.env.prod.sample

# Test harness diagnostics file (optional)
# When set, writes raw output from each codegen-build invocation.
# The {N} placeholder is replaced with invocation count (1, 2, ...).
DIAGNOSTICS_FILE=

# Keep temp directories created by isolated_tmp_dir (optional)
# Set to "1" to preserve temporary test fixtures for inspection.
KEEP_TMP=

# Consumer-supplied build-worker confinement roots (required in prod for enforcement).
# Set by the consuming platform when invoking the build worker.
# Codegen hooks treat an unknown boundary (unset) as "not a managed build worker"
# and allow all orchestrator I/O — set these in prod to enforce confinement.
OCG_APPS_ROOT=
OCG_PHOENIX_SEED_DIR=
OCG_USER_FILES_DIR=

# Claude investigative mode headless flag (optional).
# Set to "1" to enable one-shot headless mode in shape/refactor/ops/debug launchers.
# Builds 7-flag headless suite (--print, --verbose, --output-format stream-json, etc).
CLAUDE_NONINTERACTIVE=

# call-dispatch.sh watchdog knobs (optional, build-time; both harness legs
# read identically — enforced by harnesses/shared/call-dispatch-parity_test.sh).
# CODEGEN_CALL_STREAM_IDLE_SECS: dead-stream cap in seconds (default 60). Fires
#   only when BOTH no output growth AND no live tool subprocess (pgrep -P
#   empty) hold for the window — the child-presence guard is what makes this
#   short cap safe against a role legitimately silent for minutes while a
#   make test/mix test bash tool runs.
CODEGEN_CALL_STREAM_IDLE_SECS=

# Operator toggles for multi-pitch queue draining (optional, build-time).
# CODEGEN_BUILD_QUEUE_MAX_RETRIES: max retry attempts per pitch on transient failure (default 3).
# CODEGEN_BUILD_QUEUE_RETRY_DELAYS: space-separated backoff delays in seconds (default "30 120 300").
# CODEGEN_BUILD_QUEUE_PITCH_BUDGET_SECS: wall-clock timeout per pitch in seconds (default 3600).
# CODEGEN_BUILD_QUEUE_MAX_CONSECUTIVE_FAILS: consecutive deterministic pitch
#   failures (no ship in between) at which the drain HALTs instead of
#   skipping-and-continuing (default 3).
# CODEGEN_BUILD_QUEUE_BUDGET_USD: queue-wide spend ceiling in USD across all
#   pitches in the drain; unset = unlimited (no default ceiling). Checked
#   before launching each pitch against the accumulated total_cost_usd of all
#   prior pitches in the drain; halts (fails closed) rather than launching
#   another pitch once reached, or if a prior pitch's cost cannot be read.
# CODEGEN_BUILD_QUEUE_POLL_SECS: --watch-only; seconds slept between scans of
#   ready/ once it empties (default 60).
# CODEGEN_BUILD_QUEUE_QUIESCE_SECS: --watch-only; a pitch .md whose mtime is
#   newer than (now - this) is treated as still arriving (e.g. mid-scp) and
#   skipped until it stops changing (default 30).
# CODEGEN_BUILD_QUEUE_OUTAGE_PAUSE_SECS: total outage-pause ceiling in seconds
#   before the drain gives up on a sustained provider outage and HALTs with a
#   distinct "provider outage" message (default 900). A provider-classified
#   transient failure probes liveness and holds during this window instead of
#   consuming a max_retries slot or a consecutive_fails breaker strike.
# CODEGEN_BUILD_QUEUE_MAX_PITCH_FAILS: deterministic (non-transient) build
#   failures a single pitch tolerates in ready/ before the drain demotes it to
#   draft/ with status: SHAPING, a demoted_from/demote_reason frontmatter
#   stamp, and a "## Build failure history" section (default 2). EVERY counted
#   deterministic failure writes a self-contained evidence row into that
#   section — not only the demoting one; this threshold controls only WHEN
#   the pitch moves to draft/. Transient failures never count toward this
#   threshold.
# Set via operator environment when invoking claude-build --queue.
# Note: test_harness/lib/codegen_test_harness/loop_gate.ex default_run_fn/2 scrubs
# (unsets) all CODEGEN_BUILD_* flags from the gate subprocess env before running —
# harness build-time flags never leak into the gate's own env.
CODEGEN_BUILD_QUEUE_MAX_RETRIES=
CODEGEN_BUILD_QUEUE_RETRY_DELAYS=
CODEGEN_BUILD_QUEUE_PITCH_BUDGET_SECS=
CODEGEN_BUILD_QUEUE_MAX_CONSECUTIVE_FAILS=
CODEGEN_BUILD_QUEUE_BUDGET_USD=
CODEGEN_BUILD_QUEUE_POLL_SECS=
CODEGEN_BUILD_QUEUE_QUIESCE_SECS=
CODEGEN_BUILD_QUEUE_OUTAGE_PAUSE_SECS=
CODEGEN_BUILD_QUEUE_MAX_PITCH_FAILS=

# Test harness internal variables (not user-facing).
# HARNESS: selected harness name ("claude"); set by test fixtures.
HARNESS=
OCG_CODEGEN_DIR=

# BENCH_RUN_DIR: benchmark run output directory; read by test fixtures
# (test_harness/test/support/fixtures.ex) when locating per-run artifacts.
BENCH_RUN_DIR=

# CODEGEN_BUILD_LOCK_HELD: internal reentrancy guard read by
# orchestration_loop.ex to detect a nested codegen-build invocation; not an
# operator-facing toggle.
CODEGEN_BUILD_LOCK_HELD=
# CODEGEN_BUILD_INVOCATION_ID: generated by codegen-build for one dispatch;
# validates fresh loop-owned build-result.json. Never operator-set.
CODEGEN_BUILD_INVOCATION_ID=

# CLAUDE_PROJECT_DIR / CODEGEN_BUILD_CWD (not user-facing).
# Ambient project-root overrides read by codegen-log's LOG_ROOT fallback
# chain and by test isolation code that neutralizes them before shelling
# out to the real codegen-log binary (see
# test_harness/test/codegen_test_harness/orchestration_loop_test.exs and
# harnesses/claude/hooks/codegen-log_test.sh). Not settable by operators —
# CLAUDE_PROJECT_DIR is injected by the Claude CLI itself; CODEGEN_BUILD_CWD
# is set internally by codegen-build.
CLAUDE_PROJECT_DIR=
CODEGEN_BUILD_CWD=

# PATH (passthrough, not a new operator toggle).
# loop_queue_drain.ex reads the ambient PATH via System.get_env("PATH") and
# forwards it into the spawned child's Port.open :env option so the child
# process can resolve executables. Not settable here — inherited from the
# invoking shell.