.env.hosted.example

# Portable single-user hosted pilot profile. Copy values into your deployment's
# secret/config system; do not commit a populated .env file.
HOST=0.0.0.0
PORT=8081
LOG_LEVEL=info
LUCID_WEB_ORIGIN=https://app.example.com

# Supabase verifies the Google session; Lucid maps its immutable issuer and
# subject to a durable participant. Keep enrollment false for an invite-only
# preview, or explicitly enable it while the OAuth app itself is restricted to
# approved test accounts.
LUCID_AUTH_MODE=supabase
LUCID_SUPABASE_PROJECT_URL=https://project-ref.supabase.co
LUCID_ALLOW_SELF_ENROLLMENT=false
LUCID_OPERATOR_TOKEN=<server-only-break-glass-secret>

# Use a managed PostgreSQL URL reachable from the container. If the provider's
# direct endpoint is IPv6-only but the host is IPv4-only, use its IPv4-capable
# session pooler instead.
LUCID_DATABASE_URL=<postgresql-url-with-tls-required>
LUCID_STATE_ROOT=/var/lib/lucid

# Fresh workspaces start paused. These values bound work after an operator
# explicitly resumes a representative.
LUCID_HEARTBEAT_MAX_CONCURRENCY=1
LUCID_HEARTBEAT_NAMESPACE=lucid:representatives
LUCID_HEARTBEAT_EXECUTION_LEASE_MS=1200000
LUCID_HEARTBEAT_RECOVERY_INTERVAL_MS=60000
LUCID_HEARTBEAT_INVOCATION_TIMEOUT_MS=720000
LUCID_PREFER_API_KEY=true
OPENAI_API_KEY=<model-key-for-in-process-representative-work>

# External conversation turns use the managed AgentCore transport. The public
# URL is the HTTPS issuer and callback origin reachable by the Runtime.
LUCID_HOSTED_EXECUTION_ENABLED=true
LUCID_HOSTED_EXECUTION_TRANSPORT=agentcore
LUCID_HOSTED_EXECUTION_PUBLIC_URL=https://api.example.com
LUCID_HOSTED_EXECUTION_AGENTCORE_REGION=<aws-region>
LUCID_HOSTED_EXECUTION_AGENTCORE_RUNTIME_ARN=<agentcore-runtime-arn>
# LUCID_HOSTED_EXECUTION_AGENTCORE_QUALIFIER=DEFAULT
LUCID_HOSTED_EXECUTION_MODEL_API_KEY=<model-key-for-hosted-conversation-turns>

# Mount the private signing JWK as a deployment secret with owner-only file
# permissions. The public key is exposed through Lucid's JWKS route.
LUCID_HOSTED_EXECUTION_SIGNING_JWK_PATH=/run/secrets/lucid/es256-private.jwk.json
LUCID_HOSTED_EXECUTION_ADOPTER_ID=<deployment-adopter-id>
LUCID_HOSTED_EXECUTION_TENANT_ID=<pilot-tenant-id>
LUCID_HOSTED_EXECUTION_PRODUCT_SESSION_ID=<pilot-product-session-id>
LUCID_HOSTED_EXECUTION_KEY_ID=<signing-key-id>
LUCID_HOSTED_EXECUTION_AUDIENCE=<execution-host-audience>
LUCID_HOSTED_EXECUTION_MCP_AUDIENCE=<product-mcp-audience>
LUCID_HOSTED_EXECUTION_MCP_SERVER_ID=lucid_product
LUCID_HOSTED_EXECUTION_MAX_TURN_MS=600000