This is the canonical list of every ROBOCO_* setting. They are all read by a single Pydantic-Settings class (roboco/config.py), loaded from the process environment and .env, prefixed with ROBOCO_, and case-insensitive. Most have a working default; the few that don't, and the ones the orchestrator refuses to start without, are flagged below.
You rarely set most of these
For a working deploy you set the two required secrets, the host paths, and maybe a feature flag or two. The long tables here exist so that when you do need to tune a timeout or a window, you can find it. The defaults shown are RoboCo's config defaults; a few compose-only defaults differ and are called out.
A feature flag set in .env takes effect on the next backend restart. The env-gated subsystems can also be toggled from the panel's Settings → Feature Flags card, which persists to the settings store and overrides the env default; an unset toggle falls back to the env/config default. See the Optional capabilities section for what each subsystem does.
Required secrets
Variable
Default
Purpose
ROBOCO_ENCRYPTION_KEY
(empty — required)
Fernet key encrypting every per-project git token at rest. The orchestrator refuses to start without it (compose :? guard). Generate with python -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())'. Keep it stable — losing it makes stored tokens undecryptable.
ROBOCO_AGENT_AUTH_SECRET
(empty — required for compose)
HMAC secret signing the per-agent X-Agent-Token. Generate with python -c 'import secrets; print(secrets.token_hex(32))'.
Signs the session cookie's JWT. The orchestrator refuses to start if ROBOCO_CLOUD_AUTH_ENABLED=true and this is unset. Generate with python -c 'import secrets; print(secrets.token_hex(32))'. Irrelevant while cloud auth is off.
Security & auth
Variable
Default
Purpose
ROBOCO_AGENT_AUTH_REQUIRED
false
Fail-closed secure mode. When true, every API call must carry a valid token. Requires ROBOCO_PANEL_AGENT_TOKEN to keep the panel working. On a trusted LAN, leave false (header-trust mode).
ROBOCO_PANEL_AGENT_TOKEN
(empty)
The CEO token nginx injects as X-Agent-Token on /api and /ws in secure mode, so the panel works without the browser holding the signing secret. Generate with make panel-token.
Application & API server
Variable
Default
Purpose
ROBOCO_APP_VERSION
0.20.0
Reported app version.
ROBOCO_DEBUG
false
Debug mode.
ROBOCO_ENVIRONMENT
development
One of development / staging / production. Selects the JSON log renderer (prod) vs console renderer. The compose stack sets production.
ROBOCO_HOST
127.0.0.1
Bind address. Use 0.0.0.0 in containers.
ROBOCO_PORT
8000
API port.
ROBOCO_API_URL
(unset)
Override base URL for containerized agents (e.g. http://roboco-orchestrator:8000); otherwise built from host/port.
ROBOCO_CORS_ORIGINS
["http://localhost:3000","http://localhost:5173"]
Allowed CORS origins. The single-origin nginx setup means you rarely change this.
ROBOCO_CORS_ALLOW_CREDENTIALS
true
Whether CORS allows credentials.
ROBOCO_PUBLIC_BASE_URL
http://127.0.0.1:8000
Reachable base URL embedded in commit-trailer links — set to your LAN IP or domain so the links resolve.
Database
Variable
Default
Purpose
ROBOCO_DATABASE_HOST
localhost
Postgres host (roboco-postgres in compose).
ROBOCO_DATABASE_PORT
5432
Postgres port.
ROBOCO_DATABASE_USER
roboco
Postgres user.
ROBOCO_DATABASE_PASSWORD
roboco
Postgres password — change it for any real deployment.
ROBOCO_DATABASE_NAME
roboco
Database name.
ROBOCO_DATABASE_ECHO
false
Log every SQL statement.
ROBOCO_DATABASE_POOL_SIZE
10
Connection pool size.
ROBOCO_DATABASE_MAX_OVERFLOW
20
Extra connections beyond the pool.
ROBOCO_DATABASE_POOL_TIMEOUT
10
Seconds to wait for a pooled connection.
ROBOCO_DATABASE_POOL_RECYCLE
1800
Recycle a connection after this many seconds.
A daily pg_dump of this database runs automatically via an always-on sidecar — no flag, no env var here to set. See Backups.
Redis
Variable
Default
Purpose
ROBOCO_REDIS_HOST
localhost
Redis host (roboco-redis in compose).
ROBOCO_REDIS_PORT
6379
Redis port.
ROBOCO_REDIS_DB
0
Redis logical DB.
ROBOCO_REDIS_PASSWORD
(unset)
Optional Redis password.
RAG, embeddings & Ollama
Variable
Default
Purpose
ROBOCO_RAG_PERSIST_DIR
.roboco
Local RAG persistence dir.
ROBOCO_RAG_CHUNK_STRATEGY
fixed
One of fixed / semantic / hierarchical / contextual. fixed recommended; semantic loads an extra model.
ROBOCO_RAG_CHUNK_SIZE
512
Base chunk size.
ROBOCO_RAG_CHUNK_SIZE_DOCS
1536
Chunk size for docs.
ROBOCO_RAG_CHUNK_SIZE_JOURNALS
1024
Chunk size for journals/reflections.
ROBOCO_RAG_CHUNK_OVERLAP
128
Chunk overlap.
ROBOCO_RAG_AUTO_UPDATE_ENABLED
true
Whether the RAG index auto-refreshes.
ROBOCO_RAG_AUTO_UPDATE_INTERVAL
300
Seconds between auto-updates.
ROBOCO_ANTHROPIC_API_KEY
(unset)
Optional Anthropic key. Agents use the mounted Claude Code auth, not a metered key.
ROBOCO_DEFAULT_EMBEDDING_MODEL
qwen3-embedding:0.6b
Embedding model (1024-dim).
ROBOCO_EMBEDDING_DIMENSIONS
1024
Embedding dimensions — must match the model.
ROBOCO_LOCAL_LLM_MODEL
glm-5:cloud
Local LLM for RAG answer synthesis.
ROBOCO_LOCAL_LLM_BASE_URL
http://roboco-ollama:11434/v1
Ollama OpenAI-compatible endpoint.
ROBOCO_OLLAMA_BASE_URL
http://roboco-ollama:11434
Ollama native endpoint (embeddings, model management).
Workspaces & git timeouts
Variable
Default
Purpose
ROBOCO_WORKSPACES_ROOT
/data/workspaces
Root for all agent git clones.
ROBOCO_WORKSPACE_AUTO_CLONE
true
Auto-clone a repo on first workspace access.
ROBOCO_WORKSPACE_CLONE_TIMEOUT
300
Seconds for a git clone.
ROBOCO_WORKSPACE_REFRESH_FETCH_TIMEOUT_SECONDS
60
Timeout for the best-effort git fetch on re-entry into a healthy clone.
ROBOCO_WORKSPACE_INSTALL_DEV_DEPS
true
After cloning, install the project's dev dependencies into the workspace so make quality runs without re-downloading tooling.
ROBOCO_WORKSPACE_DEP_INSTALL_TIMEOUT_SECONDS
600
Timeout for that post-clone dependency install.
ROBOCO_GIT_COMMAND_TIMEOUT_SECONDS
30
Timeout for a single local git subprocess (status, log, checkout).
ROBOCO_GIT_COMMIT_TIMEOUT_SECONDS
180
Timeout for staging + committing a changeset.
ROBOCO_GIT_NETWORK_TIMEOUT_SECONDS
120
Timeout for git ops that talk to origin (fetch / pull / push).
ROBOCO_PROTECTED_GIT_URLS
(empty)
Repo URL substrings a project may not point at — blocks agent commits/merges from reaching a protected repo.
Agent images (spawn source)
Variable
Default
Purpose
ROBOCO_AGENT_IMAGE_REGISTRY
(empty)
Registry namespace for pre-built agent images (e.g. ghcr.io/rennf93). Empty = build locally. The registry compose wires this to ROBOCO_REGISTRY.
ROBOCO_AGENT_IMAGE_TAG
(empty)
Tag for pre-built agent images (e.g. 0.9.0). Empty = implicit :latest. The registry compose wires this to ROBOCO_VERSION.
Deploy-time variables (compose, not config.py)
A few variables are consumed by the compose files and host-mount wiring rather than by config.py: ROBOCO_REGISTRY, ROBOCO_VERSION, ROBOCO_DATA_DIR, ROBOCO_HOST_PROJECT_DIR, ROBOCO_HOST_CLAUDE_DIR / CLAUDE_AUTH_DIR, ROBOCO_HOST_DATA_DIR, ROBOCO_HOST_GROK_DIR, ROBOCO_HOST_CODEX_DIR, ROBOCO_HOST_GEMINI_DIR, ROBOCO_HOST_KIMI_DIR, and ROBOCO_BACKUP_MIRROR_DIR. They are documented in the production deploy reference and Backups.
Transcript retention
Variable
Default
Purpose
ROBOCO_TRANSCRIPT_RETENTION_DAYS
14
Days to keep agent Claude Code transcripts. A stored panel setting overrides this default.
ROBOCO_TRANSCRIPT_PRUNE_ENABLED
true
Whether the background sweep prunes old transcripts.
ROBOCO_TRANSCRIPT_PRUNE_INTERVAL_SECONDS
3600
Minimum seconds between prune passes.
Notifications
Variable
Default
Purpose
ROBOCO_NOTIFICATION_ACK_TTL_HOURS
48
Hours until an ack-required notification's deadline is stamped at creation. Past that deadline, still unacknowledged, it re-escalates one level up on the backoff schedule below. 0 disables stamping — the legacy behavior, where a notification never expires. Informational (non-ack-required) notifications never get a deadline regardless of this setting. See Notifications.
ROBOCO_NOTIFICATION_REESCALATION_BASE_SECONDS
3600
Base interval for the re-escalation backoff: the first re-escalation fires at expiry, each one after that doubles the wait from this base (1h, 2h, 4h, 8h, ...) capped at 24h between attempts — instead of re-firing every ~60s sweep tick forever.
ROBOCO_NOTIFICATION_MAX_REESCALATIONS
5
Hard cap on re-escalations per notification. Past this many attempts, a still-unacked notification is logged once as permanently-unacked and left alone for good.
Spawn pacing, SLAs & reaper windows
The orchestrator's dispatcher uses these to pace spawns, detect loops, and reclaim stuck work. Defaults are tuned for real LLM latency — raise the reaper windows (not lower) if long agent tasks are being reaped mid-work.
Variable
Default
Purpose
ROBOCO_AGENT_TOOL_CALL_WARN
100
Soft warning threshold for per-session tool calls.
ROBOCO_AGENT_TOOL_CALL_HALT
300
Hard cap on per-session tool calls; the orchestrator stops the container. Raised from 150 — that ceiling repeatedly halted legitimate multi-file work seconds after a real commit, burning a spawn and the resumed agent's re-verification turns.
ROBOCO_AGENT_LOOP_THRESHOLD
3
Identical tool+args repeats in the window that flag a loop.
ROBOCO_AGENT_LOOP_WINDOW
10
How many recent tool calls to inspect for loop detection.
ROBOCO_AGENT_STOP_ATTEMPT_ALLOWANCE
1
Stop-without-terminal attempts before auto-substitute.
ROBOCO_AGENT_SLA_DEVELOPER_IN_PROGRESS
7200
SLA (s) for a developer in in_progress.
ROBOCO_AGENT_SLA_DEVELOPER_VERIFYING
1800
SLA (s) for a developer in verifying.
ROBOCO_AGENT_SLA_QA_CLAIMED
1800
SLA (s) for QA on a claimed review.
ROBOCO_AGENT_SLA_DOCUMENTER_CLAIMED
3600
SLA (s) for a documenter on a claimed task.
ROBOCO_AGENT_SLA_CELL_PM_CLAIMED
14400
SLA (s) for a cell PM on a claimed task.
ROBOCO_CLAIM_STALE_SECONDS
180
Claim-heartbeat staleness used by the spawn trigger filter.
ROBOCO_STALE_CLAIM_REAP_SECONDS
600
Reaper-only stale-claim threshold before releasing a claim back to pending.
ROBOCO_PM_CLOSURE_RECENTLY_PAUSED_SECONDS
45
Debounce before respawning a PM to close a recently paused parent.
ROBOCO_GROK_IDLE_KILL_SECONDS
900
Idle-container kill threshold for Grok agents (they emit no SDK heartbeat).
ROBOCO_GROK_MAX_COST_USD
0.0
Per-agent Grok cost ceiling (USD) before kill; 0 disables.
ROBOCO_INTERACTIVE_IDLE_REAP_SECONDS
1800
Idle-reap threshold for live intake/secretary chats; 0 disables.
ROBOCO_CLAIMED_NO_AGENT_GRACE_SECONDS
120
Grace window before respawning/releasing a claimed task with no running agent.
ROBOCO_PM_DECISION_WINDOW_SECONDS
300
Recency window for a PM journal:decision to satisfy gating verbs.
ROBOCO_SPAWN_COOLDOWN_SECONDS
60
Per-task spawn-rate cooldown.
ROBOCO_ROLE_SPAWN_RATE_PER_MINUTE
6
Per-role spawn-rate limit per minute.
Gateway: manifests & tracing-gate minimums
Variable
Default
Purpose
ROBOCO_MANIFEST_HOST_DIR
/app/manifests
Orchestrator dir where per-agent tool manifests are written; must be a host-bind-mounted path so the daemon can mount each manifest into its agent.
ROBOCO_QA_NOTES_MIN_CHARS
80
Minimum characters for QA notes.
ROBOCO_DOCS_NOTES_MIN_CHARS
20
Minimum characters for docs notes.
ROBOCO_DEV_NOTES_MIN_CHARS
40
Minimum characters for a developer's dev_notes.
ROBOCO_PR_REVIEWER_NOTES_MIN_CHARS
40
Minimum characters for a PR reviewer's notes.
ROBOCO_QUICK_CONTEXT_MIN_CHARS
30
Minimum characters for a PM's quick_context resumption section.
ROBOCO_COMMIT_SUBJECT_MIN_CHARS
20
Minimum characters for a commit subject.
ROBOCO_COMMIT_BANNED_WORDS
wip,tmp,asdf,oops,fix,update,change,stuff,things
Banned single-word commit subjects.
Grok runtime
Only relevant if you run any agent on Grok. See the models section for the full runtime.
Variable
Default
Purpose
ROBOCO_HOST_GROK_DIR
/home/renzof/.grok (compose)
Host ~/.grok SuperGrok auth dir; mounted read-write into the orchestrator (token auto-refresh) and read-only into Grok agents. The same value is both the source and target path.
ROBOCO_GROK_AGENT_IMAGE
roboco-agent-grok:latest
Image the orchestrator spawns for Grok agents.
ROBOCO_GROK_CLI_MODEL
grok-build
Grok CLI model id.
ROBOCO_GROK_REASONING_EFFORT
(empty)
low/medium/high/xhigh/max for all Grok agents; empty keeps the model default.
ROBOCO_GROK_MAX_TURNS
200
Hard ceiling on agentic turns per Grok run (loop guard).
ROBOCO_GROK_IDLE_KILL_SECONDS
900
(see reaper table) Idle-kill window for a wedged Grok container.
ROBOCO_GROK_MAX_COST_USD
0.0
(see reaper table) Per-agent Grok cost ceiling.
Codex runtime
Only relevant if you run any agent on Codex. V1: delivery roles only, not Intake/Secretary. See the models section for the full runtime.
Variable
Default
Purpose
ROBOCO_HOST_CODEX_DIR
~/.codex
Host ~/.codex ChatGPT-subscription auth dir (from codex login), mounted read-only as a directory into each Codex agent.
ROBOCO_CODEX_CLI_MODEL
gpt-5.3-codex
Codex CLI model id — Codex has no reliable default, so this is always set explicitly.
ROBOCO_CODEX_OAUTH_CLIENT_ID
(unset — built-in default)
Override the OIDC client id used for the token-refresh grant, if the default is wrong for your account. A bad refresh never mutates auth.json — worst case is a parked provider.
Gemini runtime
Only relevant if you run any agent on Gemini. V1: delivery roles only, not Intake/Secretary. See the models section for the full runtime.
Variable
Default
Purpose
ROBOCO_HOST_GEMINI_DIR
~/.gemini
Host ~/.gemini OAuth login dir (from the interactive gemini login), mounted read-only; each container copies it into a writable local dir and refreshes its own copy in-process — no orchestrator refresh daemon needed.
ROBOCO_GEMINI_CLI_MODEL
gemini-2.5-pro
Gemini CLI model id — also accepts gemini-2.5-flash / gemini-2.5-flash-lite.
ROBOCO_GEMINI_MAX_TURNS
200
Hard ceiling on agentic turns per Gemini run (loop guard, Grok parity).
ROBOCO_GEMINI_RATE_LIMIT_RETRY_AFTER_SECONDS
60.0
Base park-and-retry delay after a quota/rate-limit exit.
ROBOCO_GEMINI_AUTH_RETRY_AFTER_SECONDS
60.0
Park-and-retry delay after a missing/invalid OAuth credential (entrypoint preflight failure).
Kimi runtime
Only relevant if you run any agent on Kimi. V1: delivery roles only, not Intake/Secretary. See the models section for the full runtime.
Variable
Default
Purpose
ROBOCO_HOST_KIMI_DIR
~/.kimi-code
Host ~/.kimi-code Kimi-subscription auth dir (from kimi login), mounted read-write and shared into every Kimi agent plus the orchestrator — Moonshot's refresh token rotates with only a short reuse grace, so every container redeems the same chain instead of an independent copy.
ROBOCO_KIMI_CLI_MODEL
kimi-code/k3
Kimi CLI model alias — also accepts kimi-code/kimi-for-coding (K2.7) as a cheaper lever.
These gate the env-toggled capabilities. Each is inert when off. See Optional capabilities.
Web research — default on
Variable
Default
Purpose
ROBOCO_RESEARCH_ENABLED
true
Master switch for web research. When false, the search MCP is not mounted into any agent.
ROBOCO_RESEARCH_PROVIDER
tavily
tavily / brave / exa / null.
ROBOCO_RESEARCH_API_KEY
(unset)
Provider key — server-side only, never reaches an agent. Unset = empty-result null provider.
ROBOCO_RESEARCH_MAX_RESULTS
5
Cap on results per search (1–20).
ROBOCO_RESEARCH_FETCH_MAX_CHARS
20000
Cap on extracted characters per fetch.
ROBOCO_RESEARCH_TIMEOUT_SECONDS
15.0
Per-request outbound timeout.
ROBOCO_RESEARCH_DAILY_QUOTA_PER_AGENT
50
Search+fetch calls per agent per UTC day.
GitHub repo provisioning — default on (inert without token/org)
Creating brand-new repos from an approved pitch is GitHub-only — see Pitch provisioning. This is distinct from a project's per-project Forge selection (GitHub, Gitea, or GitLab), which routes PR/CI/review operations against a repo that already exists — that part works on all three forges. See Choosing a forge.
Variable
Default
Purpose
ROBOCO_PROVISIONING_ENABLED
true
Master switch for pitch auto-provisioning. Inert with no token/org regardless.
ROBOCO_PROVISIONING_TOKEN
(empty)
GitHub PAT (repo + org admin) used to create repos — server-side only.
ROBOCO_PROVISIONING_ORG
(empty)
GitHub org where new repos are created.
ROBOCO_GITHUB_API_BASE_URL
https://api.github.com
Override for GitHub Enterprise — used both for provisioning and, per-project, whenever a project's Forge is set to GitHub / GitHub Enterprise. Gitea and GitLab need no equivalent variable: their API base is derived from the project's own Git URL host. See Choosing a forge.
ROBOCO_PROVISIONING_TIMEOUT_SECONDS
30.0
Per-request provisioning timeout.
ROBOCO_PROVISIONING_REPO_PRIVATE
true
Whether provisioned repos are private.
Architectural conventions — off (config) / on (compose)
Variable
Default
Purpose
ROBOCO_CONVENTIONS_ENABLED
false (config) / true (compose)
Master switch for the per-project conventions standard (scaffold, ambient injection, baseline constraints, gate enforcement). The compose orchestrator block defaults this on (left off in docker-compose.registry.yml); fully inert when off.
Toolchain matching — default off
Variable
Default
Purpose
ROBOCO_TOOLCHAIN_MATCH_ENABLED
false (config) / true (compose)
Provision the agent workspace with the target project's Python and block delivery gates when the suite can't run. The compose orchestrator block defaults this on.
Provider overload break — default on
Variable
Default
Purpose
ROBOCO_OVERLOAD_BREAK_ENABLED
true
Park a provider on a persistent overload (HTTP 529/500/503) the way a 429 is parked, instead of crash-retrying.
ROBOCO_GATEWAY_HEALTH_ENABLED
true
Probe a stale-heartbeat-but-live agent's gateway and kill + respawn it when the gateway is broken (a corrupted /app venv firing no verb), instead of the reaper protecting it forever. Off => spare live containers on verb-heartbeat liveness alone.
ROBOCO_GATEWAY_HEALTH_GRACE_SECONDS
180
How long an agent gateway may probe as broken before recovery — tolerates a transient probe miss.
ROBOCO_IMAGE_PRUNE_ENABLED
true
Background sweep prunes dangling (<none>) Docker images left by agent-image rebuilds, throttled ~6h. Only dangling images are removed — a tagged image or one backing a running container is never touched. Not a feature flag; disable to manage image cleanup yourself.
PR-gate turn cut — default on
Not a subsystem toggle — a delivery-flow behavior. See the merge model.
Variable
Default
Purpose
ROBOCO_PR_GATE_AUTO_SUBMIT_ENABLED
true
When every child of an assembled parent is terminal, run the PM's submit_up / submit_root to the in-path PR gate system-side (as the owning PM) instead of spawning the PM just to press submit — the submit's substance (freshness rebase, integrity check, PR open) is deterministic gate code. A gate rejection falls back to the classic PM closure spawn, and the PM keeps its judgment turns (merge, revision). Off => every closure spawns the PM to submit.
Strategy engine — default off
Variable
Default
Purpose
ROBOCO_STRATEGY_ENGINE_ENABLED
false
Master switch for the autonomous strategy engine (notify-only). When off the loop never runs.
ROBOCO_STRATEGY_ENGINE_INTERVAL_SECONDS
1800
Seconds between assessment passes.
ROBOCO_STRATEGY_STRANDED_BLOCKED_MINUTES
120
A task blocked longer than this is surfaced as stranded.
Possibilities matrix — default off
Variable
Default
Purpose
ROBOCO_POSSIBILITIES_MATRIX_ENABLED
false
Master switch for the i_am_done fast path. Off: every task follows the standard multi-turn plan/verify/submit flow regardless of how complete it looks. On: a task with commits, an open PR, full acceptance-criteria coverage, and no open findings can submit to QA in one call, with PR CI-green standing in for the local quality gate (falling back to the local gate + toolchain check when no CI signal exists). Conventions and findings enforcement are never skipped.
Task & project cost budgets — default off (config) / on in the NAS compose
Project monthly_budget_usd and task budget_usd are project/task fields set in the panel, independent of this flag; the flag decides whether either is ever consulted. See Task & project cost budgets.
Master switch. Off: neither cap is ever consulted regardless of field values. On: a work-starting claim is refused once a project's monthly spend cap is reached (review/doc/gate/inbound-PR claims are exempt), and a background sweep blocks an over-budget task (falling back to a per-TaskType default when budget_usd is null), notifying the CEO.
External / internal PR review — default off
Variable
Default
Purpose
ROBOCO_EXTERNAL_PR_ENABLED
false (config) / true (compose)
Master switch for inbound external/fork PR review. The compose orchestrator block defaults this on.
ROBOCO_EXTERNAL_PR_POLL_INTERVAL_SECONDS
300
Seconds between inbound external-PR discovery passes.
ROBOCO_EXTERNAL_PR_AUTHOR_ALLOWLIST
(empty)
GitHub usernames auto-trusted. Empty = every external PR needs human confirmation.
ROBOCO_EXTERNAL_PR_REQUIRE_HUMAN_CONFIRM
true
Require explicit human confirmation before any agent fetches/checks-out/executes external code.
ROBOCO_INTERNAL_PR_ENABLED
false
Also review org-repo (non-fork) PRs not tied to an active task.
Self-healing CI loop — default off
Variable
Default
Purpose
ROBOCO_SELF_HEAL_ENABLED
false
Master switch for the self-heal loop (detect + notify the CEO). When off the loop never runs.
ROBOCO_SELF_HEAL_PROJECT_SLUG
(empty) / roboco-api (compose)
The registered project that is RoboCo itself — the only repo the loop watches/originates into.
ROBOCO_SELF_HEAL_CI_WORKFLOW
ci.yml
GitHub Actions workflow file to scope the CI signal to.
ROBOCO_SELF_HEAL_ORIGINATE_ENABLED
false
Second opt-in: on a regression, also open a fix task and dispatch it to the Main PM automatically (no manual start). The loop never merges or deploys — the fix ships through the normal gates (QA, PR review, your merge).
ROBOCO_SELF_HEAL_INTERVAL_SECONDS
1800
Seconds between telemetry passes.
ROBOCO_SELF_HEAL_MAX_OPEN_TASKS
3
Rolling cap on concurrently-open self-heal tasks.
ROBOCO_SELF_HEAL_MAX_PER_CYCLE
1
Max self-heal tasks originated in one cycle.
Multi-repo CI-watch — default off
The global switch arms the engine; each project opts in via ci_watch_enabled (+ optional ci_watch_workflow) on its settings page.
Variable
Default
Purpose
ROBOCO_CI_WATCH_ENABLED
false
Master switch for watching opted-in projects' CI. When off the engine never runs and no CI telemetry is fetched.
ROBOCO_CI_WATCH_DEFAULT_WORKFLOW
ci.yml
Workflow file to scope the CI signal to when a project sets no ci_watch_workflow of its own.
ROBOCO_CI_WATCH_INTERVAL_SECONDS
1800
Seconds between CI-watch passes.
ROBOCO_CI_WATCH_MAX_OPEN_TASKS
3
Rolling cap on concurrently-open CI-watch fix tasks per repo.
ROBOCO_CI_WATCH_MAX_PER_CYCLE
1
Max CI-watch fix tasks opened in one cycle.
Dependency-update bot — default off
The global switch arms the engine; each project opts in via dep_update_command (+ optional dep_update_paths) on its settings page. Detection is read-only — the command runs in a throwaway clone and only the lockfiles are diffed; the real repo is never mutated.
Variable
Default
Purpose
ROBOCO_DEP_UPDATE_ENABLED
false
Master switch for the dependency-update bot. When off nothing runs and no throwaway clone is made.
ROBOCO_DEP_UPDATE_INTERVAL_SECONDS
604800
Seconds between dependency-update passes (default weekly).
ROBOCO_DEP_UPDATE_MAX_OPEN_TASKS
3
Rolling cap on concurrently-open update-dependencies tasks per repo.
ROBOCO_DEP_UPDATE_MAX_PER_CYCLE
1
Max update-dependencies tasks opened in one cycle.
Environment branches & EnvSync — default off
A project's environment ladder (an ordered list of {name, branch} rungs) is project configuration, set on its settings page — always available regardless of this flag. ROBOCO_ENV_SYNC_ENABLED only arms the automatic cascade between rungs. See Environment Branches & EnvSync.
Variable
Default
Purpose
ROBOCO_ENV_SYNC_ENABLED
false
Master switch for the ladder auto-cascade. Off: a project's ladder still resolves the PR-target branch and the release branch, but nothing syncs the middle rungs automatically. On: a periodic pass merges each rung down into the next; a clean merge auto-pushes, a conflict opens one sync PR + one coordination task and stops that project's cascade for the cycle. Never pushes to the last (release) rung.
ROBOCO_ENV_SYNC_INTERVAL_SECONDS
1800
Seconds between cascade passes.
ROBOCO_ENV_SYNC_MAX_OPEN_TASKS
3
Rolling cap on concurrently-open env-sync conflict tasks across all repos.
ROBOCO_ENV_SYNC_MAX_PER_CYCLE
1
Max projects cascaded in one cycle.
Docs-Sync — default off
No polling interval — triggered directly off the gated release manager's publish step, not a background loop. Requires the docs site itself to be registered as a RoboCo project with a git token. See Docs-Sync.
Variable
Default
Purpose
ROBOCO_DOCS_SYNC_ENABLED
false
Master switch. Off: publishing a release never opens a docs-update task. On: a publish checks the registered docs-site project for drift and, if found, opens one task that rides the normal delivery flow (dev → QA → PR-review gate → your merge); never auto-merges. With no docs-site project registered, it skips silently regardless of this flag.
ROBOCO_DOCS_SYNC_MAX_OPEN_TASKS
3
Rolling cap on concurrently-open docs-sync tasks.
ROBOCO_DOCS_SYNC_MAX_PER_CYCLE
1
Max docs-sync tasks opened per release publish.
HTTP security guard (fastapi-guard) — off (config) / active on the NAS compose
Not a panel flag — see HTTP security. The registry compose omits this whole trio and stays off.
Variable
Default
Purpose
ROBOCO_GUARD_ENABLED
false
Master switch. Off: create_app never mounts the middleware; the request path is byte-for-byte unchanged.
ROBOCO_GUARD_PASSIVE_MODE
true (config) / false (NAS compose)
true detects and logs only, never blocking. false actually blocks a matching request. The NAS compose flips this to enforce once passive-mode calibration reviewed clean.
ROBOCO_GUARD_FAIL_SECURE
true (config) / false (NAS compose)
What happens when a security check itself errors: true fails closed (blocks); the NAS compose relaxes this so a guard-internal bug can't 500 your own deploy.
ROBOCO_GUARD_EMERGENCY
false
Kill-switch: blocks every non-whitelisted IP, flippable without a redeploy during an active attack.
ROBOCO_GUARD_EMERGENCY_WHITELIST
(empty)
Comma-separated IPs exempted from the emergency lockdown above.
ROBOCO_GUARD_TELEMETRY_ENABLED
false
Reports security events/metrics to a guard-core platform via guard-agent. No data leaves the box while off.
ROBOCO_GUARD_AGENT_API_KEY
(empty)
guard-agent API key — required when telemetry is enabled.
ROBOCO_GUARD_PROJECT_ID
(empty)
guard-core project id — required when telemetry is enabled.
ROBOCO_GUARD_TRUSTED_CHAIN_PEERS
(empty)
Comma-separated exact IP address(es) — never a CIDR range — of a host-proxy hop (e.g. Tailscale Serve's docker-bridge gateway) in front of nginx, trusted to appear as a recorded proxy hop in X-Forwarded-For when resolving the real client behind it. Empty: only a loopback rightmost hop peels.
Gated release manager (default-off)
Variable
Default
Purpose
ROBOCO_RELEASE_MANAGER_ENABLED
false
Master switch for the gated release manager. When off the loop never runs and no release is proposed. Even on it only PROPOSES — the CEO approves before any publish.
ROBOCO_RELEASE_MIN_COMMITS
8
Minimum unreleased commits since the last tag before a release is proposed (a feat/security change also qualifies).
ROBOCO_RELEASE_MANAGER_INTERVAL_SECONDS
3600
Seconds between release-readiness assessment passes.
ROBOCO_RELEASE_GIT_NAME
RoboCo Release Manager
Committer name on the release commit created by ReleaseExecutor.
ROBOCO_RELEASE_GIT_EMAIL
release-manager@roboco.local
Committer email on the release commit.
ROBOCO_RELEASE_SIGN_COMMITS
false
Set to true to GPG-sign the release commit. The executor only signs when this is explicitly enabled; the default is unsigned.
Organizational memory loop (default-off)
Variable
Default
Purpose
ROBOCO_ORG_MEMORY_ENABLED
false
Master switch for the org-memory loop. When off: legacy completion capture, no auto-inject, no playbook curation verbs.
ROBOCO_ORG_MEMORY_TOP_K
3
Max institutional-memory items injected into a briefing on claim.
ROBOCO_ORG_MEMORY_MIN_SCORE
0.6
Cosine-similarity floor for injected memory; below it, nothing is injected.
Master switch. When off, request_sandbox refuses every call and spawning is unaffected (the legacy prod-creds gate-env injection, itself gated by ROBOCO_TOOLCHAIN_MATCH_ENABLED, is what an opted-in project falls back to). Only projects with sandbox_services set participate even when on — and provisioning happens on-demand via the request_sandbox do-verb, not at spawn.
DB network isolation — default off (config) / on in all 3 tracked composes
Not a panel flag — it must travel with the compose networks: topology. See DB network isolation.
Variable
Default
Purpose
ROBOCO_DB_NETWORK_ISOLATED
false (config) / true (all 3 tracked composes)
True when postgres/redis sit on a data-only roboco_data network agent containers never join. Suppresses the legacy prod-creds gate-env injection (unreachable creds are worse than none).
Cloud auth — default off
Not a panel flag — changes authentication behavior, so it's environment-only. See Cloud auth.
Variable
Default
Purpose
ROBOCO_CLOUD_AUTH_ENABLED
false
Master switch. Off: get_agent_context behaves byte-for-byte as today (header-trust). On: a valid session cookie or agent HMAC token is required for the CEO role; a spoofed ceo header is rejected. Requires TLS — the cookie is secure-only.
ROBOCO_CLOUD_AUTH_EMAIL
(unset)
Email for the single seeded CEO login user. Required when the flag is on.
ROBOCO_CLOUD_AUTH_PASSWORD
(unset)
Password for the single seeded CEO login user. Hashed at startup; required when the flag is on.
ROBOCO_CLOUD_AUTH_SECRET
(unset — required when enabled)
Signs the session JWT. Startup fails loud if the flag is on and this is unset.
ROBOCO_CLOUD_AUTH_COOKIE_MAX_AGE
2592000 (30 days)
Sliding session cookie lifetime in seconds — every authenticated request re-mints the cookie, so only genuine inactivity past this window logs out.
Fable + Ponytail doctrine — default off
Variable
Default
Notes
ROBOCO_FABLE_MODE_ENABLED
false
Composes the Fable (outcome-first communication) and Ponytail (build-lazy) doctrine layers into every spawned agent's prompt, plus guard hooks on the Claude runtime. Off: the spawn path is byte-for-byte unchanged.
ROBOCO_PONYTAIL_INTENSITY
full
Developer-ladder aggressiveness: lite / full / ultra. A string value, not a flag; only read when fable-mode is on. Non-developer roles ignore it.
Telegram notifications — default off
The bot token and chat id are entered in the collapsible under the Telegram notifications flag row in Settings → Feature Flags, Fernet-encrypted at rest — never set via environment. The Mini App's own switch is environment-only, like cloud auth itself, and requires ROBOCO_CLOUD_AUTH_ENABLED=true. See Telegram bridge.
Variable
Default
Purpose
ROBOCO_TELEGRAM_ENABLED
false
Master switch. Off: no Telegram API call is ever made. On (with credentials stored): sends one best-effort DM — subject plus a panel deep-link, never the body — on a CEO escalation, on task completion, and whenever any of the four held-draft queues — a release proposal, an X post, a video, or a roadmap review cycle — originates a new item.
ROBOCO_TELEGRAM_INBOUND_ENABLED
false
Sub-switch on top of the master switch. Off: the bot only sends the three DMs above, never polls, and the escalation DM and every held-draft-origination DM carry no buttons. On (with ROBOCO_TELEGRAM_ENABLED and credentials both set): polls for /status, /queue, /task, /agents, /blocked, /usage, /secretary, /newtask, and button taps, and the escalation DM and every held-draft-origination DM gain an Approve/Reject/Open row.
ROBOCO_TELEGRAM_TIMEOUT_SECONDS
10.0
Per-request timeout for the outbound Bot API sendMessage call.
ROBOCO_TELEGRAM_POLL_INTERVAL_SECONDS
5.0
Floor between getUpdates long-poll re-issues (each call itself blocks server-side up to the poll timeout below, so this isn't the effective latency).
ROBOCO_TELEGRAM_POLL_TIMEOUT_SECONDS
25
The getUpdates long-poll timeout param, in seconds.
ROBOCO_TELEGRAM_MAX_UPDATES_PER_CYCLE
50
Max inbound updates (messages + button taps) processed in one poll cycle.
ROBOCO_TELEGRAM_PENDING_REPLY_TTL_SECONDS
300.0
How long a "reply with your reason" prompt (e.g. after tapping Reject) stays live before it expires and you have to tap the button again.
ROBOCO_TELEGRAM_MINIAPP_ENABLED
false
Master switch for the Mini App (POST /api/telegram/webapp-auth), the /tg phone cockpit. Environment-only — not on the panel's Feature Flags card. Requires ROBOCO_CLOUD_AUTH_ENABLED=true; the orchestrator refuses to start if this is on without that.
ROBOCO_TELEGRAM_INITDATA_MAX_AGE_SECONDS
600
Max age, in seconds, of a Telegram-signed initData payload before Mini App sign-in refuses it as stale.
X (Twitter) engine — default off
Credentials (the 4 OAuth 1.0a secrets) are entered in Settings → X (Twitter) Credentials in the panel, Fernet-encrypted at rest — never set via environment. See X (Twitter) engine.
Variable
Default
Purpose
ROBOCO_X_ENGINE_ENABLED
false
Master switch. Off: no draft is ever originated and no X API call is made.
ROBOCO_X_REPLIES_ENABLED
false
Sub-switch for the mention-reply half specifically (needs a paid X API tier to read mentions). Off: only release-announcement posts draft, even with the master switch on.
ROBOCO_X_MENTIONS_INTERVAL_SECONDS
1800
Seconds between mentions-poll passes.
ROBOCO_X_MENTIONS_MAX_PER_CYCLE
5
Max held reply drafts the mentions poll may originate in one cycle.
ROBOCO_X_MENTIONS_MIN_ENGAGEMENT
0
Minimum combined like+reply+retweet count for a mention to count as worth replying to.
ROBOCO_X_MAX_OPEN_POSTS
10
Rolling cap on concurrently-open held posts/replies (both sources combined).
ROBOCO_X_ACCOUNT_USER_ID
(unset)
Numeric X user id of the account's own account. Empty resolves it once per mentions cycle via GET /2/users/me.
ROBOCO_X_REQUEST_TIMEOUT_SECONDS
15.0
Per-request timeout for outbound X API calls.
ROBOCO_X_FEATURE_SPOTLIGHT_ENABLED
false
A third, independent sub-switch: periodically spawns the Head of Marketing to investigate RoboCo's own shipped, under-publicized capabilities and draft a spotlight post about one. Off: the master switch above only ever drafts release posts and mention replies — this half never spawns an agent. Unlike those two (local-model-only), this is a real cloud-LLM spawn per cycle, so it's a deliberate, costlier opt-in.
ROBOCO_X_FEATURE_SPOTLIGHT_INTERVAL_SECONDS
86400
Base seconds between feature-spotlight exploration cycles. A quiet-week guard stretches the effective cadence to 3× this when nothing has shipped since the last spotlight, so it doesn't fire daily against a stale codebase.
Board Programs — default off, no master flag
See Board Programs. Unlike every other subsystem on this page, arming is entirely per-program on the Business → Programs panel tab (board_program.<key>.enabled in the settings store) — there is no ROBOCO_BOARD_PROGRAMS_ENABLED. The variable below is the only environment-level knob a new program reads; Roadmap and the X feature spotlight (ROBOCO_X_ENGINE_ENABLED + ROBOCO_X_FEATURE_SPOTLIGHT_ENABLED, in the X (Twitter) engine section above) additionally keep their own pre-registry flags as the default their Programs-tab switch falls back to.
Variable
Default
Purpose
ROBOCO_PEST_REWORK_THRESHOLD
0.3
7-day rework rate (0-1) above which the Pest Control program opens a cycle off-schedule, on top of its weekly cron.
Board roadmap engine — default off
Variable
Default
Purpose
ROBOCO_ROADMAP_ENGINE_ENABLED
false
Master switch. Off: no exploration cycle is originated and the Product Owner is never spawned for it. Even on, nothing auto-starts — approved items land in BACKLOG for normal PM activation. Doubles as the default for the roadmap program's switch on Business → Programs.
ROBOCO_ROADMAP_INTERVAL_SECONDS
604800
Seconds between roadmap-exploration cycles (default weekly).
ROBOCO_ROADMAP_MIN_ITEMS_PER_CYCLE
3
Minimum roadmap item drafts a themed cycle must propose.
ROBOCO_ROADMAP_MAX_ITEMS_PER_CYCLE
7
Maximum roadmap item drafts a themed cycle may propose.
Master switch. Off: no note is ever written, python -m roboco.vault refuses to run, and every event seam is a no-op.
ROBOCO_VAULT_PATH
/data/vault
Root directory the vault materializes into. Only consulted when the master flag is on.
ROBOCO_VAULT_INTAKE_ENABLED
false
Second switch for the #roboco inbox watcher; both this and the master flag must be on.
ROBOCO_VAULT_INTAKE_INTERVAL_SECONDS
300
Seconds between inbox scan cycles.
ROBOCO_VAULT_INTAKE_DIR
RoboCo/Inbox
Vault-relative folder scanned for #roboco-tagged notes.
ROBOCO_VAULT_INTAKE_MAX_PER_CYCLE
3
Max held drafts one scan cycle may originate.
ROBOCO_VAULT_INTAKE_MAX_OPEN_DRAFTS
10
Rolling cap on concurrently-open held vault-note drafts.
ROBOCO_VAULT_ARCHIVE_DAYS
30
Age (past terminal timestamp) at which a completed/cancelled task's note moves to RoboCo/Archive/<year>/. 0 disables archival.
ROBOCO_VAULT_REPORT_ENABLED
true
Materializes a weekly RoboCo/Reports/<ISO-week>.md org-report note (deterministic, no LLM) and notifies you. Needs the master vault flag on.
ROBOCO_VAULT_KB_ENABLED
false
Second switch: embeds your own note folders (default RoboCo/Notes) into a fleet-retrievable RAG corpus. Off: no note is ever embedded.
ROBOCO_VAULT_KB_DIRS
RoboCo/Notes
CSV of vault-relative folders scanned recursively for KB ingest. Rejected at startup if it overlaps the intake inbox or a reserved projection dir.
ROBOCO_VAULT_KB_INTERVAL_SECONDS
900
Seconds between vault-KB ingest scan cycles.
Video engine (HyperFrames) — default off
TikTok's OAuth2 secrets are entered in Settings → TikTok Credentials in the panel, Fernet-encrypted at rest — never set via environment. See Video engine.
Variable
Default
Purpose
ROBOCO_VIDEO_ENGINE_ENABLED
false
Master switch. Off: no video-authoring task is ever opened. Even on, distribution requires an explicit per-clip CEO approval.
ROBOCO_VIDEO_ON_RELEASE
false
Sub-switch: open an authoring task when a release publishes. Off even with the master switch on.
ROBOCO_VIDEO_ON_SPOTLIGHT
false
Sub-switch: open an authoring task when the CEO approves a feature-spotlight draft that requests one. Off even with the master switch on.
ROBOCO_VIDEO_MAX_OPEN_POSTS
5
Rolling cap on concurrently-open video tasks (authoring plus held post drafts combined).
ROBOCO_VIDEO_RENDERER_BASE_URL
http://roboco-video-renderer:3001
Base URL of the video-renderer sidecar.
ROBOCO_VIDEO_OUTPUT_DIR
/data/video-renders
Where rendered MP4s are written. Bind-mounted in all three compose files so renders survive container recreation.
ROBOCO_VIDEO_RENDER_INTERVAL_SECONDS
120
Seconds between render-loop passes.
ROBOCO_VIDEO_RENDER_TIMEOUT_SECONDS
600
Deadline for one render pass on the sidecar.
ROBOCO_VIDEO_REQUEST_TIMEOUT_SECONDS
30
Per-request timeout for outbound video-engine HTTP calls.
Object storage (MinIO) — default off
Landed in 0.19.0: config fields, the minio dependency, minio / minio-init compose services, and the write + serve paths. The orchestrator PUTs each render to MinIO after the local write (non-fatal on failure); the media route streams from MinIO when configured, falling back to FileResponse on a missing object or MinIO down. Empty endpoint = disabled and the existing FileResponse media-serve path is unchanged. See Deployment.
Variable
Default
Purpose
ROBOCO_MINIO_ENDPOINT
`` (empty)
MinIO endpoint, e.g. http://roboco-minio:9000. Empty = disabled (FileResponse fallback).
ROBOCO_MINIO_ACCESS_KEY
``
Access key. Required when endpoint is set.
ROBOCO_MINIO_SECRET_KEY
``
Secret key. Required when endpoint is set.
ROBOCO_MINIO_BUCKET
roboco-video-renders
Bucket for rendered videos. Created idempotently by minio-init.
ROBOCO_MINIO_REGION
us-east-1
MinIO region.
Next
Production deploy — compose files, host mounts, secure mode, startup.