Files
selfheal-lab-gitops/vm/ai-env/ai.env
T
seon 7967f7a320 chore(ai-env): add the Claude Workload Identity Federation id settings (empty until the Console rule exists)
ai.env 에 ANTHROPIC_FEDERATION_RULE_ID 등 4개 설정 키를 추가한다. 값은 Console 위자드로
규칙을 만든 뒤 채운다. 비어 있는 동안 에이전트는 기존 키 파일 경로로 동작한다.
2026-10-15 11:48:36 +09:00

32 lines
2.2 KiB
Bash

# Non-secret settings of the AI VM (merged into /opt/selfheal/ai.env by apply.sh). Secrets never go here.
# Discord server "Selfheal Lab" (created 2026-10-08): approvals channel for layer-2 buttons, escalation channel for layer 3.
DISCORD_GUILD_ID=1557424985793101824
DISCORD_APPROVALS_CHANNEL_ID=1557425140302872698
DISCORD_ESCALATION_CHANNEL_ID=1557425282363691048
# optional: restrict button decisions to one role id (empty = any member of the server)
DISCORD_APPROVER_ROLE_ID=
# Discord message language of the hitl bot: en or ja (runbooks and prompt free text are written in Japanese)
HITL_LANG=ja
# experiment design 11.1: candidates gpt-6-astra / gpt-6.1-sol / gpt-6-luna (OpenAI model page 2026-10-08). luna for the first live checks and campaign (budget), compare with sol afterwards
# default when a campaign does not name a model. Since apps 53ff243 the harness passes the campaign's model on every /diagnose
# (console "model" field); ids starting with claude- go to the Claude Messages API (secret selfheal-anthropic-api-key).
OPENAI_MODEL=gpt-6.1-sol
EMBED_MODEL=text-embedding-3-small
# Claude API auth: Workload Identity Federation (platform.claude.com/docs/en/manage-claude/wif-providers/gcp). The four ids are
# not secrets; the agent exchanges this VM's Google identity token (service account selfheal-ai-vm, unique id 117534696004805578884)
# for a short-lived access token. Empty = federation off (then the key file selfheal-anthropic-api-key is used, if registered).
ANTHROPIC_FEDERATION_RULE_ID=
ANTHROPIC_ORGANIZATION_ID=
ANTHROPIC_SERVICE_ACCOUNT_ID=
ANTHROPIC_WORKSPACE_ID=
HARNESS_URL=http://10.20.0.11:8080
MIMIR_URL=http://10.20.0.10:9009/prometheus
LOKI_URL=http://10.20.0.10:3100
K8S_API=https://10.10.0.10:6443
# Jev gates (2026-10-08): off | shadow | enforce. shadow records TypeSafe System One answers (triage before the LLM, review after it)
# next to each diagnosis in ai.jev_shadow and in the harness diagnosis event without changing the disposition. enforce additionally
# downgrades a catalogue proposal to escalate when review.best_action disagrees with confidence >= 0.9 or target_valid < 0.5
# (campaign-2 report 3.3). Kept at shadow until the C-G1 re-run shows the rules catching a real misjudgement.
JEV_MODE=enforce
JEV_MODEL=jev-1.13.0