.env.example

# Required
ANTHROPIC_API_KEY=sk-ant-...
SYMBIONT_MASTER_KEY=                 # openssl rand -hex 32
SYMBIONT_API_TOKEN=                  # any opaque bearer token

# Optional
GITHUB_TOKEN=                        # OSV/GHSA rate-limit headroom
SYMBI_LOG_LEVEL=info                 # debug | info | warn | error
GRC_TOKEN=                           # bearer token for `codered export-grc` (gapps/comp)

# LLM inference provider for the reasoning agents (pattern_scout, chain_builder,
# poc_forge, devils_advocate, reflector). Default is ANTHROPIC_API_KEY above.
# Provider precedence: OPENROUTER_API_KEY -> OPENAI_API_KEY -> ANTHROPIC_API_KEY.
# OPENROUTER_API_KEY=sk-or-...        # highest-precedence provider when set
#
# AWS Bedrock: codered has no native Bedrock (SigV4) client, but you can use
# Bedrock's models through an OpenAI-compatible gateway — LiteLLM proxy or the
# AWS "Bedrock Access Gateway" — which signs the bedrock-runtime calls for you.
# Point the OpenAI path at the gateway (note: CHAT_MODEL + OPENAI_BASE_URL drive
# inference; OPENAI_MODEL above is only for embeddings). The gateway host must be
# public HTTPS — an SSRF guard rejects private/link-local addresses.
# OPENAI_API_KEY=<token-the-gateway-accepts>
# OPENAI_BASE_URL=https://your-bedrock-gateway/v1
# CHAT_MODEL=anthropic.claude-3-5-sonnet-20241022-v2:0   # gateway's model id

# Generation model profile for the finding-generation stages (pattern_scout,
# chain_builder, reflector). Pick a preset or define a custom chain.
# Presets: fable5 (default) | opus | sonnet | ollama-qwen
#   codered hunt --model-profile opus     # (flag overrides the env below)
# CODERED_MODEL_PROFILE=fable5
#
# Custom generation chain (overrides the preset; no recompile). Provider is
# anthropic | openrouter | openai. FALLBACK is comma-separated provider:model
# tiers tried in order (split on the FIRST colon, so Ollama tags like :32b work).
# CODERED_GENERATION_PROVIDER=openrouter
# CODERED_GENERATION_MODEL=qwen/qwen3-max
# CODERED_GENERATION_FALLBACK=anthropic:claude-sonnet-4-6
#
# Fully-local example — Ollama serving a Qwen coder model via its OpenAI API.
# Use `--model-profile ollama-qwen` (or the env override above), then:
#   OPENAI_API_KEY=ollama            # any non-empty token; Ollama ignores it
#   OPENAI_BASE_URL=http://ollama:11434/v1
#   ollama pull qwen2.5-coder:32b
# Note: the OpenAI-path SSRF guard may reject private/link-local hosts —
# allowlist your Ollama host if the connection is refused.
#
# Independent devil's-advocate model (kept a different family from generation).
# CODERED_ADVOCATE_PROVIDER=openrouter
# CODERED_ADVOCATE_MODEL=google/gemini-2.5-pro
# CODERED_ADVOCATE_FALLBACK=anthropic:claude-sonnet-4-6

# Embeddings (default: local bge-small; override here to use ollama/openai)
# EMBEDDINGS_PROVIDER=ollama
# OLLAMA_HOST=http://ollama:11434
# OLLAMA_MODEL=nomic-embed-text
# EMBEDDINGS_PROVIDER=openai
# OPENAI_API_KEY=sk-...
# OPENAI_MODEL=text-embedding-3-small