SpecSync/env.example at main · SentinelOps-CI/SpecSync · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
# =============================================================================
# SpecSync environment template
# Copy to .env for local development (do not commit secrets).
# Probot docs: https://probot.github.io/docs/configuration/
# =============================================================================

# --- GitHub App (required for Probot) ---
APP_ID=
PRIVATE_KEY=
WEBHOOK_SECRET=

# Optional: PAT for local CLI/demo only. Production PR path uses context.octokit
# (GitHub App installation auth). Do not rely on GITHUB_TOKEN for multi-tenant installs.
GITHUB_TOKEN=

# --- LLM providers ---
# Without keys, SpecSync falls back to mock specs in development only.
# In production (NODE_ENV=production), mock specs are NOT posted unless
# SPECSYNC_ALLOW_MOCK_LLM=true. Otherwise SpecSync posts a single "LLM unavailable" comment.
OPENAI_API_KEY=
ANTHROPIC_API_KEY=
LLM_REQUEST_TIMEOUT_MS=120000
LLM_MAX_RETRIES=2

# When true: allow mock specs even in production (they are badged [MOCK] in comments).
# When false (recommended): production refuses mock output and reports LLM unavailable.
SPECSYNC_ALLOW_MOCK_LLM=false

# Cap how many function specs are generated per PR (budget / spam control).
SPECSYNC_MAX_SPECS_PER_PR=10

# Max parallel LLM calls within one PR analysis job.
SPECSYNC_LLM_CONCURRENCY=3

# In-memory spec/content cache TTL (ms). Single-instance only — not multi-tenant durable.
SPECSYNC_CACHE_TTL_MS=3600000

# Optional shared-volume job markers for multi-instance idempotency (local FS only;
# NOT written into the target GitHub repo). Leave unset for single-instance memory queue.
# Example: /var/lib/specsync/jobs
SPECSYNC_JOB_MARKERS_DIR=

# Max mutating /specsync accept|ignore|edit commands per actor per PR per window.
SPECSYNC_COMMAND_RATE_LIMIT=10
SPECSYNC_COMMAND_RATE_WINDOW_MS=60000

# Proof gate: soft (report sorry count, do not fail) | strict (fail on any sorry in specs/).
# Generator closes smoke/Nat fragments with real proofs; undecided LLM posts stay labeled unproved.
SPECSYNC_PROOF_GATE=soft

# Coverage check threshold (%). Formula: accepted .specsync specs / eligible changed functions.
COVERAGE_THRESHOLD=70

# --- Slack (optional) ---
SLACK_BOT_TOKEN=
SLACK_CHANNEL=#specsync

# --- Process / HTTP ---
NODE_ENV=development
PORT=3000
HOST=localhost
LOG_LEVEL=info

# --- Formal specs (Lean / Lake) ---
# Must match the Lake library layout (see lakefile.lean)
SPECS_DIR=specs

# --- Future SaaS only (not used in this remediation program) ---
DATABASE_URL=

# --- UI / experiments ---
# Experimental feature flags (comma-separated). Keep suggest-only until accept store ships.
SPECSYNC_EXPERIMENTAL=suggest-only

# Optional local dashboard (off by default). Requires both flag and shared secret.
# SPECSYNC_DASHBOARD=1 starts the HTTP server; without a secret it refuses to bind.
# Bind defaults to loopback (DASHBOARD_HOST=127.0.0.1). Do not expose publicly without
# a reverse proxy that terminates TLS and restricts access; the shared secret alone is
# not a full multi-tenant AuthN story.
SPECSYNC_DASHBOARD=0
SPECSYNC_DASHBOARD_SECRET=
DASHBOARD_PORT=3001
# Bind address for the dashboard (default loopback — do not expose publicly without a reverse proxy).
DASHBOARD_HOST=127.0.0.1
# Clients must send header: X-SpecSync-Dashboard-Secret: <SPECSYNC_DASHBOARD_SECRET>
# or Authorization: Bearer <SPECSYNC_DASHBOARD_SECRET>