Only consulted when the master flag is on.
`ROBOCO_VAULT_INTAKE_ENABLED`	`false`	Second switch for the `#roboco` inbox watcher; both this and the master flag must be on.
`ROBOCO_VAULT_INTAKE_INTERVAL_SECONDS`	`300`	Seconds between inbox scan cycles.
`ROBOCO_VAULT_INTAKE_DIR`	`RoboCo/Inbox`	Vault-relative folder scanned for `#roboco`-tagged notes.
`ROBOCO_VAULT_INTAKE_MAX_PER_CYCLE`	`3`	Max held drafts one scan cycle may originate.
`ROBOCO_VAULT_INTAKE_MAX_OPEN_DRAFTS`	`10`	Rolling cap on concurrently-open held vault-note drafts.
`ROBOCO_VAULT_ARCHIVE_DAYS`	`30`	Age (past terminal timestamp) at which a completed/cancelled task's note moves to `RoboCo/Archive/<year>/`. `0` disables archival.
`ROBOCO_VAULT_REPORT_ENABLED`	`true`	Materializes a weekly `RoboCo/Reports/<ISO-week>.md` org-report note (deterministic, no LLM) and notifies you. Needs the master vault flag on.
`ROBOCO_VAULT_KB_ENABLED`	`false`	Second switch: embeds your own note folders (default `RoboCo/Notes`) into a fleet-retrievable RAG corpus. Off: no note is ever embedded.
`ROBOCO_VAULT_KB_DIRS`	`RoboCo/Notes`	CSV of vault-relative folders scanned recursively for KB ingest. Rejected at startup if it overlaps the intake inbox or a reserved projection dir.
`ROBOCO_VAULT_KB_INTERVAL_SECONDS`	`900`	Seconds between vault-KB ingest scan cycles.

Video engine (HyperFrames) — default off

TikTok's OAuth2 secrets are entered in Settings → TikTok Credentials in the panel, Fernet-encrypted at rest — never set via environment. See Video engine.

Variable	Default	Purpose
`ROBOCO_VIDEO_ENGINE_ENABLED`	`false`	Master switch. Off: no video-authoring task is ever opened. Even on, distribution requires an explicit per-clip CEO approval.
`ROBOCO_VIDEO_ON_RELEASE`	`false`	Sub-switch: open an authoring task when a release publishes. Off even with the master switch on.
`ROBOCO_VIDEO_ON_SPOTLIGHT`	`false`	Sub-switch: open an authoring task when the CEO approves a feature-spotlight draft that requests one. Off even with the master switch on.
`ROBOCO_VIDEO_MAX_OPEN_POSTS`	`5`	Rolling cap on concurrently-open video tasks (authoring plus held post drafts combined).
`ROBOCO_VIDEO_RENDERER_BASE_URL`	`http://roboco-video-renderer:3001`	Base URL of the `video-renderer` sidecar.
`ROBOCO_VIDEO_OUTPUT_DIR`	`/data/video-renders`	Where rendered MP4s are written. Bind-mounted in all three compose files so renders survive container recreation.
`ROBOCO_VIDEO_RENDER_INTERVAL_SECONDS`	`120`	Seconds between render-loop passes.
`ROBOCO_VIDEO_RENDER_TIMEOUT_SECONDS`	`600`	Deadline for one render pass on the sidecar.
`ROBOCO_VIDEO_REQUEST_TIMEOUT_SECONDS`	`30`	Per-request timeout for outbound video-engine HTTP calls.

Object storage (MinIO) — default off

Landed in 0.19.0: config fields, the minio dependency, minio / minio-init compose services, and the write + serve paths. The orchestrator PUTs each render to MinIO after the local write (non-fatal on failure); the media route streams from MinIO when configured, falling back to FileResponse on a missing object or MinIO down. Empty endpoint = disabled and the existing FileResponse media-serve path is unchanged. See Deployment.

Variable	Default	Purpose
`ROBOCO_MINIO_ENDPOINT`	`` (empty)	MinIO endpoint, e.g. `http://roboco-minio:9000`. Empty = disabled (`FileResponse` fallback).
`ROBOCO_MINIO_ACCESS_KEY`	``	Access key. Required when endpoint is set.
`ROBOCO_MINIO_SECRET_KEY`	``	Secret key. Required when endpoint is set.
`ROBOCO_MINIO_BUCKET`	`roboco-video-renders`	Bucket for rendered videos. Created idempotently by `minio-init`.
`ROBOCO_MINIO_REGION`	`us-east-1`	MinIO region.

Production deploy — compose files, host mounts, secure mode, startup.
Optional capabilities — what each flag above turns on.
Settings panel — toggling flags from the UI instead of .env.

llms.txt