.env.example

# Aevum environment configuration example.
# Copy to .env and fill in your values. Never commit .env to version control.

# ── Core behaviour ────────────────────────────────────────────────────────────

# Set to "1" to enable dev mode (permissive, no TSA, no Rekor).
# NEVER set in production. See CLAUDE.md S-11.
# AEVUM_DEV=1

# ── SCITT receipt issuer ──────────────────────────────────────────────────────

# Hostname for the SCITT iss (issuer) field in COSE_Sign1 protected headers.
# Results in: did:web:<AEVUM_ISSUER_HOST>
# Default (dev): aevum.local
# Production example:
AEVUM_ISSUER_HOST=your.domain.example.com

# ── Transparency log (Rekor v2) ───────────────────────────────────────────────

# Rekor v2 endpoint for RekorV2Backend (aevum-publish).
# S-13: no hardcoded Rekor URLs — always configure via this variable.
# AEVUM_REKOR_URL=https://rekor.sigstore.dev

# ── Receipt store (SQLite WAL, three-tier) ────────────────────────────────────

# Path to the SQLite receipt store file (aevum-core SqliteReceiptStore).
# Required in production. AEVUM_DEV=1 uses :memory: instead.
# See: adr-010-three-tier-receipt-storage.md
# AEVUM_RECEIPT_DB=/var/lib/aevum/receipts.db

# WORM-backend URL (S3/Azure/GCS Object Lock) — not implemented; setting this
# has no effect. Crash-protected receipts are not replicated off-host.
# AEVUM_RECEIPT_WORM_URL=s3://your-bucket/receipts/

# ── OpenTelemetry ─────────────────────────────────────────────────────────────

# Set to "true" to capture prompt/completion content in OTel spans.
# S-14: default is OFF (privacy-preserving). Opt-in only.
# OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true

# OTel GenAI semconv stability opt-in
# When set, emits ONLY the current gen_ai.provider.name attribute
# (not the deprecated gen_ai.system alias).
# Requires: Datadog agent ≥7.50, Grafana Tempo ≥2.4, or any OTel backend
# that supports semconv v1.38.0+.
# OTEL_SEMCONV_STABILITY_OPT_IN=gen_ai_latest_experimental