Environment Variables

Generated by make docs-env from internal/config (266 variables). Do not edit; edit the Var beside the getter and regenerate.

Precedence, everywhere: a command-line flag beats the environment, the environment beats ~/.ailang/config.yaml, and the file beats the default. A getter in internal/config returns what the environment says (or the default); the command that owns a flag applies it above, and the package that owns a config-file section reads it below.

An empty Default means the variable is unset by default: the feature is off, or the value comes from the fallback the description names. The DEBUG_* compiler knobs are documented in Debugging, not here.

Cloud identity

Variable	Default	What it does
AILANG_CLOUD_PROJECT	—	GCP project this process acts on; first of AILANG_CLOUD_PROJECT, GOOGLE_CLOUD_PROJECT, pubsub.project_id in the config file, then the GCE metadata server. No default: unresolved is an error.
AILANG_CLOUD_REGION	europe-west1	Cloud region; falls through GOOGLE_CLOUD_REGION to a deprecated default that warns once and is refused under AILANG_STRICT_CONFIG=1.
AILANG_CONFIG	~/.ailang/config.yaml	Path of the user config file that Load parses; every section reader goes through it.
AILANG_NO_METADATA	—	Set to anything to skip the GCE metadata server when resolving the project (a laptop pays the 500ms timeout once per process otherwise).
AILANG_STRICT_CONFIG	0	1 or true makes every deprecated production default a hard error instead of a one-time warning — the v1.0.0 behaviour, rehearsable today.
GOOGLE_CLOUD_PROJECT	—	Project set by Cloud Run, GKE and App Engine; second source for CloudProject and, with OTLP_GOOGLE_CLOUD_PROJECT, the switch that enables Cloud Trace export.
GOOGLE_CLOUD_REGION	—	Region alias read after AILANG_CLOUD_REGION.
OTLP_GOOGLE_CLOUD_PROJECT	—	Project Cloud Trace export targets. Setting it (or GOOGLE_CLOUD_PROJECT) is what turns export on; the config file and metadata server are deliberately not consulted.

Storage plane

Variable	Default	What it does
AILANG_STORAGE	local	The one plane switch: local (SQLite under the state dir), gcp (Firestore in the cloud project) or hybrid (SQLite stores that join the shared Pub/Sub plane).
AILANG_STORAGE_COORDINATOR	—	local or gcp; moves the coordinator store alone.
AILANG_STORAGE_MESSAGING	—	local or gcp; moves the messaging store alone, reported as its Source.
AILANG_STORAGE_OBSERVATORY	—	local or gcp; moves the observatory store alone.
COORDINATOR_MODE	local	Coordinator execution mode, local (worktrees on this host) or cloud (Cloud Run Jobs fed by Pub/Sub push); cloud is refused unless the coordinator and messaging stores are in Firestore.

Compiler and runtime

Variable	Default	What it does
AILANG_DTREE	0	1 compiles match expressions through the experimental decision-tree compiler (no guards, no list/record/tuple patterns).
AILANG_DUMP_SMT	—	Set to anything to keep the SMT-LIB file handed to Z3 instead of deleting it.
AILANG_FS_MAX_BYTES	—	Cap on every FS read (a byte count or K/M/G/T-suffixed size); unset or 0 is unbounded, --fs-max-bytes overrides it, and a malformed value is an error. serve-api uses its upload cap instead.
AILANG_FS_SANDBOX	—	Directory the FS effect is confined to; empty means no sandbox.
AILANG_FS_SANDBOX_DEBUG	0	1 logs every sandbox rejection to stderr.
AILANG_HUB_URL	—	Collaboration-hub URL the metrics collector POSTs to; unset sends nothing.
AILANG_IFC_CORPUS	—	Path-list of source roots for the opt-in IFC function-value corpus diagnostic test; unset skips that test.
AILANG_MEMLIMIT	—	Go soft memory limit for run and serve-api: a size (256MB, 1GB) or the literal cgroup (the container's cgroup limit x 0.9); unset applies none, --max-memory overrides it, and a malformed value is an error. Best-effort GC tuning, not a hard bound.
AILANG_METRICS	0	1 collects pipeline phase timings and memory for each compile.
AILANG_METRICS_DEBUG	0	1 prints the raw phase-timing map to stderr.
AILANG_METRICS_VERBOSE	0	1 prints a metrics summary to stderr at the end of the run.
AILANG_NET_MAX_BYTES	—	Cap on each Net (std/net, std/web) HTTP response body, for run and serve-api (a positive byte count or K/M/G/T-suffixed size); unset keeps the 5 MB default, --net-max-bytes overrides it, and zero or a malformed value is an error. Over the cap fails with BodyTooLarge(<cap>) (httpRequest*) or E_NET_BODY_TOO_LARGE (httpGet/httpPost). The body is buffered whole in memory, so budget at least twice the cap per in-flight response.
AILANG_NO_CACHE	0	1 disables the compile cache for this run.
AILANG_NO_PRELUDE	0	1 starts the type checker with an empty instance environment instead of auto-importing std/prelude's Eq, Ord, Num and Show instances.
AILANG_NO_VERSION_WARNINGS	—	Set to anything to suppress the stdlib version-mismatch warning.
AILANG_QUIET_WARNINGS	—	Set by the CLI in JSON and quiet modes to suppress the stdlib version warning.
AILANG_RECORDS_V2	0	1 enables the records-v2 type-checker path.
AILANG_REDACT_ENV	on	off disables redaction of sensitive environment values in traces and errors.
AILANG_RELAX_MODULES	—	1, true or yes relaxes module checking, the same as --relax-modules; the flag and the variable are OR-ed.
AILANG_SEED	—	Integer seed for the effect runtime; when present, seeded mode may draw from Rand.
GOGC	—	Go's GC percent; when unset the run and exec commands raise it to 500 for a faster compile.
GOMEMLIMIT	—	Go's own soft memory limit, applied by the Go runtime itself; ailang only reports it (doctor memory). Prefer AILANG_MEMLIMIT, which also understands cgroup.
LANG	C	Locale the effect runtime reports.
TZ	UTC	Time zone the Clock effect reports.

Paths

Variable	Default	What it does
AILANG_BROWSER_PROFILE_DIR	—	Root for browser profiles used by the browser commands; unset derives one under the state dir.
AILANG_CACHE_DIR	—	Root of the compile cache (<dir>/compile) and the prompt cache; unset means <project>/.ailang/cache and $XDG_CACHE_HOME/ailang (else ~/.cache/ailang) respectively. Restricted run --policy honours non-empty overrides; empty/unset uses a private per-run temp directory outside fs_sandbox, removed after the worker exits (cold compilation). Operator directories are retained; inside-sandbox overrides warn about cache poisoning and fs_deny_write. An inside-sandbox TMPDIR is refused. trusted_host keeps normal defaults.
AILANG_EXAMPLES	—	Directory ailang examples reads instead of searching upward from the binary. Unset tries next to the binary, ~/.ailang/examples, the working directory (not when AILANG_AGENT_POLICY is set), then the corpus built into the binary.
AILANG_PACKAGE_ROOT	—	Read-only, operator-provisioned package root (<vendor>/<name>/<version>) for registry AND git packages. When set, resolution uses only this root, with no HOME cache fallback; never written or created. Set by the host, never the agent.
AILANG_PROJECT_ROOT	—	Root the embed engine resolves module paths against; must contain the requested module or Load fails.
AILANG_STATE_DIR	~/.ailang	Directory for every local store (SQLite databases, ledgers, locks). Read by internal/statedir itself — a stdlib-only leaf that cannot import this package — and registered here so the reference lists it.
AILANG_STDLIB_PATH	—	Path-list (OS separator) of stdlib directories; the first holding io.ail is the stdlib root for the whole process. Beats ./std and the installed copies; loses only to --stdlib-path. Set but holding no stdlib is an error. Unset falls through to ./std, <binary>/../std, the user data dir, system dirs, then the stdlib built into the binary.
AILANG_Z3_PATH	—	Path of the z3 binary, tried before PATH and the usual install locations.
APPDATA	—	Windows application-data base; the installed stdlib lives under it.
GOPATH	—	Go workspace; the eval harness looks for $GOPATH/bin/ailang after PATH and ./bin.
HOME	—	The user's home directory as the shell set it; used where a plist or a data-dir convention needs the literal value rather than os.UserHomeDir.
XDG_CACHE_HOME	—	XDG cache base; the prompt cache lives at $XDG_CACHE_HOME/ailang when AILANG_CACHE_DIR is unset.
XDG_DATA_HOME	—	XDG data base on Linux/BSD; the installed stdlib lives under it (else ~/.local/share).

Tracing

Variable	Default	What it does
AILANG_NO_TRACE	0	1 selects the off tier when AILANG_TRACE is unset.
AILANG_TRACE	standard	Tracing tier: off, standard or deep (~2x overhead); an unknown value is an error.
AILANG_TRACE_MAX_SPANS	500	Cap on spans kept per trace; a non-integer or negative value keeps the default.
AILANG_TRACE_RECORDING	0	1 records span names into the TraceRegistry at start-up.
AILANG_TRACE_VALUES	—	Value-recording mode when the --trace-values flag is empty; an unknown value is an error, never a widening.

Telemetry export

Variable	Default	What it does
AILANG_OBSERVATORY_WAL_CHECKPOINT_MB	1024	Observatory SQLite WAL size in MB that triggers a checkpoint; non-positive or malformed keeps the default.
AILANG_OTLP_INGEST_TOKEN	—	Shared secret the observatory's OTLP receiver requires from callers; empty disables ingest auth.
AILANG_PARENT_TASK_ID	—	Task id of the parent that spawned this ailang process; inherited by check, run and exec for hierarchy linking.
AILANG_SESSION_ID	—	Session id of this process, recorded on spans.
AILANG_SPAN_FILTER_ALLOW	—	Comma-separated span-name patterns the observatory keeps.
AILANG_SPAN_FILTER_DENY	—	Comma-separated span-name patterns the observatory drops.
AILANG_SPAN_FILTER_DISABLE	false	true disables the observatory's span filter entirely.
AILANG_TASK_ID	—	Coordinator task id of this process, recorded on spans for cross-trace correlation.
GEMINI_TELEMETRY_TARGET	—	Where the Gemini CLI sends telemetry; when unset an executor with a cloud project sets gcp.
GOOGLE_CLOUD_LOCATION	—	GCP location handed to executors (Vertex / managed agents); empty means the executor's own default.
OTEL_ENVIRONMENT	development	deployment.environment resource attribute.
OTEL_EXPORTER_OTLP_ENDPOINT	—	OTLP collector URL; setting it enables OTLP export, and executors default their children to http://localhost:1957 (the local observatory) when it is unset.
OTEL_EXPORTER_OTLP_METRICS_ENDPOINT	—	Per-signal override of the metrics endpoint; validated as a URL when OTLP export is on.
OTEL_EXPORTER_OTLP_PROTOCOL	—	OTLP transport (grpc, http/protobuf) passed through to executor children when set.
OTEL_EXPORTER_OTLP_TRACES_ENDPOINT	—	Per-signal override of the traces endpoint; validated as a URL when OTLP export is on.
OTEL_RESOURCE_ATTRIBUTES	—	Comma-separated key=value resource attributes merged into every span; executors extend it with task ids for their children.

Coordinator daemon

Variable	Default	What it does
AILANG_AGENT_CHECK_REPO_CONFIG	—	Path of the repo config coordinator agent check and agent set validate against when --repo-config is not given.
AILANG_APPROVAL_AUTHORITY_MODELS	fable,astra,opus	Comma-separated models allowed to rule on approvals.
AILANG_APPROVAL_BASE_URL	—	Public base URL for the secret-approval action links pushed to ntfy; unset skips the push.
AILANG_APPROVAL_CONTROLLER	0	1 grants an attended session approval authority.
AILANG_APPROVAL_POLICY	—	Approval policy override (evaluated, manual, ...); unset reads the coordinator config.
AILANG_APPROVAL_TIMEOUT	—	How long an approval request waits for a human, as a positive Go duration (e.g. 24h); unset serves the built-in wait as a deprecated default (D3).
AILANG_APPROVAL_TOKEN	—	Shared-secret bearer for secret-approval create/poll: the client sends it in place of a minted Google ID token, and the dashboard accepts it when set to the same value there.
AILANG_APPROVAL_URL	—	Service that serves /api/approvals (the dashboard), which secret() on the shared storage plane POSTs approval requests to; falls back to AILANG_COORDINATOR_URL, and unset leaves secret() un-gated as a deprecated default (D3).
AILANG_BACKSTOP_SWEEP	report	Backstop sweep mode: dispatch runs stranded work, off disables the sweep, report (and any other value) only reports.
AILANG_BUDGET_UNLIMITED	0	1 acknowledges that a task may run with NO spend cap when no budget resolves; unset serves that as a deprecated default (D3), refused under AILANG_STRICT_CONFIG=1.
AILANG_CLAUDE_CREDIT_GATEWAY_URL	—	Authenticated HTTPS origin for coordinator credits confirm/status/enable/disable/promote; default for --gateway, with Google ID-token authentication.
AILANG_CONFIG_BUCKET	—	GCS bucket holding the fleet's config.yaml; unset derives <project>-ailang-config from CloudProject.
AILANG_CONFIG_OBJECT	config.yaml	Object name of the fleet config inside AILANG_CONFIG_BUCKET.
AILANG_COORDINATOR_SERVICE	ailang-coordinator	Cloud Run service name coordinator config roll restarts.
AILANG_COORDINATOR_URL	—	Compatibility fallback for AILANG_APPROVAL_URL.
AILANG_COORD_HTTP_PORT	—	Port the coordinator's HTTP API is on, for commands that must reach a running daemon; falls back to PORT.
AILANG_DEFAULT_PROVIDER	—	Provider a task is attributed to for budgeting when neither the task nor its agent names one; unset serves claude as a deprecated default (D3).
AILANG_FEEDBACK_GATE_DRY_RUN	—	1, true, yes or on forces the feedback gate into dry-run.
AILANG_FEEDBACK_GATE_MODE	—	Overrides the feedback gate's configured mode (operator kill-switch).
AILANG_FEEDBACK_GATE_SHADOW	—	off | openrouter | direct: runs a System One decision model (sunholo/decisions, TypeSafe Jev) beside the feedback-gate classifier and records both verdicts in the audit row; never changes the action. Enabling it sends the submission body to TypeSafe — the operator's data-boundary ruling. Overrides coordinator.feedback_gate.shadow.
AILANG_KMS_KEY	—	Cloud KMS key resource that encrypts stored secrets and decrypts an ENC:-prefixed ANTHROPIC_API_KEY; unset means plaintext passthrough.
AILANG_MESSAGES_PROJECT	—	Pins the messaging store's Firestore project without moving anything else to the cloud project.
AILANG_REPO_URL	—	Repository URL for task worktrees when the task's workspace does not name one.
AILANG_TOKEN_SECRET	—	HMAC secret for approval tokens; unset generates one per process.
AILANG_WORKSPACE	—	Workspace a cloud process partitions its data under: the daemon's broadcast events and the execute-job's completion; unset serves default as a deprecated default (D3), refused under AILANG_STRICT_CONFIG=1.
COORDINATOR_API_KEY	—	Shared secret for the coordinator's HTTP API and the dashboard's WebSocket; the daemon rejects every request while it is unset (fail-closed since S3 M5) and ailang coordinator commands discover it from here first.
COORDINATOR_BIND_ADDR	—	Host the daemon's HTTP server binds; unset is 127.0.0.1 locally and 0.0.0.0 in cloud mode.
GITHUB_WEBHOOK_SECRET	—	HMAC secret for the /github/webhook route; unset means the route is not served.
PORT	—	Cloud Run's port convention: when set, the daemon starts its HTTP server on it, ailang server and ailang serve-api bind 0.0.0.0 instead of 127.0.0.1 (DefaultBindHost; --bind overrides), and the registry validator listens on it (default 8080 there).
RESIDENT_LIFECYCLE_ALLOWED_CALLERS	—	Comma-separated principals allowed to call the lifecycle routes; unset means nobody.
RESIDENT_LIFECYCLE_AUDIENCE	—	ID-token audience the lifecycle routes verify; unset means nobody may call them.
RESIDENT_LIFECYCLE_PROJECT	—	Project of the resident Cloud Run instances the lifecycle routes start and stop.
RESIDENT_LIFECYCLE_REGION	—	Region of the resident instances.

Cloud Run job (execute-job)

Variable	Default	What it does
AILANG_ACKNOWLEDGE_ONLY	false	Exactly true declares the task acknowledge-only (no file changes expected); anything else means changes were expected, so an older dispatcher fails loud rather than lenient.
AILANG_AGENT_ID	—	Agent the job runs as; recorded on spans and completions.
AILANG_AGENT_POLICY	—	Materialised program-policy PATH the ailang_only lane's tools (ailang_run, ailang_cli, ailang_read/write/edit via ailang policy-tool) are gated by; exported by the launcher, never set by the model. Unset = the tools refuse (default-deny). policy-tool pins it on every CLI child; set, ailang examples ignores working-directory examples/ dirs.
AILANG_AGENT_POLICY_TOML	—	Program policy (agent-policy.toml CONTENT) an ailang_only job's ailang_run is gated by; materialised read-only by execute-job. Unset = ailang_run refuses (default-deny).
AILANG_APPROVER_IDENTITY	—	Expected non-author GitHub login.
AILANG_APPROVER_SECRET	—	Secret Manager name holding the non-author token; never token material.
AILANG_ARTIFACT_PATTERNS	—	Newline-separated path patterns the dispatcher declared as the task's artifacts; the auto-merge scope guard.
AILANG_AUTO_MERGE	0	1 lets the job enable native auto-merge on scoped PRs; code requires a separate opt-in.
AILANG_AUTO_MERGE_CODE	0	1 opts in to scoped code auto-merge with required checks and a non-author approver.
AILANG_AUTO_MERGE_REQUIRED_CHECKS	—	Newline-separated check names required by the target ruleset and verified on base HEAD.
AILANG_BRANCH	dev	Branch the job clones and branches from.
AILANG_BRIEF_ID	—	Brief id appended to the structured commit subject when AILANG_SITE_SLUG is set.
AILANG_CASCADE_CHANGE_CLASS	—	Change class of the cascade (A content-only, B additive, ...); decides whether the deterministic path applies.
AILANG_CASCADE_ROOT_PACKAGE	—	Root package of a package cascade; when set the job tries the deterministic bump first and the PR is labelled and titled as a cascade.
AILANG_CASCADE_TO_VERSION	—	Version the cascade bumps the dependency to.
AILANG_CLAUDE_CREDIT_ACCOUNT	—	Explicit guarded Claude API-credit lane; anthropic-api-credits requires a gateway capability, HTTPS origin, pinned Haiku 5.5 and finite positive task budget at most $2.
AILANG_DIRECTIVE	—	Inline task directive; read only when AILANG_DIRECTIVE_SOURCE is unset (a coordinator older than the Firestore hand-off). Cloud Run caps it at 32,768 bytes.
AILANG_DIRECTIVE_SOURCE	—	Where the job reads its directive: "firestore" = task_directives/<AILANG_TASK_ID>, and a missing document fails the task. Unset = AILANG_DIRECTIVE.
AILANG_GIT_AUTHOR_EMAIL	—	git user.email for the job's commits; see AILANG_GIT_AUTHOR_NAME.
AILANG_GIT_AUTHOR_NAME	—	git user.name for the job's commits; applied only together with AILANG_GIT_AUTHOR_EMAIL, since a half-configured identity is worse than the container default.
AILANG_GIT_MODE	—	Git mode the executor's children run under; unset, the job exports guardrails before starting the executor.
AILANG_IDLE_TIMEOUT	—	Max silence BETWEEN executor output events as a Go duration, distinct from the wall-clock ceiling; unset means the executor default (3m). Set by the dispatcher from the agent's idle_timeout — before 2026-09-22 it did not travel, so every cloud task ran at 3m whatever the registry declared.
AILANG_IMAGE_PROVIDER	—	Which provider image the job believes it runs in; verified against AILANG_PROVIDER and printed by preflight diagnostics.
AILANG_JOB_MODE	—	What execute-job does: unset runs the agent on the task; shadow_grade runs the mechanical grade of a shadow comparison (AILANG gates only, under the agent's policy, no agent, no push) and writes the result to Firestore.
AILANG_MAX_COST_USD	—	Per-task cost budget in USD; the guarded Claude credit lane rejects unset/malformed/nonpositive budgets and caps tasks at $2; legacy lanes log and ignore malformed values.
AILANG_MERGE_STARTS	—	Comma-separated agents that approving this task hands off to; the PR says merging starts them.
AILANG_MODEL	—	Model the executor runs; there is no default (an empty value fails at the point of use), and it names the commit co-author.
AILANG_PLUGIN_REPO	—	Repository of shared skills cloned into the job's plugin directory.
AILANG_PROVIDER	—	Provider the dispatcher requested for the task; deliberately not defaulted, the job resolves and verifies it against the image.
AILANG_PR_LABELS	—	Comma-separated labels the job adds to its PR besides agent-task (the agent's needs-*-approval label).
AILANG_PUSH_BRANCH	—	Branch the job commits to and pushes directly (skip_approval agents); set, it also replaces the clone branch.
AILANG_SHADOW_PARENT	—	The primary task whose shadow comparison a shadow_grade job grades.
AILANG_SHADOW_PHASE	mechanical	Which shadow_grade phase the job runs: mechanical (AILANG gates on each diff), merged_tests (the merged PR's *_test.ail files on each diff) or review (the off-Anthropic reviewer, model from AILANG_MODEL, capped by AILANG_MAX_COST_USD).
AILANG_SITE_SLUG	—	Site slug that turns the job's commit into a structured Build: <slug> message.
AILANG_SSH_HOST_ALIAS	agent-repo	SSH host alias the deploy key is installed under.
AILANG_SSH_KEY_SECRET	—	Secret Manager secret NAME holding a deploy key (never the key itself); set means the job installs it.
AILANG_SUBDIRECTORY	—	Monorepo subdirectory the executor is scoped to, relative to the clone.
AILANG_TASK_INPUTS	—	JSON task inputs fetched by the cloud job parent before the executor; malformed values fail the task.
AILANG_TASK_SHADOW	false	Exactly true marks a shadow run (M-AILANG-LANE-EXECUTOR-SHADOW): the job keeps its diff and artifacts but skips the deploy-key preflight, the push and the PR, and gives the agent no git credential.
AILANG_TASK_TITLE	—	Human-written task title used as the message subject; unset derives one from the directive.
AILANG_TIMEOUT	—	Executor wall-clock as a Go duration; unset means the coordinator's default task timeout (2h).
AILANG_TOOL_POLICY	—	Tool-policy profile for the executor (full | ailang_only | canonical list); unset = the CLI's own defaults. Banked as tool_policy on the row.
CLOUD_RUN_EXECUTION	—	Cloud Run execution identity supplied by the runtime; required for exclusive subscription credential ownership.

Dashboard server

Variable	Default	What it does
AILANG_APPROVAL_ALLOWED_CALLERS	—	Comma-separated service-account emails whose Google-signed ID tokens may create and poll secret approvals (POST /api/approvals, GET /api/approvals/<id>); unset admits no ID token.
AILANG_APPROVAL_AUDIENCE	—	Comma-separated audiences an approval caller's ID token may carry; unset uses AILANG_APPROVAL_BASE_URL.
AILANG_APPROVAL_INTAKE_AUTH	enforce	enforce (default) requires an ID token or AILANG_APPROVAL_TOKEN on secret-approval create/poll; off admits anonymous callers (rollback lever, logged loudly). Any other value enforces.
AILANG_APPROVAL_SIGNING_KEY	—	HMAC key that signs the secret-approval action links, so ntfy buttons can POST without IAM; unset disables those endpoints.
AILANG_DASHBOARD_URL	—	Dashboard base URL for commands that print or open links, after the --dashboard flag.
AILANG_FIREBASE_PROJECT	—	Firebase / Firestore project for the dashboard's auth, workspaces and access control when --firebase-project is not given.
AILANG_HUB_TOKEN	—	Bearer token the hub's /api/hooks/* routes require; unset leaves them open (local use).
BENCHMARKS_BUCKET	ailang-multivac-dev-benchmarks	GCS bucket the benchmarks API reads through.

Executors

Variable	Default	What it does
AILANG_AUTH_MODE	—	apikey makes the claude executor use ANTHROPIC_API_KEY (billed); anything else writes the OAuth credentials file from CLAUDE_CODE_OAUTH_TOKEN (subscription).
AILANG_CHILD_GIT_CREDENTIALS	repo	How a cloud job gives the agent child git credentials: repo = a per-task 0600 credential file outside the workspace, scoped by URL to the task's repository (the parent still pushes); none = nothing (the child cannot authenticate git at all). The fleet token never enters the child's environment either way.
AILANG_EXECUTOR	—	Executor name that overrides the config file's default_executor.
AILANG_EXECUTOR_ENV_INHERIT	—	Comma-separated variable names an agent child may inherit beyond its default-deny profile (M-EXECUTOR-ENV-HARDENING), credentials included; an operator grant, never read from a task. The rollback lever when a lane needs a variable the profile drops.
AILANG_MOTOKO_AGENT_SYSTEM_FILE	—	File whose content becomes motoko's system-role prompt for an A/B, keeping the teaching in the user message.
AILANG_MOTOKO_SYSTEM_ROLE	1	0 stops motoko receiving the teaching prompt in the system role (the default sends it there; reverting to gated is a known regression).
CLAUDE_CONFIG_DIR	—	Claude Code's config dir; when set the executor also writes credentials there (never under /artifacts). The cloud job sets it to a local per-task dir whose projects/ links to the artifacts bucket.
MOTOKO_REPO	—	motoko_agent checkout whose .motoko/logfile holds session JSONL; MOTOKO.md says which one evals use.

Provider credentials

Variable	Default	What it does
AILANG_CODEX_AUTH_SECRET	—	Secret Manager secret holding a ChatGPT-subscription codex auth.json. Cloud codex jobs install it as ~/.codex/auth.json (subscription billing) and write refreshed tokens back as a new version; without it and without AILANG_AUTH_MODE=apikey the job fails loudly.
ANTHROPIC_API_KEY	—	Anthropic API key (METERED); the in-process client resolves it first, and the claude executor requires it under AILANG_AUTH_MODE=apikey and decrypts an ENC:-prefixed value with AILANG_KMS_KEY.
ANTHROPIC_AUTH_TOKEN	—	Anthropic OAuth access token from a Claude subscription profile (SUBSCRIPTION QUOTA); the in-process client resolves it after ANTHROPIC_API_KEY, matching the official SDKs.
ANTHROPIC_BASE_URL	—	Claude Messages API origin; the guarded credit lane requires the authenticated HTTPS budget gateway and refuses alternate provider routes.
CLAUDE_CODE_OAUTH_TOKEN	—	Claude Code subscription token: a raw claude setup-token token (sk-ant-oat…) held by ONE consumer, the cloud executors or the local mission loops, never both, so no other session can rotate it; or a legacy JSON credential blob, whose embedded refresh token dies when any other session rotates it. The claude executor passes a setup-token to the child in this variable and writes a blob to the credentials file. The in-process client resolves either third; the mission loop's Anthropic quota reader tries it after the login credential, since a setup-token cannot read usage (an empty-but-set value deliberately bypasses the keychain).
GEMINI_AGENTS_API_KEY	—	Gemini Developer API key for the gemini_agents executor (METERED, capped by the AI Studio project spend cap). SA-bound and restricted to generativelanguage in the locked ailang-gemini-agents project (scripts/security/setup_gemini_agents_project.sh); the Developer API refuses service-account OAuth, so a key is the only route.
GEMINI_API_KEY	—	Gemini API key the factory falls back to when GOOGLE_API_KEY is unset, Vertex ADC is unavailable and no key was given.
GITHUB_TOKEN	—	GitHub token for PR creation, docs search and read-only API calls; falls back to gh auth token where a command can shell out.
GOOGLE_API_KEY	—	Google API key: the Gemini provider's credential variable and the Gemini embedder's key.
OLLAMA_API_KEY	—	Ollama Cloud API key; the mission admission policy observes quota with it.
OPENAI_API_KEY	—	OpenAI API key (METERED); a cloud codex job bootstraps an api-key auth.json from it ONLY under AILANG_AUTH_MODE=apikey.
OPENROUTER_API_KEY	—	OpenRouter API key; required by motoko smoke runs and the OpenRouter quota observer.
OPENROUTER_API_KEY_SHADOW	—	OpenRouter key for shadow runs only (M-AILANG-LANE-EXECUTOR-SHADOW D7), with its own monthly cap: a shadow job puts it in OPENROUTER_API_KEY before the agent starts, and refuses to run without it rather than spend the fleet's key.
TYPESAFE_API_KEY	—	TypeSafe direct API key (System One decision model, Jev): read by the sunholo/decisions package's TypeSafeDirect transport via std/env; the OpenRouter transport uses OPENROUTER_API_KEY instead. No Go code reads it — the row exists so the variable is documented and gated like every other provider key.

AI clients

Variable	Default	What it does
AILANG_AI_HTTP_LOG	—	Path the OpenAI-compatible clients append their raw HTTP wire log to; unset falls back to the ai-http-log sentinel file under the state dir, and no sentinel means logging off.
AILANG_AI_KEY_FILE	—	Path to a file holding the API key for the --ai model's provider, read once on the first AI effect in run (eagerly for service setup) and never echoed (same as ailang run --ai-key-file, which wins); the file's contents replace the provider's key variable.
AILANG_AI_NO_ADC	—	Set to 1 to disable the Google provider's Application Default Credentials lane: a missing GOOGLE_API_KEY/GEMINI_API_KEY becomes a hard AuthFailed error instead of silently billing the gcloud project (same as ailang run --ai-no-adc).
AILANG_OPENROUTER_PROVIDER	—	JSON object merged into the OpenRouter provider routing block of every request, over the model registry's openrouter_provider and any caller routing policy ("ignore" lists are unioned). For experiments, e.g. '{"sort":"throughput"}'; a value that is not a JSON object fails the request.
BROWSERBASE_API_KEY	—	Browserbase API key for browser eval sessions when the benchmark's browser config does not name another variable (read through Raw, since the name is configurable).
BROWSERBASE_PROJECT_ID	—	Browserbase project id for browser eval sessions; same rule as the API key.
LYCEUM_BASE_URL	https://api.lyceum.technology/openai/v1	Overrides the Lyceum OpenAI-compatible endpoint, for tests and proxies.
OPENAI_BASE_URL	—	Base URL for the OpenAI provider when the caller gives none; set alone it allows an unauthenticated custom endpoint.
OPENROUTER_CATEGORIES	—	X-OpenRouter-Categories header sent to OpenRouter; same precedence as the referer.
OPENROUTER_HTTP_REFERER	—	HTTP-Referer attribution header sent to OpenRouter; unset uses the built-in default, and a per-request Attribution overrides both.
OPENROUTER_SESSION_ID	—	x-session-id sent on every OpenRouter request, so OpenRouter keeps one conversation on one upstream host (warm prompt cache, consistent model behaviour); unset uses one id per process. Executors set it to their session id.
OPENROUTER_X_TITLE	—	X-Title attribution header sent to OpenRouter; same precedence as the referer.
ZAI_BASE_URL	https://api.z.ai/api/paas/v4	Overrides z.ai's PAYG OpenAI-compatible endpoint, for tests and proxies; pointing it at the coding-plan endpoint is a usage-policy violation.

Ollama

Variable	Default	What it does
AILANG_OLLAMA_HTTP_TIMEOUT_SEC	—	Total budget for one /v1 call in seconds, with two meanings: buffered (flag off) it is the HTTP client timeout, default 300, where 0 or negative means no timeout; streaming (flag on) it is the mandatory hard deadline, default 3600, where 0, negative or unparseable is rejected at client construction.
AILANG_OLLAMA_IDLE_TIMEOUT_SEC	120	Streaming only: max silence between bytes in seconds before the typed idle-timeout trips; non-positive or malformed keeps the default.
AILANG_OLLAMA_LOG_REQUESTS	—	JSONL path each logical request (and every streaming stream_metrics record) is appended to; unset falls back to the ollama-log-requests sentinel file under the state dir, whose contents are the path.
AILANG_OLLAMA_MAX_TOKENS	—	Output budget for the agentic path; a positive integer overrides both the request's value and the built-in floor.
AILANG_OLLAMA_NATIVE_TOOLS	0	1 forces tool-calling turns down the legacy native /api/chat path instead of /v1.
AILANG_OLLAMA_NUM_CTX	—	Pins ollama's num_ctx on the non-tool paths; unset sends none so ollama sizes the context from the model. Raise or lower only for VRAM.
AILANG_OLLAMA_TEMPERATURE	—	Sampling temperature for the agentic path when the request sets none; a value that is not a float > 0 sends no temperature, leaving the model default.
AILANG_OLLAMA_TTFT_TIMEOUT_SEC	600	Streaming only: max silence before the first byte in seconds (long on purpose: a cold 35B load takes minutes); non-positive or malformed keeps the default.
AILANG_OLLAMA_V1_STREAM	0	Exactly 1 opts the tool-calling /v1 path into streaming with the three watchdog windows; anything else keeps the buffered path with byte-identical requests.
OLLAMA_HOST	—	Ollama server every client in the process talks to; set, it wins even over an explicit endpoint option, and unset means http://127.0.0.1:11434 (IPv4-pinned so the harness cannot reach an uncapped listener over ::1).

Embeddings

Variable	Default	What it does
AILANG_EMBED_GEMINI_MODEL	—	Gemini embedding model over the config file; unset serves text-embedding-004 as a deprecated default (768 dimensions).
AILANG_EMBED_OPENAI_MODEL	—	OpenAI embedding model over the config file; unset serves text-embedding-3-small as a deprecated default (1536 dimensions).
AILANG_EMBED_PROVIDER	—	Embedding provider (ollama, openai, gemini, none) over the config file's embeddings.provider.
AILANG_OLLAMA_ENDPOINT	—	Ollama endpoint the embedder uses over the config file's embeddings.ollama.endpoint; set, it is exported as OLLAMA_HOST for the ollama client library.
AILANG_OLLAMA_MODEL	—	Ollama embedding model over the config file's embeddings.ollama.model.

Eval harness

Variable	Default	What it does
AILANG_AGENT_OUTPUT_DELIVERY	1	0 drops the agent-mode output-delivery override from the system prompt (a clean A/B control arm).
AILANG_AVER	—	Path of the aver binary; unset looks on PATH, then $CARGO_HOME/bin/aver.
AILANG_BIN	—	The ailang binary the agent-mode grade probe runs; unset resolves ailang on PATH and serves it as a deprecated default (the stale-binary trap), refused under AILANG_STRICT_CONFIG=1.
AILANG_EVAL_MAX_RSS	8G	Resident-memory cap per generated-code run: a byte count or an integer with a K/M/G/T suffix; 0 or off disables the watchdog, and a malformed value is an error.
AILANG_EVAL_PERSIST_PROMPT	0	1, true, on or yes delivers the full teaching prompt through a persistent system-prompt channel re-injected every turn (measured worse; for A/B only).
AILANG_EVAL_TRAPS_CARD	—	Path of the traps card prepended to every agent-mode directive; unset loads the built-in card, and off (or 0/false/no/none) disables it.
AILANG_MOON	—	Path of the moon (MoonBit) binary; unset looks on PATH, then $MOON_HOME/bin/moon.
AILANG_UV	—	Path of the uv binary for Python benchmarks; unset looks it up on PATH.
CARGO_HOME	—	Cargo home searched for aver when it is not on PATH; unset means ~/.cargo.
MOON_HOME	—	MoonBit home searched for moon when it is not on PATH; unset means ~/.moon.
OBSERVATORY_ENDPOINT	http://localhost:1957	Observatory API the eval suite creates and completes its task in.

Mission loop

Variable	Default	What it does
AILANG_ANTHROPIC_RATION	1	0 turns off Anthropic subscription rationing for one attended process; unset means rationed.
AILANG_CODEX_RUNTIME	—	Codex execution owner: daemon for isolated local mission home, cli for an exclusive cloud execution; unset retains CLI behavior.
AILANG_MISSION_REGISTRY	—	Absolute directory holding mission definitions, instead of the built-in registry.
CLAUDECODE	—	Set to 1 by Claude Code in the sessions it runs; used only to label an attended identity.
CLAUDE_CODE_SESSION_ID	—	Claude Code session id, appended to the attended identity label.
CODEX_HOME	—	Codex CLI home whose auth and quota files are observed; unset means ~/.codex.
CONTROLLER_ID	—	Identity of the mission controller acting in this process; used as the approval identity label.
MISSION_CONTROL_ACTIVE	0	1 marks the process as running inside a mission-control iteration.
MISSION_DESIGN_AUTHOR	—	The designer lane that wrote a doc (e.g. codex:gpt-6-astra); design-quorum benches that vendor. Unset assumes a Claude author.
MISSION_GH_ISSUE	—	GitHub issue number that overrides the mission's directive channel, so a cutover can be rehearsed against a scratch issue.
MISSION_METERED_BUDGET_USD	—	Metered spend budget in USD for the mission's chain statistics; unset means no budget line.
MISSION_NAME	—	Name of the mission whose fire this process belongs to (v1, docs, motoko, world, fleet); set by the mission driver. Default filer for ailang mission ticket file; the push scope guard keys on it.
MISSION_QUORUM_ARTIFACT_DIR	—	Opt-in absolute quorum evidence directory; unset uses the current repo local directory. Raw nonempty AILANG_AGENT_POLICY suppresses default overrides for confinement; distinct explicit artifact paths retain precedence.
MISSION_ROLE	—	Role the mission loop pinned this process to (controller, designer, executor, ...).
USER	—	The login user, the last-resort identity label and operator principal.

Rig lock

Variable	Default	What it does
AILANG_RIG_LEASE	none	Lease token of the held rig lock, exported by the holder for its GPU clients; the rig gateway admits long work only with the live token while the lock is held.
AILANG_RIG_LOCK_HELD	0	Set to 1 by a lock holder for its children, which then skip their own acquire.
AILANG_RIG_YIELD_TO_OPERATOR	0	Set to 1 by unattended batch jobs (rotation filler, nightly): at each checkpoint they lend the GPU while rig.operator says someone is using the desktop.
RIG_HANDOFF_FILE	—	Path of the yield hand-off file; unset derives rig.handoff beside the lock directory.
RIG_LOCK_DIR	—	Lock directory; unset derives <RIG_SHARED_DIR>/rig.lock.d when that shared directory exists, else rig.lock.d under the state dir.
RIG_LOCK_STALE_MIN	360	Minutes without a heartbeat before a holder is presumed dead; a non-positive or malformed value keeps the default.
RIG_SHARED_DIR	/Users/Shared/ailang	Machine-wide parent for the lock so agents under different OS users contend for one; used only when an operator has created it.

Pub/Sub

Variable	Default	What it does
AILANG_TOPIC_PREFIX	ailang	Prefix of every Pub/Sub topic name (<prefix>-messages, <prefix>-tasks, ...); terraform sets it per environment.

Package registry

Variable	Default	What it does
AILANG_REGISTRY	https://storage.googleapis.com/ailang-registry	Base URL of the package registry index the pkg commands read.
AILANG_REGISTRY_API	—	Deprecated alias of AILANG_REGISTRY_VALIDATOR, read after it.
AILANG_REGISTRY_API_KEY	—	API key sent as X-API-Key to the validator for publish, unpublish and key management.
AILANG_REGISTRY_OBJECT	registry.yml	Object name models publish writes the model registry to.
AILANG_REGISTRY_VALIDATOR	https://registry.ailang.sunholo.com	Registry validator base URL (trailing slash trimmed).
FIRESTORE_DATABASE	—	Firestore database holding scoped registry keys; unset runs the validator superuser-only.
FIRESTORE_KEYS_COLLECTION	ailang_registry_keys	Firestore collection of scoped registry keys.
REGISTRY_API_KEY	—	Superuser API key the registry validator accepts.
REGISTRY_BUCKET	—	GCS bucket the registry validator serves; required, the service refuses to start without it.

Model registry

Variable	Default	What it does
AILANG_MODELS_PATH	—	Explicit models.yml to load; a file named here that fails to parse is a hard error, and models publish publishes it (default internal/modelreg/models.yml).
AILANG_MODELS_PUBLISHED_DIR	/registry	Directory of the published registry (the gcsfuse mount); a broken file there degrades to the embedded floor, loudly.

Prompt and MCP

Variable	Default	What it does
AILANG_MCP_QUIET	—	Set to anything to silence the prompt-source note ailang prompt prints on a terminal.
AILANG_MCP_URL	—	MCP endpoint ailang prompt and mcp status fetch the canonical prompt from; unset means the production endpoint.
AILANG_MCP_VERBOSE	—	Set to anything to print the prompt-source note even when stdout is not a terminal.
AILANG_NO_GITHUB_SEARCH	—	Set to anything to stop ailang docs search falling back to the GitHub backend when local docs are missing.

MicroRAG

Variable	Default	What it does
AILANG_MICRORAG_DRYRUN	false	1 or true retrieves and logs without injecting.
AILANG_MICRORAG_ENABLED	true	0 or false turns the engine off; anything else (including an invalid value) leaves it on — it does not fail closed.
AILANG_MICRORAG_ROUTES	—	Comma-separated allowlist of routes the engine serves; unset allows all.
AILANG_MICRORAG_SESSION	—	Session id that names the ledger directory; unset uses pid-<pid> so concurrent sessions do not share one.
AILANG_MICRORAG_USERPROMPT_FLOOR	0.70	Relevance floor in (0, 1] for the user-prompt path; out of range or malformed keeps the default rather than widening the gate.

serve-api

Variable	Default	What it does
AILANG_RATELIMIT_BURST	3	submit_feedback burst allowance per client.
AILANG_RATELIMIT_RPM	5	submit_feedback requests per minute per client.
AILANG_SERVE_API_ALLOW_DROPS	0	1 lets serve-api start with @route-bearing modules dropped for lying outside its base path (not for production).

Notifications

Variable	Default	What it does
AILANG_DISCORD_WEBHOOK_URL	—	Discord webhook the notify daemon posts to; unset falls back to the macOS login keychain, then to no Discord channel.
AILANG_NTFY_AUTH_TOKEN	—	Bearer token for the ntfy server, when it requires one.
AILANG_NTFY_SERVER_URL	—	ntfy server the coordinator pushes secret-approval requests to; unset (or no topic) skips the push.
AILANG_NTFY_TOPIC	—	ntfy topic for secret-approval pushes.