Configuration reference¶
vornik reads its configuration from config.yaml. The keys below are the customer-facing settings, by dotted YAML path. Where an environment variable overrides a key it is listed; an override wins over the file, and vornikctl config show --provenance shows which one supplied each value on the running daemon.
steering_notifications_enabled¶
| Key | Type | Description | Environment override |
|---|---|---|---|
steering_notifications_enabled |
bool | Push a chat/DM prompt when a task needs operator steering (input/approval). Default true. | — |
steering_operator_alert¶
| Key | Type | Description | Environment override |
|---|---|---|---|
steering_operator_alert |
struct | Fallback chat recipient alerted when an ownerless autonomy task needs steering (channel/session[/address]). | — |
cluster¶
| Key | Type | Description | Environment override |
|---|---|---|---|
cluster |
struct | Cluster-diagnostics: expected endpoints + monitor interval. | — |
control_plane¶
| Key | Type | Description | Environment override |
|---|---|---|---|
control_plane |
struct | Control-plane worker knobs (self-healing incident detection). | — |
registry¶
| Key | Type | Description | Environment override |
|---|---|---|---|
registry |
struct | Config-tree loading policy (what a rejected project file does at boot). | — |
named_secrets¶
| Key | Type | Description | Environment override |
|---|---|---|---|
named_secrets |
list | Per-secret allowlist of env credentials injected into agent containers, scoped by project. | — |
doctor¶
| Key | Type | Description | Environment override |
|---|---|---|---|
doctor.thresholds.unclassified_share |
float | Share of classified step failures that may be unclassified before unclassified_step_failures warns (0-1). Default 0.05. | — |
doctor.thresholds.unclassified_share_window_days |
int | How many days of failures unclassified_step_failures divides over. Default 30. | — |
doctor.thresholds.model_failure_rate |
float | Failed fraction at or above which model_health and model_calls_live flag a model (0-1). Default 0.5. | — |
doctor.thresholds.model_min_samples |
int | Smallest call count model_health and model_calls_live will judge a model on. Default 5. | — |
doctor.thresholds.cost_attribution_fraction |
float | Share of recent cost rows that must carry a DB-backed key before cost_attribution is satisfied (0-1). Default 0.9. | — |
doctor.thresholds.cost_attribution_min_total |
int | Sample floor below which cost_attribution stays OK regardless of distribution. Default 10. | — |
doctor.thresholds.fallback_rung_min_attempts |
int | Attempts a fallback rung needs before a zero-success record is reported. Default 2. | — |
telemetry¶
| Key | Type | Description | Environment override |
|---|---|---|---|
telemetry |
struct | Anonymous install and project-creation telemetry. Enabled by default; set enabled=false to opt out. | — |
server¶
| Key | Type | Description | Environment override |
|---|---|---|---|
server.address |
string | TCP listen address for the HTTP API. | VORNIK_SERVER_ADDRESS |
server.read_timeout |
string | Max time to read a request. | — |
server.write_timeout |
string | Max time to write a response. | — |
server.unix_socket |
string | Optional Unix socket path the API is also served on, alongside the TCP address. Required for zero-egress agents. | VORNIK_SERVER_UNIX_SOCKET |
server.real_ip.enabled |
bool | Honour the trusted client-IP header from trusted_proxies. Off ⇒ always key on RemoteAddr. | — |
server.real_ip.trusted_proxies |
list | CIDRs/IPs trusted to set the real-IP header. List ONLY the cloudflared host. | — |
server.real_ip.header |
string | Trusted client-IP header. Default CF-Connecting-IP. | — |
server.public_base_url |
string | Public origin (scheme://host[:port]) for git clone/push HTTPS URLs; used only to render the clone URL on the project page. | — |
server.accepted_hosts |
list | Extra Host names the daemon answers on its unauthenticated surfaces: every route when api.auth_enabled is false, and the metrics endpoints whenever they need no credential (DNS-rebinding guard). IP literals, localhost and the public base URL's host are always accepted. | — |
database¶
| Key | Type | Description | Environment override |
|---|---|---|---|
database.host |
string | PostgreSQL host. | VORNIK_DATABASE_HOST |
database.port |
int | PostgreSQL port. | VORNIK_DATABASE_PORT |
database.name |
string | Database name. | VORNIK_DATABASE_NAME |
database.user |
string | Database user. | VORNIK_DATABASE_USER |
database.password |
string | Password. Prefer the VORNIK_DATABASE_PASSWORD environment variable. | VORNIK_DATABASE_PASSWORD |
database.sslmode |
string | One of disable, require, verify-ca, verify-full. | VORNIK_DATABASE_SSLMODE |
storage¶
| Key | Type | Description | Environment override |
|---|---|---|---|
storage.artifacts_path |
string | Local directory for artifacts when using the filesystem backend. | VORNIK_ARTIFACTS_PATH |
storage.backend |
string | filesystem (local disk) or s3 (S3-compatible object store, including MinIO). | VORNIK_STORAGE_BACKEND |
storage.s3.endpoint |
string | S3 endpoint URL. Leave empty for AWS S3; set for MinIO/non-AWS. | VORNIK_STORAGE_S3_ENDPOINT |
storage.s3.region |
string | AWS region. Required when backend is s3. | VORNIK_STORAGE_S3_REGION |
storage.s3.bucket |
string | Bucket holding artifacts. Required when backend is s3; must already exist. | VORNIK_STORAGE_S3_BUCKET |
storage.s3.prefix |
string | Optional key prefix to namespace one bucket across deployments. | VORNIK_STORAGE_S3_PREFIX |
storage.s3.access_key_id |
string | Access key. Prefer VORNIK_STORAGE_S3_ACCESS_KEY_ID. | VORNIK_STORAGE_S3_ACCESS_KEY_ID |
storage.s3.secret_access_key |
string | Secret key. Prefer VORNIK_STORAGE_S3_SECRET_ACCESS_KEY. | VORNIK_STORAGE_S3_SECRET_ACCESS_KEY |
storage.s3.use_path_style |
bool | Force path-style addressing. Set true for MinIO. | VORNIK_STORAGE_S3_USE_PATH_STYLE |
storage.s3.force_ssl |
bool | Require HTTPS. Set false only for local MinIO development. | VORNIK_STORAGE_S3_FORCE_SSL |
artifacts¶
| Key | Type | Description | Environment override |
|---|---|---|---|
artifacts.artifacts_path |
string | Local directory for artifacts when using the filesystem backend. | VORNIK_ARTIFACTS_PATH |
artifacts.backend |
string | filesystem (local disk) or s3 (S3-compatible object store, including MinIO). | VORNIK_STORAGE_BACKEND |
artifacts.s3.endpoint |
string | S3 endpoint URL. Leave empty for AWS S3; set for MinIO/non-AWS. | VORNIK_STORAGE_S3_ENDPOINT |
artifacts.s3.region |
string | AWS region. Required when backend is s3. | VORNIK_STORAGE_S3_REGION |
artifacts.s3.bucket |
string | Bucket holding artifacts. Required when backend is s3; must already exist. | VORNIK_STORAGE_S3_BUCKET |
artifacts.s3.prefix |
string | Optional key prefix to namespace one bucket across deployments. | VORNIK_STORAGE_S3_PREFIX |
artifacts.s3.access_key_id |
string | Access key. Prefer VORNIK_STORAGE_S3_ACCESS_KEY_ID. | VORNIK_STORAGE_S3_ACCESS_KEY_ID |
artifacts.s3.secret_access_key |
string | Secret key. Prefer VORNIK_STORAGE_S3_SECRET_ACCESS_KEY. | VORNIK_STORAGE_S3_SECRET_ACCESS_KEY |
artifacts.s3.use_path_style |
bool | Force path-style addressing. Set true for MinIO. | VORNIK_STORAGE_S3_USE_PATH_STYLE |
artifacts.s3.force_ssl |
bool | Require HTTPS. Set false only for local MinIO development. | VORNIK_STORAGE_S3_FORCE_SSL |
runtime¶
| Key | Type | Description | Environment override |
|---|---|---|---|
runtime.run_as_user |
string | Override the container user (uid, uid:gid, or user:group). Use to force non-root on root-default images. | VORNIK_RUNTIME_RUN_AS_USER |
runtime.default_network |
string | Default network policy for agent roles: host, none, or daemon-only (zero egress; requires server.unix_socket). | — |
runtime.image_timeout |
string | Bound on a podman run or pull of the agent image, which may download it (a Go duration). Empty = 15m. Raise it on a slow registry link. | — |
runtime.agent_memory_limit |
string | Per-agent-container memory cap (e.g. 2GiB); a bounded container gets no swap. Absent derives from host memory and concurrency; "none" disables the limit. | — |
runtime.agent_llm.endpoint |
string | OpenAI-compatible base URL for the LLM agents call. Falls back to the chat section when empty. | — |
runtime.agent_llm.api_key |
string | API key for the agent LLM endpoint. | — |
runtime.agent_llm.model |
string | Default model for agents. | — |
runtime.agent_llm.context_size |
int | Context-window tokens. | — |
runtime.agent_llm.max_tokens |
int | Max output tokens per call. | — |
runtime.agent_llm.timeout |
string | Bound on a single LLM call from inside an agent. | — |
runtime.agent_llm.tool_result_max_bytes |
int | Max bytes of a tool result fed back to the model (0 = agent default 256 KiB). | — |
runtime.agent_llm.health.enabled |
bool | Activate the model-health circuit breaker (default on; false disables). | — |
runtime.agent_llm.health.window |
string | Rolling failure window, e.g. 60s (default 60s). | — |
runtime.agent_llm.health.min_samples |
int | Minimum in-window failures before the breaker can trip (default 5). | — |
runtime.agent_llm.health.failure_rate |
float | Failure fraction at/above which the breaker trips (default 0.5). | — |
runtime.agent_llm.health.open_cooldown |
string | How long the circuit stays open before a half-open probe, e.g. 30s (default 30s). | — |
runtime.warm_pool.enabled |
bool | Reuse warm containers for faster task start. | — |
runtime.warm_pool.idle_timeout |
string | How long an idle warm container is kept. | — |
runtime.warm_pool.max_per_role |
int | Max warm containers per project and role. | — |
runtime.project_workspace_path |
string | Base directory for per-project persistent workspaces. | — |
runtime.dependency_cache_path |
string | Directory for installed project dependency trees (empty: a deps/ sibling of project_workspace_path). | — |
runtime.delegation_depth_limit |
int | Max nesting depth for delegation chains (0 = default). | — |
runtime.delegation_fanout_limit |
int | Max child tasks one parent may spawn in a batch (0 = default). | — |
scheduler¶
| Key | Type | Description | Environment override |
|---|---|---|---|
scheduler.max_concurrent_tasks |
int | Maximum tasks running at once across all projects. | — |
scheduler.lease_timeout |
string | How long a task lease is held before it is considered stale. | — |
scheduler.speed_aware_timeouts.enabled |
bool | Scale time budgets by measured decode speed. Off by default; off is byte-identical to not having the feature. | — |
scheduler.speed_aware_timeouts.reference_tokens_per_sec |
float | Decode rate the shipped base timeouts were calibrated against. Must be declared; a local measurement cannot serve as its own reference. | — |
scheduler.speed_aware_timeouts.min_factor |
float | Floor, so fast hardware cannot starve a step of startup time. | — |
scheduler.speed_aware_timeouts.max_factor |
float | Ceiling. Deliberately below what the slowest hardware demands: hitting it is reported, because the honest answer there is that the hardware cannot run the workload at this shape. | — |
scheduler.speed_aware_timeouts.observed_tokens_per_sec |
float | This host's measured decode rate (see: vornikctl profile). Zero disables scaling. | — |
scheduler.speed_aware_timeouts.min_samples |
int | Steps required before a fitted profile is trusted at all. | — |
scheduler.speed_aware_timeouts.window |
string | Rolling window the profile is fitted over. | — |
scheduler.default_step_timeout |
string | Ceiling for a step whose workflow declares no timeout. Empty = 30m. | — |
scheduler.execution_timeout |
string | Ceiling for a whole execution whose workflow declares no maxWallClock (a workflow's own value always wins). Empty = no ceiling. | — |
watchdog¶
| Key | Type | Description | Environment override |
|---|---|---|---|
watchdog.enabled |
bool | Periodic scan for stuck executions. | — |
watchdog.interval |
string | Gap between scans. | — |
watchdog.stuck_threshold |
string | Idle time before an execution is flagged. | — |
watchdog.action |
string | warn (log only) or fail (mark the task terminal). | — |
effective_cost¶
| Key | Type | Description | Environment override |
|---|---|---|---|
effective_cost.enabled |
bool | Turn the drift monitor on. | — |
effective_cost.interval |
string | Evaluation cadence. | — |
effective_cost.ratio_threshold |
float | Current/baseline cost ratio that triggers an alert. | — |
secrets¶
| Key | Type | Description | Environment override |
|---|---|---|---|
secrets.enabled |
bool | Turn detection on. | — |
secrets.allowlist |
list | Extra regexes appended to the default allowlist. | — |
secrets.checkpoints |
map | Map a channel to an action: detect, redact, or block. | — |
secrets.trusted_output_tools |
list | Tool-name prefixes whose tool-audit OUTPUT is exempt from generic_kv/entropy redaction (strong credential patterns still redact; input always scanned). | — |
secrets.tool_credentials |
list | Map a trusted tool to a credential field in its output to capture and surface code-formatted + copyable (strong-pattern values are never captured). | — |
retention¶
| Key | Type | Description | Environment override |
|---|---|---|---|
retention.enabled |
bool | Turn the background sweeper on. | — |
retention.interval |
string | How often the sweeper runs. | — |
retention.task_llm_usage_days |
int | Days to keep per-task LLM usage rows. | — |
retention.tool_audit_days |
int | Days to keep tool-call audit rows; clamped up to tool_audit_floor_days. | — |
retention.tool_audit_floor_days |
int | Minimum days to keep tool-call audit rows (0 = 180, six months). | — |
retention.tool_audit_floor_override |
bool | Allow tool_audit_floor_days below six months (logs a warning). | — |
retention.tool_audit_floor_override_basis |
string | Why six months does not apply (a law requiring less, or not a high-risk deployment); required for the override. | — |
retention.tasks_days |
int | Days to keep task rows. | — |
retention.executions_days |
int | Days to keep execution rows. | — |
retention.artifacts_days |
int | Days to keep artifacts. | — |
retention.response_cache_days |
int | Days to keep cached LLM responses (30d recommended on busy deployments). | — |
retention.execution_ratings_days |
int | Days to keep execution ratings. 0 means the 400-day default, not forever. | — |
retention.embedding_cache_days |
int | Days to keep cached embeddings before evicting cold entries (0 = keep forever; 30d recommended if the table grows large). | — |
retention.blackbox_trace_cache_days |
int | Days to keep assembled black-box traces (0 = 1 day, the cache TTL). | — |
retention.project_gists_days |
int | Days a project gist or its narrative may go unrefreshed before it is removed (0 = 7). | — |
retention.upgrade_dump_keep |
int | Upgrade database dumps kept at most, newest first (0 = 2). | — |
retention.upgrade_dump_grace_days |
int | Days an upgrade database dump is kept after its upgrade succeeded (0 = 14). | — |
retention.upgrade_dump_dir |
string | Directory holding the vornik-upgrade-backup-* directories (empty = the daemon user's home). | — |
workspace_ingest¶
| Key | Type | Description | Environment override |
|---|---|---|---|
workspace_ingest.enabled |
bool | Turn on automatic ingestion of Workspace documents. Off by default; ingest-on-request works regardless. | — |
workspace_ingest.sources |
list | Explicit source rules. No rules means nothing is ingested automatically. | — |
metrics¶
| Key | Type | Description | Environment override |
|---|---|---|---|
metrics.enabled |
bool | Expose a Prometheus metrics endpoint. | VORNIK_METRICS_ENABLED |
metrics.addr |
string | Listen address for the dedicated metrics server. | VORNIK_METRICS_ADDR |
metrics.require_admin |
bool | Require the admin key on the main port metrics endpoint. | — |
tracing¶
| Key | Type | Description | Environment override |
|---|---|---|---|
tracing.enabled |
bool | Enable OpenTelemetry tracing. | VORNIK_TRACING_ENABLED |
tracing.endpoint |
string | OTLP gRPC endpoint for trace export. | VORNIK_TRACING_ENDPOINT |
logging¶
| Key | Type | Description | Environment override |
|---|---|---|---|
logging.level |
string | Log level (e.g. info, debug). | VORNIK_LOG_LEVEL |
logging.format |
string | Log format (e.g. json, text). | — |
logging.forward.enabled |
bool | Enable centralised log forwarding to remote sinks. | — |
logging.forward.scopes |
list | Allowlist of log categories to forward. Empty ships all scopes. | — |
logging.forward.queue_size |
int | Bounded forward queue size; overflow is dropped + counted. | — |
logging.forward.batch_size |
int | Max events per shipped batch. | — |
logging.forward.flush_interval |
string | Max time a partial batch waits before shipping (e.g. 5s). | — |
logging.forward.http.enabled |
bool | Enable the HTTP webhook log sink. | — |
logging.forward.http.url |
string | Collector ingest URL the HTTP sink POSTs NDJSON to. | — |
logging.forward.http.bearer_token_env |
string | Env-var NAME holding the HTTP sink bearer token (never the token itself). | — |
logging.forward.http.timeout |
string | Per-request HTTP sink timeout (e.g. 5s). | — |
logging.forward.http.max_retries |
int | Max HTTP sink retries on 5xx/transport error. | — |
logging.forward.syslog.enabled |
bool | Enable the syslog log sink. | — |
logging.forward.syslog.address |
string | host:port of the syslog collector. | — |
logging.forward.syslog.protocol |
string | Syslog transport: udp | tcp | tls. | — |
logging.forward.syslog.ca_file |
string | Optional PEM CA bundle for syslog tls (system roots otherwise). | — |
api¶
| Key | Type | Description | Environment override |
|---|---|---|---|
api.auth_enabled |
bool | Require a valid API key on every request. Turn this on for any network-reachable deployment. | — |
api.auth_dry_run |
bool | Evaluate and log auth verdicts without enforcing. Cannot be set together with auth_enabled: true. | — |
api.api_keys |
list | Static bearer keys. Prefer per-project DB-backed keys via vornikctl key. | — |
api.rate_limit.per_ip.rps |
int | Per-IP sustained request rate (unauthenticated backstop). | — |
api.rate_limit.per_ip.burst |
int | Per-IP burst capacity. | — |
api.rate_limit.per_ip.trusted_proxies |
list | Deprecated: use server.real_ip.trusted_proxies. CIDRs/IPs trusted to set X-Forwarded-For. | — |
a2a¶
| Key | Type | Description | Environment override |
|---|---|---|---|
a2a |
struct | Outbound A2A federation: consultable peer instances + consult guardrails. | — |
chat¶
| Key | Type | Description | Environment override |
|---|---|---|---|
chat.enabled |
bool | Turn the chat client on. | — |
chat.provider |
string | http (OpenAI-compatible) or router (multi-provider). | — |
chat.router.default |
string | Sub-provider used when no route matches. Required for router. | — |
chat.router.model_fallbacks |
map | Non-swarm per-model fallback map (primary model -> fallback model), used when the primary's circuit is open. Empty disables non-swarm fallback. | — |
chat.router.claude_cli.effort_level |
string | CLI reasoning effort: low|medium|high|xhigh|max (default low); honored by claude-cli, ignored by codex-cli. | — |
chat.router.claude_subscription.thinking_budget |
int | Anthropic extended-thinking budget_tokens; 0 disables (router subprovider). | — |
chat.router.codex_cli.effort_level |
string | CLI reasoning effort: low|medium|high|xhigh|max (default low); honored by claude-cli, ignored by codex-cli. | — |
chat.router.codex_subscription.effort_level |
string | Codex reasoning effort: low|medium|high (empty = omit). | — |
chat.router.http.enabled |
bool | Enable the OpenAI-compatible sub-provider. | — |
chat.router.http.endpoint |
string | Endpoint URL for the HTTP sub-provider. | — |
chat.router.http.api_key |
string | API key for the HTTP sub-provider. | — |
chat.router.http.model |
string | Default model for the HTTP sub-provider. | — |
chat.router.vertex.enabled |
bool | Enable Google Vertex AI (Gemini). | — |
chat.router.vertex.api_key |
string | Vertex API key. | — |
chat.router.vertex.project_id |
string | GCP project that owns the Vertex endpoint. | — |
chat.router.vertex.location |
string | Vertex region; defaults to global. | — |
chat.router.vertex.model |
string | Default Vertex model. | — |
chat.router.openrouter.enabled |
bool | Enable the OpenRouter sub-provider. | — |
chat.router.openrouter.api_key |
string | OpenRouter API key. | — |
chat.router.openrouter.model |
string | OpenRouter default model. | — |
chat.router.openrouter.free_only |
bool | Reject any non-:free model — a hard guard against accidental spend. | — |
chat.router.ollama_cloud.enabled |
bool | Enable the Ollama Cloud sub-provider. | — |
chat.router.ollama_cloud.api_key |
string | Ollama Cloud API key. | — |
chat.router.ollama_cloud.model |
string | Ollama Cloud default model, e.g. gpt-oss:120b. | — |
chat.router.bedrock.enabled |
bool | Enable AWS Bedrock (credentials via the AWS SDK chain). | — |
chat.router.bedrock.region |
string | Bedrock region. | — |
chat.router.bedrock.model |
string | Bedrock default model. | — |
chat.router.health.enabled |
bool | Activate the model-health circuit breaker (default on; false disables). | — |
chat.router.health.window |
string | Rolling failure window, e.g. 60s (default 60s). | — |
chat.router.health.min_samples |
int | Minimum in-window failures before the breaker can trip (default 5). | — |
chat.router.health.failure_rate |
float | Failure fraction at/above which the breaker trips (default 0.5). | — |
chat.router.health.open_cooldown |
string | How long the circuit stays open before a half-open probe, e.g. 30s (default 30s). | — |
chat.endpoint |
string | OpenAI-compatible base URL (single-provider mode). | — |
chat.api_key |
string | API key for the endpoint. Prefer an environment variable. | — |
chat.model |
string | Default model identifier when a request does not pin one. | — |
chat.model_capabilities |
map | Per-model modality declarations (text, vision, audio). Undeclared models fall back to built-in id patterns, then text-only. | — |
chat.wizard_model |
string | Model for the project-setup wizard. | — |
chat.fixit_model |
string | Model for the Fix-It Doctor repair chat. | — |
chat.optional_work.disabled |
bool | Refuse all optional LLM work (narration, memory titles/classes/narratives, reranking) on every model. | — |
chat.optional_work.disabled_models |
list | Refuse optional LLM work on these model ids (exact match). For a backend too slow to serve it beside task traffic. | — |
chat.timeout |
string | Bound on a single LLM round-trip. | — |
chat.dispatch_timeout |
string | Bound on one complete interactive (multi-call) turn. | — |
chat.max_history |
int | Max conversation messages kept. | — |
chat.max_history_tokens |
int | Soft token budget for history trimming. | — |
chat.compaction.enabled |
bool | Summarize overflow turns into a topic gist instead of dropping them. | — |
chat.compaction.max_gist_terms |
int | Topics retained in the compaction gist (0 = default 24). | — |
chat.max_tool_iterations |
int | Tool-call loop cap per dispatcher turn. | — |
chat.deferred_tool_threshold |
int | MCP catalog size above which chat sessions defer MCP tools behind tool_search. 0 = default (20); negative = never defer. | — |
chat.max_concurrent_requests |
int | Max in-flight chat backend calls; excess queues. | — |
chat.context_size |
int | Context-window tokens. | — |
chat.max_tokens |
int | Max output tokens per call. | — |
chat.prompt_cache_mode |
string | Provider-native prompt caching: off, auto (recommended), or prefix. | — |
autonomy¶
| Key | Type | Description | Environment override |
|---|---|---|---|
autonomy.default_evaluate_timeout |
string | Bound on one evaluation tick when a project does not set its own. | — |
autonomy.circuit_breaker.enabled |
bool | Auto-pause autonomy on a project that fails repeatedly. | — |
autonomy.circuit_breaker.threshold |
int | Failure count that trips the breaker. | — |
autonomy.circuit_breaker.window |
string | Rolling window the count is measured over. | — |
autonomy.approval_timeout_hours |
int | Cancel tasks awaiting approval after this many hours (0 = never; default 96). | — |
telegram¶
| Key | Type | Description | Environment override |
|---|---|---|---|
telegram.enabled |
bool | Turn the Telegram bot on. | — |
telegram.bot_token |
string | Bot token. Prefer an environment variable. | — |
telegram.allowed_users |
map | Map of Telegram user ID to access. true = full access; a list of project IDs scopes the user. Absent users are denied. | — |
telegram.allow_unlisted_users |
bool | When allowed_users is empty, admit every Telegram user (dev only). Default false = deny. | — |
telegram.rate_limit |
int | Requests per minute per user. | — |
telegram.session_path |
string | Path for conversation persistence (empty = none). | — |
telegram.session_ttl |
string | Auto-expire idle sessions (e.g. 24h). | — |
telegram.dispatcher_max_iterations |
int | Tool-call loop cap per chat turn. | — |
telegram.forum_chat_id |
int | Supergroup ID for one forum topic per task (0 = off). | — |
telegram.web_ui_base_url |
string | Public base URL of the web UI, used in onboarding links. | — |
memory¶
| Key | Type | Description | Environment override |
|---|---|---|---|
memory.enabled |
bool | Activate the memory subsystem. | — |
memory.embedding_provider |
string | Embedding transport: empty or openai for an OpenAI-compatible /v1/embeddings endpoint, or bedrock for native AWS Bedrock InvokeModel embeddings. | — |
memory.sufficiency.enabled |
bool | Widen-and-retry recall when too few high-relevance hits (requires the reranker). | — |
memory.sufficiency.min_high_rel |
int | Hits at/above score_floor that count as 'enough' (0 = default 3). | — |
memory.sufficiency.score_floor |
float | Absolute reranker relevance floor in [0,1] (0 = default 0.6). | — |
memory.sufficiency.max_rounds |
int | Hard cap on retrieval rounds (<=1 = single shot; 0 = default 3). | — |
memory.reranker.enabled |
bool | LLM-rerank context-assembly recall (the pre-delegation hint) and activate scored-sufficiency. Adds one LLM call (seconds) to that path only; the interactive memory_search tool and companion recall stay fast RRF. | — |
memory.reranker.model |
string | Reranker model id; small OSS recommended. Empty = chat router default (often overkill). | — |
memory.reranker.max_candidates |
int | Top-K results scored per recall (0 = default 20). | — |
memory.reranker.timeout_seconds |
int | Per-recall rerank timeout in seconds (0 = default 15). | — |
memory.reranker.max_snippet_bytes |
int | Per-candidate snippet sent to the reranker (0 = default 600). | — |
memory.retrieval_routing.k |
int | Top-K window the trust mean is computed over (0 = default 5). | — |
memory.retrieval_routing.min_results |
int | Floor result count for a non-low verdict; must be <= k (0 = default 1). | — |
memory.retrieval_routing.high_threshold |
float | Trust-mean at/above which the verdict is high (0 = default 0.70). | — |
memory.retrieval_routing.low_threshold |
float | Trust-mean below which the verdict is low and the widen fires (0 = default 0.40). | — |
memory.retrieval_routing.w_status |
float | Weight of the validation-status leg (0 = default 0.6). | — |
memory.retrieval_routing.w_conf |
float | Weight of the confidence leg (0 = default 0.2). | — |
memory.retrieval_routing.w_fresh |
float | Weight of the freshness leg (0 = default 0.2). | — |
memory.retrieval_routing.unverified_conf_discount |
float | Discount applied to unverified chunks' confidence term (0 = default 0.5). | — |
memory.retrieval_routing.no_ttl_age_cap_days |
int | Age in days past which a no-TTL chunk is stale and, as top hit, caps the verdict at medium (0 = default 180). | — |
memory.retrieval_routing.no_ttl_stale_freshness |
float | Freshness floor for an aged no-TTL chunk (0 = default 0.3). | — |
memory.retrieval_routing.max_rounds |
int | Hard cap on verdict-predicated widen rounds (0 = default 3). | — |
memory.retrieval_routing.widen_enabled |
bool | Enable the verdict-predicated DB widen (default true; set false for verdict-only). | — |
memory.retrieval_routing.enabled |
bool | Master switch for confidence-based retrieval routing (default true; set false to disable the feature entirely). | — |
memory.min_refute_score |
float | Minimum hybrid-search (RRF) score a chunk must reach before memory_correct's claim search will refute it (0 = default 0.05). Guards against refuting an unrelated chunk on a weak claim match. | — |
memory.embedding_model |
string | Embedding model name. Required when enabled. | — |
memory.embedding_dimension |
int | Vector dimension produced by the model. | — |
memory.embedding_endpoint |
string | Override endpoint for embedding requests. | — |
memory.embedding_api_key |
string | Override API key for embedding requests. | — |
memory.bedrock.region |
string | AWS region for native Bedrock embeddings when memory.embedding_provider=bedrock. | — |
memory.ingest_require_producer_success |
bool | Gate RAG ingest on the producing task reaching COMPLETED (default on). | — |
memory.embedding_cache_enabled |
bool | Cache embeddings to skip repeat API calls. | — |
memory.response_cache_enabled |
bool | Cache memory-pipeline LLM responses. | — |
memory.chunk_tokens |
int | Approximate tokens per chunk. | — |
memory.chunk_overlap |
int | Token overlap between adjacent chunks. | — |
memory.worker_concurrency |
int | Embed-queue worker goroutines. | — |
memory.graph.enabled |
bool | Knowledge-graph extraction pipeline. | — |
memory.titler.enabled |
bool | Generate a short topic label per chunk (one LLM call each). | — |
memory.classifier.enabled |
bool | LLM content-class backfill. | — |
memory.prompt_injection_scan |
string | Ingest prompt-injection gate: off (default), detect, or quarantine. | — |
memory.claim_audit_disabled_projects |
list | Project IDs that skip the claim-audit/hallucination ingest gate. | — |
memory.deny_patterns |
list | Substring deny-list (NOT regex) that quarantines matching content at memory ingest. | — |
instinct¶
| Key | Type | Description | Environment override |
|---|---|---|---|
instinct.enabled |
bool | Master switch for the instinct layer. | — |
instinct.cadence_seconds |
int | Extraction-worker tick interval. | — |
instinct.lookback_seconds |
int | How far back each tick scans. | — |
instinct.min_support |
int | Corroborating outcomes before a pattern goes active. | — |
instinct.active_confidence |
float | Confidence floor for an active instinct. | — |
instinct.decay_halflife_days |
int | Recency half-life for confidence decay. | — |
instinct.consumers.failure_playbooks |
bool | Surface recovery instincts on failed-task views. | — |
instinct.consumers.architect_priors |
bool | Feed workflow instincts to the architect as priors. | — |
instinct.consumers.memory_hygiene |
bool | Feed retrieval instincts to memory sweepers. | — |
instinct.consumers.tool_budget |
bool | Let learned budget instincts fill an absent complexity tier (default off). | — |
instinct.consumers.lift_eval |
bool | Measure true instinct lift and propose retiring instincts that do not help (default off). | — |
instinct.consumers.auto_apply.enabled |
bool | Promote high-confidence recovery instincts to a prompt-level directive (default off). | — |
instinct.consumers.auto_apply.min_confidence |
float | Confidence floor for auto-apply (default 0.85). | — |
instinct.consumers.auto_apply.min_clean_support |
int | Min clean (zero-contradiction) supports for auto-apply; 0 = off. | — |
instinct.consumers.auto_apply.allowed_error_classes |
list | Failure classes eligible for auto-apply; empty = all. | — |
instinct.lift.min_treatment |
int | Minimum applied outcomes before lift is measured (0 = 8). | — |
instinct.lift.min_baseline |
int | Minimum baseline outcomes before lift is measured (0 = 8). | — |
instinct.lift.margin |
float | Propose retirement only when lift <= -margin (0 = 0.05). | — |
instinct.lift.reeval_cooldown_hours |
int | Suppress re-proposing a rejected instinct for this many hours (0 = 168). | — |
instinct.lift.window_hours |
int | Measurement window in hours (0 = the confidence model's evidence-freshness horizon, else the decay half-life). | — |
mcp¶
| Key | Type | Description | Environment override |
|---|---|---|---|
mcp.agent_read_relist_interval |
string | How often each connected agent-namespace MCP read server is listed again, so a tool its server now marks as changing things is suspended between reloads (Go duration, 1m to 24h). Empty means 15m. Read at daemon start: a change takes a restart. | — |
auth¶
| Key | Type | Description | Environment override |
|---|---|---|---|
auth.bootstrap_admins |
list | Channel identities (channel:external_id) auto-granted admin on first login. | — |
auth.external_base_url |
string | Public origin of the daemon (scheme://host[:port]). Required when a login provider is configured. | — |
auth.session.lifetime |
string | Fixed session expiry. | — |
auth.session.idle_timeout |
string | Cut sessions idle longer than this. | — |
auth.session.credential_exchange |
bool | Open POST /api/v1/auth/session, exchanging an API key for a browser session cookie. | — |
auth.session.allow_insecure_exchange |
bool | Permit session cookies over plaintext HTTP. Development only; a cookie in the clear is the whole session. | — |
auth.providers.github.client_id |
string | GitHub OAuth App client ID. | — |
auth.providers.github.client_secret_file |
string | Path to the GitHub OAuth client secret (preferred over inline). | — |
auth.providers.github.org |
string | Restrict/soft-gate login to a GitHub org. | — |
auth.providers.github.org_member_role |
string | Auto-grant role for GitHub org members on login: empty (default, no auto-grant), 'user', or 'admin'. Requires 'org' set. | — |
auth.providers.github.org_member_projects |
list | Projects an auto-granted org member (user role) receives; '*' = all projects. | — |
admin¶
| Key | Type | Description | Environment override |
|---|---|---|---|
admin.operator_key_ids |
list | Hash ids (first 16 hex digits of SHA-256) of the admin keys that are the operator's own; tasks they start count as the operator's for memory verification. Leave the broker's and the A2A keys out. | — |
voice¶
| Key | Type | Description | Environment override |
|---|---|---|---|
voice.stt.provider |
string | Speech-to-text provider (whisper-local). | — |
voice.stt.model |
string | Absolute path to the STT ggml model file; its directory is mounted read-only into the sandbox. | — |
voice.stt.binary_path |
string | Ignored since 2026.9.7 (whisper-cli runs in the agent image); startup warns when set. | — |
voice.stt.ffmpeg_path |
string | Ignored since 2026.9.7 (ffmpeg runs in the agent image); startup warns when set. | — |
voice.tts.provider |
string | Text-to-speech provider (piper). | — |
voice.tts.voice |
string | Absolute path to the TTS voice model (.onnx, with its .onnx.json beside it); the directory is mounted read-only into the sandbox. | — |
voice.tts.binary_path |
string | Ignored since 2026.9.7 (piper runs in the agent image); startup warns when set. | — |
voice.tts.ffmpeg_path |
string | Ignored since 2026.9.7 (ffmpeg runs in the agent image); startup warns when set. | — |
media¶
| Key | Type | Description | Environment override |
|---|---|---|---|
media.stage_max_bytes |
int | Largest raw media file staged into an agent container alongside its extraction. 0 = unbounded. | — |
media.inline_max_bytes |
int | Largest single image attached to a dispatcher chat turn. 0 = built-in default (5 MB). | — |
media.inline_max_bytes_total |
int | Combined image bytes allowed on one dispatcher chat turn. 0 = built-in default (10 MB). | — |
media.inline_max_images |
int | Most images attached to one dispatcher chat turn. 0 = built-in default (4). | — |
media.video.max_frames |
int | Most keyframes sampled from one video. 0 = extractor default (8). | — |
media.video.min_interval_seconds |
int | Shortest gap between sampled keyframes. 0 = extractor default (5). | — |
sandbox_tools¶
| Key | Type | Description | Environment override |
|---|---|---|---|
sandbox_tools.max_concurrent |
int | Most sandbox tool runs at once; with 2 or more, one slot is reserved for voice. 0 = default (2). | — |
sandbox_tools.limits |
map | Per-feature memory limit (e.g. render: 1GiB). Features: render, pdf, image_ocr, video, audio, voice_stt, voice_tts. Absent = the feature's default. | — |
sandbox_tools.cpus |
map | Per-feature CPU share as podman --cpus takes it (e.g. video: "1.5"). Absent = the feature's default (2 for video, audio and voice_stt; 1 otherwise). | — |
sandbox_tools.timeouts |
map | Per-feature timeout in seconds (e.g. render: 120). Absent = the feature's default. | — |
sandbox_tools.max_input_bytes |
int | Largest total input of one run for EVERY feature, refused before any container starts. 0 = each feature's default (render 16 MiB, pdf 256 MiB, image_ocr 32 MiB, video 2 GiB, audio 512 MiB, voice_stt 64 MiB, voice_tts 16 MiB). | — |
extractors¶
| Key | Type | Description | Environment override |
|---|---|---|---|
extractors.audio.model_path |
string | Absolute path to the ggml whisper model (.bin) audio extraction uses; its directory is mounted read-only into the sandbox. Empty = voice.stt.model; neither set = audio extraction not available. | — |
node¶
| Key | Type | Description | Environment override |
|---|---|---|---|
node.profile |
string | Role preset: all|ui|worker|webhook. Default all. | — |
node.serve_ui |
bool | Mount /ui routes. | — |
node.serve_api |
bool | Mount data-plane / control endpoints. | — |
node.serve_webhooks |
bool | Mount public webhook ingress. | — |
node.run_workers |
bool | Run scheduler+executor and leader-elected singletons. | — |
node.relay.upstream |
string | Job-tier internal ingress base URL (https://host:8443). | — |
node.relay.client_cert |
string | PEM client cert for mTLS to the job tier. | — |
node.relay.client_key |
string | PEM client key for mTLS to the job tier. | — |
node.relay.ca |
string | PEM CA bundle that signed the job-tier server cert. | — |
node.relay.max_retries |
int | Bounded relay retries before 5xx to provider. 0 → 3. | — |
node.relay.timeout |
string | Per-relay-attempt timeout. Empty → 5s. | — |
node.relay_ingress.addr |
string | Listen address for the mTLS relay ingress, e.g. :8443. | — |
node.relay_ingress.server_cert |
string | PEM server cert presented to relaying webhook nodes. | — |
node.relay_ingress.server_key |
string | PEM server key for the relay ingress. | — |
node.relay_ingress.client_ca |
string | PEM CA bundle; only client certs it signed are accepted. | — |
integrations¶
| Key | Type | Description | Environment override |
|---|---|---|---|
integrations.allowed_hosts |
list | Hostnames allowed to bypass the daemon's private-range SSRF guard for operator-initiated dials: Integrations Hub probes/saves, the control-plane MCP Test probe, an operator project's MCP OAuth flow and the GitHub App API base. Empty = block all private/loopback/link-local destinations (secure default). | — |
narrator¶
| Key | Type | Description | Environment override |
|---|---|---|---|
narrator.enabled |
bool | Activate the narrator worker. | — |
narrator.model |
string | Model used for narration LLM calls (cheapest tier). | — |
narrator.debounce |
int | Seconds a step-start line waits before emitting, to collapse into a fast completion. | — |
narrator.long_tool_threshold |
int | Seconds before a still-running tool call gets a heartbeat line. | — |
narrator.min_line_interval |
int | Minimum seconds between narration lines for the same execution. | — |
narrator.max_lines |
int | Per-execution narration line cap. | — |
narrator.max_cost_usd |
float | Per-execution narrator LLM spend cap in USD; switches to template-only on breach. | — |
narrator.chat_milestone_kinds |
list | Narration trigger kinds eligible for the chat push (default: step_completed, completion). | — |
composer¶
| Key | Type | Description | Environment override |
|---|---|---|---|
composer.enabled |
bool | Activate the NL automation composer (wizard tier-3). | — |
composer.max_tier |
int | Highest composer tier allowed (2 disables free-form synthesis; 3 = full). | — |
composer.max_tier3_turns |
int | Per-session cap on expensive tier-3 composer turns. | — |
identity¶
| Key | Type | Description | Environment override |
|---|---|---|---|
identity |
struct | CE identity core: user accounts, channel→account linking, key→account ownership. | — |
config_assistant¶
| Key | Type | Description | Environment override |
|---|---|---|---|
config_assistant |
struct | Configuration assistant: natural-language config edits filed as reviewable proposals. | — |
web¶
| Key | Type | Description | Environment override |
|---|---|---|---|
web.writes |
string | Web write-action mode: off (default), on (per-project write_allowlist), or insecure (bypass the allowlist — dev only, requires insecure_ack). | — |
web.insecure_ack |
bool | Must be true to activate web.writes=insecure. A deliberate second flag so the allowlist bypass cannot be enabled by a single value. | — |
web.submit_secret |
string | Daemon↔scraper web_submit capability secret attached as daemon_auth (prefer submit_secret_file). Required when web.writes is on/insecure. | VORNIK_WEB_SUBMIT_SECRET |
web.submit_secret_file |
string | Path to a file holding the web_submit capability secret (preferred over inline submit_secret). | — |
broker¶
| Key | Type | Description | Environment override |
|---|---|---|---|
broker.writes |
string | Broker write-action mode: off (default; delegating a workflow that proposes writes is refused and nothing approved executes) or on (writes execute after approval in /inbox, each also gated by its MCP server's broker_write declaration). | — |
broker.action_timeout |
string | Bound on one approved write's tool call (default 60s, at most 10m). A call that times out is recorded as unknown, never retried. | — |
broker.standing_grants.max_days |
int | Longest standing grant a person may set, in days (default and ceiling 7). | — |
broker.standing_grants.max_uses |
int | Most writes one standing grant may cover (default and ceiling 20). | — |
broker.standing_grants.max_live_per_project |
int | Most live standing grants per project (default and ceiling 10). | — |
agent_admin¶
| Key | Type | Description | Environment override |
|---|---|---|---|
agent_admin.enabled |
bool | Offer the agent admin verbs to agent admin keys on the companion endpoint. On by default: nothing is reachable without an agent admin key, which only an operator mints (vornikctl agent connect) and only after an approver device is paired (vornikctl pair-device). Set false to turn the verbs off. | — |
agent_admin.default_project_budget_usd |
float | Monthly budget of a project an agent creates (default 2). Raising a project's budget needs approval on an approver device. | — |
agent_admin.namespace_budget_usd |
float | Ceiling on the sum of an agent's project budgets until a device approves more (default 10). | — |
agent_admin.agent_image |
string | Runtime image of the roles an agent defines (default the standard agent image). | — |
agent_admin.models |
list | Models an agent's roles may choose (empty, the default: none; every agent role runs on the global agent model). Whether each is local or remote is computed from where the chat router sends it: local only for an HTTP endpoint on a loopback or private address. A role on a remote model needs approval on an approver device, once per destination (sub-provider and endpoint host). Entries served by a command-line provider, with no route, or remote without an exact pricing.yaml entry are not offered; vornikctl doctor names them (agent_model_catalogue). | — |
gateway¶
| Key | Type | Description | Environment override |
|---|---|---|---|
gateway.enabled |
bool | Turn the query_api gateway integration on. | VORNIK_GATEWAY_ENABLED |
gateway.address |
string | Base URL the daemon uses to reach the local gateway, e.g. http://127.0.0.1:8010. | VORNIK_GATEWAY_ADDRESS |
gateway.token |
string | Internal daemon↔gateway key-auth secret (prefer token_file). | VORNIK_GATEWAY_TOKEN |
gateway.token_file |
string | Path to a file holding the gateway token (preferred over inline token). | — |
gateway.providers |
map | Registered API providers the agent may call by name. | — |
gateway.agent_writes |
string | Tri-state policy for query_api writes from task-executing agents: off (default; task-originated writes refused — chat-direct writes unaffected), user (permit only when the task's request-root creation_source is USER, i.e. a human-initiated tree; autonomous/scheduled/route-rooted trees stay read-only), all (any task-originated write permitted). Always AND-gated by the provider's writes_enabled and the gateway route allowlist. 'all' is broad (a prompt-injected autonomous agent can write to every writes_enabled provider) and emits a load-time warning. | VORNIK_GATEWAY_AGENT_WRITES |
taint_lineage¶
| Key | Type | Description | Environment override |
|---|---|---|---|
taint_lineage.enforcement_mode |
string | Daemon-default taint-lineage enforcement for autonomous writes: off (record only, never park/refuse), advisory (default; record + flag, never park/refuse), enforce (park tainted forge writes for operator review, synchronously refuse tainted query_api writes). Per-project overridable. Audit is always recorded regardless. Never LLM-settable. | VORNIK_TAINT_LINEAGE_MODE |