.env.example

# Copy to .env and fill in. .env is gitignored and never committed.
# Note: values in .env never override variables already exported in your shell
# (e.g. from ~/.bashrc). Unset a stale export, or the shell value wins.

# LLM calls (verify, roles, the decision engine): DeepSeek.
DEEPSEEK_API_KEY=
# DEEPSEEK_BASE_URL=https://api.deepseek.com

# Embeddings only (`ousast learn memory embed`, default openai/text-embedding-3-small through OpenRouter).
OPENROUTER_API_KEY=

# Plane memory store. Default is a local FileStore under ~/ousast-results/plane/memory.
# For an S3-compatible server (RustFS is the tested one): OUSAST_MEMORY=s3://<bucket>[/<prefix>], or
# OUSAST_MEMORY=s3:// to use S3_BUCKET. Needs the s3 extra (boto3). Example for a RustFS server:
# OUSAST_MEMORY=s3://sast-memory
# S3_ENDPOINT=https://files.example.com
# S3_REGION=us-east-1
# S3_BUCKET=sast-memory
# AWS_ACCESS_KEY_ID=
# AWS_SECRET_ACCESS_KEY=
# AWS_SESSION_TOKEN=
# The bucket must have versioning enabled, a lifecycle rule expiring runs/, S3 Select and readable object tags
# (see docs/rustfs.md); the store verifies them at startup and refuses to run otherwise.

# Operator notifications (Discord). Status of OpenUltraSAST processes and their results for the
# system/AI operator -- not developer debugging, and not k3s/ax infra health. See
# .kiro/steering/operator-notifications.md. Webhook posts to the operator channel; the operator id
# is the account to @mention on a stuck/impaired alert. Leave blank to disable notifications.
DISCORD_WEBHOOK_URL=
DISCORD_OPERATOR_ID=
docs: refresh merged; v3 has 15 cases; .env.example names DeepSeek, OpenRouter embeddings and the S3 store 2026-10-02 07:11:50 +02:00			`# Copy to .env and fill in. .env is gitignored and never committed.`
			`# Note: values in .env never override variables already exported in your shell`
			`# (e.g. from ~/.bashrc). Unset a stale export, or the shell value wins.`
feat: load OpenRouter settings from a local .env 2026-09-04 14:06:18 +02:00
docs: refresh merged; v3 has 15 cases; .env.example names DeepSeek, OpenRouter embeddings and the S3 store 2026-10-02 07:11:50 +02:00			`# LLM calls (verify, roles, the decision engine): DeepSeek.`
			`DEEPSEEK_API_KEY=`
			`# DEEPSEEK_BASE_URL=https://api.deepseek.com`

chore(index): remove the unused vector index, the ousast index subcommand and the [embeddings] section 2026-10-02 19:32:46 +02:00			# Embeddings only (`ousast learn memory embed`, default openai/text-embedding-3-small through OpenRouter).
docs: refresh merged; v3 has 15 cases; .env.example names DeepSeek, OpenRouter embeddings and the S3 store 2026-10-02 07:11:50 +02:00			`OPENROUTER_API_KEY=`
feat(pair-corpus-honesty): function-scoped honest scorer with mechanisms and loss counters 2026-09-05 09:27:40 +02:00
docs: refresh merged; v3 has 15 cases; .env.example names DeepSeek, OpenRouter embeddings and the S3 store 2026-10-02 07:11:50 +02:00			`# Plane memory store. Default is a local FileStore under ~/ousast-results/plane/memory.`
refactor(memory): S3-generic store on boto3; RustFS is the tested server (no MinIO naming) 2026-10-02 10:15:19 +02:00			`# For an S3-compatible server (RustFS is the tested one): OUSAST_MEMORY=s3://<bucket>[/<prefix>], or`
			`# OUSAST_MEMORY=s3:// to use S3_BUCKET. Needs the s3 extra (boto3). Example for a RustFS server:`
			`# OUSAST_MEMORY=s3://sast-memory`
			`# S3_ENDPOINT=https://files.example.com`
			`# S3_REGION=us-east-1`
			`# S3_BUCKET=sast-memory`
			`# AWS_ACCESS_KEY_ID=`
			`# AWS_SECRET_ACCESS_KEY=`
			`# AWS_SESSION_TOKEN=`
			`# The bucket must have versioning enabled, a lifecycle rule expiring runs/, S3 Select and readable object tags`
			`# (see docs/rustfs.md); the store verifies them at startup and refuses to run otherwise.`
steering: operator Discord notifications for OpenUltraSAST process status 2026-10-09 11:58:10 +02:00
			`# Operator notifications (Discord). Status of OpenUltraSAST processes and their results for the`
			`# system/AI operator -- not developer debugging, and not k3s/ax infra health. See`
			`# .kiro/steering/operator-notifications.md. Webhook posts to the operator channel; the operator id`
			`# is the account to @mention on a stuck/impaired alert. Leave blank to disable notifications.`
			`DISCORD_WEBHOOK_URL=`
			`DISCORD_OPERATOR_ID=`