.env.example

# ──────────────────────────────────────────────────────────────────────────────
# Spec-Drift Chronometer — Environment Variables
# Copy this file and configure as needed. Never commit .env or .env.local.
# ──────────────────────────────────────────────────────────────────────────────

# ── Demo Mode (no AWS credentials needed) ─────────────────────────────────────
# Set to "true" to run with pre-scripted governance scenarios (recommended for
# first-time setup and demos). Set to "false" to enable live AWS Bedrock calls.
DEMO_MODE=true

# ── Governance Thresholds ─────────────────────────────────────────────────────
# Drift index above this value triggers the Justification Gate.
DRIFT_THRESHOLD=0.0075

# ── Backend ───────────────────────────────────────────────────────────────────
# Port for the FastAPI Warden Engine (default: 8000).
BACKEND_PORT=8000

# ── Frontend ──────────────────────────────────────────────────────────────────
# URL the Next.js dashboard uses to reach the backend. For local dev this is
# localhost; for production set it to your API Gateway or load-balancer URL.
NEXT_PUBLIC_API_URL=http://localhost:8000

# ── AWS Credentials (PRODUCTION only — not needed in DEMO_MODE) ───────────────
# Your AWS access key ID. Required for live Bedrock Nova Pro calls.
AWS_ACCESS_KEY_ID=your_aws_access_key_here

# Your AWS secret access key.
AWS_SECRET_ACCESS_KEY=your_aws_secret_key_here

# AWS region. Must be eu-central-1 (Frankfurt) for GDPR/EU AI Act data sovereignty.
AWS_REGION=eu-central-1

# ── Optional: AWS Session Token ───────────────────────────────────────────────
# Only needed when using temporary credentials (e.g., IAM role assumption, SSO).
# AWS_SESSION_TOKEN=your_session_token_here

# ── Optional: DynamoDB Intent Ledger ─────────────────────────────────────────
# Name of the DynamoDB table used for the immutable audit trail in production.
# Required for EU AI Act Article 12 audit persistence in Lambda deployments
# (Lambda filesystem is ephemeral — without this, audit records are lost on restart).
# DYNAMODB_TABLE_NAME=spec-drift-intent-ledger

# ── GDPR: Audit Retention ─────────────────────────────────────────────────────
# Number of days to retain audit records in DynamoDB (TTL-based auto-expiry).
# Defaults to 90 days. Adjust to match your data retention policy.
# AUDIT_RETENTION_DAYS=90

# ── GDPR: CORS Origins ────────────────────────────────────────────────────────
# Comma-separated list of allowed frontend origins. Defaults to * in DEMO_MODE.
# In production, lock this to your actual frontend domain.
# CORS_ORIGINS=https://spec-drift-chronometer.aevoxis.de