.env.example

# =============================================================================
# csharp — Windows DFIR triage agent
# =============================================================================
# The runtime hosts a DFIR triage parent + per-class child agents. Cases are
# mounted read-only at $CASES_DIR; outputs land in $REPORTS_DIR.
# -----------------------------------------------------------------------------

# --- LLM ---------------------------------------------------------------------
OLLAMA_MODEL=qwen2.5:1.5b-instruct
OLLAMA_URL=http://ollama:11434
OLLAMA_KEEP_ALIVE=5m
OLLAMA_HOST_PORT=11434

# --- ARCP --------------------------------------------------------------------
ARCP_SDK_VERSION=latest
ARCP_RUNTIME_HOST=0.0.0.0
ARCP_RUNTIME_PORT=8080
ARCP_RUNTIME_PATH=/arcp
ARCP_AUTH_TOKEN=dev-token-change-me
ARCP_CLIENT_NAME=dfir
ARCP_CLIENT_VERSION=1.0.0
ARCP_CLIENT_TIMEOUT_MS=30000

# --- DFIR --------------------------------------------------------------------
# Read-only mount of the analyst's case bundle(s).
CASES_DIR=/cases
# Read-write mount where the parent writes timeline/brief/STIX outputs.
REPORTS_DIR=/reports
# Per-case budget cap (USD). Enforced by the parent's lease.
CASE_BUDGET_USD=2.00
# Per-class child-job budget (USD).
PER_CLASS_BUDGET_USD=0.30
# Suspicion threshold (0.0-1.0). Candidates scored below are dropped.
SUSPICION_THRESHOLD=0.60
# Optional bundle of Zimmerman binaries mounted into the runtime.
PARSER_BIN_DIR=/opt/dfir-parsers
PARSER_TIMEOUT_MS=15000

# --- Sample case (synthetic) -------------------------------------------------
SAMPLE_CASE_DIR=/samples/synthetic-case-001

# Microsoft logging level: Trace | Debug | Information | Warning | Error
LOG_LEVEL=Information