# Runtime Configuration

Runtime configuration is environment-driven. No Tailscale IPs, DNS names, ports, credentials, local runtime paths or legacy dashboard URLs are hardcoded in code or examples.

## Required environment names

```bash
JARVIS_ENV=development|production
JARVIS_DEMO_MODE=1|0
JARVIS_PUBLIC_BASE_URL=https://jarvis.local
JARVIS_GATEWAY_HOST=127.0.0.1
JARVIS_GATEWAY_PORT=8080
JARVIS_DEMO_API_PORT=8010
JARVIS_DEMO_DASHBOARD_PORT=5173
JARVIS_OPERATOR_DEMO_PROFILE=demo_mock
JARVIS_OPERATOR_PUBLIC_ORIGIN=
JARVIS_ALLOW_TAILNET_LINKS=0
JARVIS_DEV_CORS_ORIGINS=http://127.0.0.1:5174,http://localhost:5174
FINANCE_ADAPTER_MODE=mock
FINANCE_API_BASE_URL=
FINANCE_LEGACY_DASHBOARD_URL=
FINANCE_READ_TIMEOUT_SECONDS=3

HEALTH_ADAPTER_MODE=mock
HEALTH_RUNTIME_BASE=/configured-at-runtime-only
HEALTH_SAFE_STATUS_MARKER_PATH=
HEALTH_SAFE_STATUS_MAX_AGE_HOURS=72
HEALTH_LEGACY_DASHBOARD_URL=https://jarvis.local/health

AUTOSHORTS_ADAPTER_MODE=mock
AUTOSHORTS_API_BASE_URL=https://jarvis.local/autoshorts-api
AUTOSHORTS_RUNTIME_BASE=
AUTOSHORTS_LEGACY_DASHBOARD_URL=https://jarvis.local/autoshorts

REDACTION_DEFAULT_POLICY=summary
ALLOW_EXACT_FINANCE_VALUES=0
ALLOW_HEALTH_DETAIL_LINKS=0
```

These are documentation examples only. Do not commit real `.env` files with local paths, private hosts or credentials.

## Semantics

### JARVIS_ENV

Allowed values:

- `development`
- `production`

Controls safety posture and logging strictness. Production must be Tailscale-only for MVP.

### JARVIS_DEMO_MODE

`1` means synthetic data only. No runtime/domain access.

### JARVIS_PUBLIC_BASE_URL

Public base URL as seen by the browser. For MVP this should be a Tailscale-only/internal URL, never public internet.

### JARVIS_GATEWAY_HOST / JARVIS_GATEWAY_PORT

Gateway bind configuration. Future implementation must prefer safe local binding unless explicitly configured for Tailscale access.

### JARVIS_OPERATOR_DEMO_PROFILE / JARVIS_DEMO_* ports

`JARVIS_OPERATOR_DEMO_PROFILE` supports `demo_mock` and `demo_mixed_readonly`. The default `demo_mock` profile uses only synthetic module data and disables runtime access. `JARVIS_DEMO_API_PORT` and `JARVIS_DEMO_DASHBOARD_PORT` are preferred local ports for `make demo`; the start script may choose free alternatives and prints the actual URLs.

`JARVIS_OPERATOR_PUBLIC_ORIGIN` is an optional link-only System handoff origin. `JARVIS_ALLOW_TAILNET_LINKS=1` allows Tailnet IP legacy links for human handoff display only; it does not authorize automatic API calls to Tailnet services.

### FINANCE_API_BASE_URL

Base URL for FinanceManager FastAPI read-only calls. No secrets in URL.

### FINANCE_LEGACY_DASHBOARD_URL

Legacy link to Finance dashboard. Link only, not iframe.

### HEALTH_ADAPTER_MODE

Allowed values: `mock`, `local_probe`, `safe_marker`, `disabled`. Default remains `mock` for CI and local verify.

`safe_marker` reads one schema-validated, metadata-only Health Safe Status Marker. It requires `HEALTH_SAFE_STATUS_MARKER_PATH`; that configured path is never returned by the API.

### HEALTH_SAFE_STATUS_MARKER_PATH / HEALTH_SAFE_STATUS_MAX_AGE_HOURS

`HEALTH_SAFE_STATUS_MARKER_PATH` points to the runtime marker file for the safe-marker adapter. Leave empty unless explicitly running `HEALTH_ADAPTER_MODE=safe_marker`.

`HEALTH_SAFE_STATUS_MAX_AGE_HOURS` defaults to `72`. Older markers degrade fail-closed.

### HEALTH_RUNTIME_BASE

Runtime base for a temporary Health metadata bridge. Must not be displayed to frontend or logs. Long-term target is Health Summary API instead.

### HEALTH_LEGACY_DASHBOARD_URL

Legacy link to Health dashboard. Blocked by default until detail-link protection exists.

### AUTOSHORTS_* URLs

AutoShorts API and legacy dashboard URL. Link only until inventoried and contracted.

### AUTOSHORTS_ADAPTER_MODE / AUTOSHORTS_RUNTIME_BASE

Allowed values: `mock`, `disabled`, `local_probe`, `live_readonly`. Default is `mock`.

`local_probe` uses only filesystem metadata under `AUTOSHORTS_RUNTIME_BASE`; it never reads media, subtitle, script, prompt, manifest, log, token, or OAuth contents and never emits the configured path.

`live_readonly` may call only localhost/127.0.0.1 GET endpoints, currently `/api/dashboard/summary` plus optional `/api/health`. No render/upload/publish endpoints are called.

### REDACTION_DEFAULT_POLICY

Default must be `summary`.

### ALLOW_EXACT_FINANCE_VALUES

Default `0`. Exact finance values are not shown globally. Later secure detail mode requires separate design.

### ALLOW_HEALTH_DETAIL_LINKS

Default `0`. Health report/dashboard links are blocked unless a protection concept exists.

## No committed real env files

Allowed:

- future `.env.example` with placeholders only
- docs using `https://jarvis.local/...` placeholders

Forbidden:

- `.env` with real values
- credentials
- private hostnames/IPs if sensitive
- OAuth/token files


### FINANCE_ADAPTER_MODE

Allowed values: `mock`, `live_readonly`, `disabled`. Default is `mock`. `live_readonly` requires `FINANCE_API_BASE_URL`; `disabled` returns a degraded but safe Finance snapshot.

### FINANCE_READ_TIMEOUT_SECONDS

Timeout for read-only FinanceManager GET calls. Default `3`.

## Health adapter runtime configuration

| Variable | Default | Purpose |
| --- | --- | --- |
| `HEALTH_ADAPTER_MODE` | `mock` | `mock`, `disabled`, `local_probe`, or explicit `safe_marker`. |
| `HEALTH_RUNTIME_BASE` | empty | Absolute local directory for metadata-only probing. Never returned by API. |
| `HEALTH_SAFE_STATUS_MARKER_PATH` | empty | Runtime safe marker path for `safe_marker`; never returned by API. |
| `HEALTH_SAFE_STATUS_MAX_AGE_HOURS` | `72` | Safe marker max age before stale/degraded fail-closed output. |
| `HEALTH_LEGACY_DASHBOARD_URL` | empty | Optional localhost-only legacy link. |
| `ALLOW_HEALTH_DETAIL_LINKS` | `0` | Must remain disabled for MVP Health output. |

`local_probe` may inspect only filesystem metadata: existence, count, mtime, size-derived freshness and bounded aggregate counters. It must not read file contents, database rows, PDF/OCR/report/tracker data, or raw JSON payloads.