Configuration

Most Centaur settings come from Helm values and are rendered into service environment variables by service-specific templates under contrib/chart/templates/.

Use these as the main extension points:

Source	Use
`secretManager.existingSecretName`	Required runtime secrets such as database, Slack, sandbox signing, and 1Password credentials.
`api.extraEnv`	API feature flags, worker tuning, retention, observability, and deployment-specific overrides.
`apiRs.extraEnv`	Rust API feature flags, telemetry exporter settings, and deployment-specific overrides.
`apiRs.metrics.*`	Prometheus/VictoriaMetrics scrape metadata for the Rust API `/metrics` endpoint.
`slackbot.extraEnv`	Slackbot HTTP, Slack, feedback, and cross-org behavior.
`sandbox.extraEnv`	Extra variables copied into every sandbox pod through `KUBERNETES_SANDBOX_EXTRA_ENV`.
`overlays.sources`	Ordered repo-cache-backed overlay repos for tools, workflows, and skills; subdirs default to `tools`, `workflows`, and `.agents/skills`.
`overlay.systemPrompt`	Small inline prompt overlay escape hatch.

Tool credentials are not listed here. Tool plugins declare their own secrets in tools/**/pyproject.toml; Centaur resolves them through secret(...) and iron-proxy instead of treating them as global platform configuration.

Required

These must exist for the normal Helm deployment. For local development, just bootstrap-secrets creates centaur-infra-env from your shell.

Env var	Set from	Controls
`DATABASE_URL`	`secretManager.existingSecretName`; local bootstrap generates it.	API and Slackbot Postgres connection.
`SLACK_SIGNING_SECRET`	`secretManager.existingSecretName`; local bootstrap reads shell env.	Slack request signature verification.
`SLACKBOT_API_KEY`	`secretManager.existingSecretName`; local bootstrap reads shell env.	Static API key bootstrapped for Slackbot.
`SLACK_BOT_TOKEN`	`secretManager.existingSecretName`; local bootstrap reads shell env.	Slack Web API access for Slackbot and api-rs Slack helpers.
`SANDBOX_SIGNING_KEY`	`secretManager.existingSecretName`; local bootstrap generates it.	Signing key for short-lived sandbox API tokens.
`IRON_MANAGEMENT_API_KEY`	`secretManager.existingSecretName`; local bootstrap generates it.	Management key for API-created iron-proxy pods.
`IRON_BROKER_TOKEN`	`secretManager.existingSecretName`; required when `tokenBroker.enabled=true`.	Bearer token iron-proxy presents to iron-token-broker and the broker enforces on its HTTP API.
`OP_SERVICE_ACCOUNT_TOKEN`	Local shell, then `centaur-infra-env`; production Secret.	1Password service-account auth when using `onepassword` secret source.
`OP_VAULT`	Local shell, then `centaur-infra-env`; defaults to `ai-agents` in code.	1Password vault used for `op://...` secret refs.

Optional required-by-mode variables:

Env var	Set from	Controls
`OP_CONNECT_CREDENTIALS_FILE`	Local shell before `just deploy`.	Enables the 1Password Connect subchart and creates its credentials Secret.
`OP_CONNECT_TOKEN`	Secret or local bootstrap shell env.	Token used by iron-proxy when `ironProxy.secretSource=onepassword-connect`.
`LOCAL_DEV_API_KEY`	API env.	Static local admin/dev key bootstrapped into Postgres.
`TEAMS_BOT_APP_ID`, `TEAMS_BOT_APP_PASSWORD`, `TEAMS_BOT_APP_TENANT_ID`	Local shell before `just bootstrap-secrets`; production Secret.	Required by Teamsbot when `teamsbot.enabled=true`.
`TEAMSBOT_API_KEY`	`secretManager.existingSecretName`; local bootstrap generates it when Teams credentials are present and it is omitted.	Static API key used by Teamsbot.

API

Env var	Set from	Controls
`CENTAUR_DEFAULT_HARNESS`	`api.defaultHarness`.	Default harness for new executions.
`CENTAUR_ENVIRONMENT`	`api.extraEnv` or deployment env.	Environment label in traces and telemetry.
`CENTAUR_LOG_LEVEL`, `LOG_LEVEL`	Helm sets `CENTAUR_LOG_LEVEL=info`; override in `api.extraEnv`.	API log level.
`CENTAUR_SERVICE_NAME`	`api.extraEnv`.	Default API log `service` field.
`SHUTDOWN_DRAIN_TIMEOUT_S`	`api.extraEnv`.	Graceful shutdown wait for in-flight HTTP requests.
`EXECUTION_WORKER_ENABLED`	`api.executionWorkerEnabled`.	Starts the durable agent execution worker.
`WORKFLOW_WORKER_ENABLED`	`api.workflowWorkerEnabled`.	Starts the durable workflow worker.
`WARM_POOL_ENABLED`	`api.warmPoolEnabled`.	Starts warm sandbox replenishment.
`PLUGIN_WATCHER_ENABLED`	`api.pluginWatcherEnabled`.	Enables tool and workflow hot-reload watchers.
`TOOL_DIRS`, `PLUGINS_DIR`	Chart-rendered from `overlays.sources[*].toolsSubdir` (default `tools`); fallback to `PLUGINS_DIR`.	Tool discovery paths.
`WORKFLOW_DIRS`	Chart-rendered from `overlays.sources[*].workflowsSubdir` (default `workflows`).	Workflow discovery paths.
`SLACKBOT_URL`	Chart-rendered Slackbot service URL.	API callback target for Slack delivery.
`FINAL_DELIVERY_MAX_ATTEMPTS`, `FINAL_DELIVERY_READY_GRACE_S`	`api.extraEnv`.	Final-delivery retry and claim timing.
`CENTAUR_ENABLE_GCLOUD_BOOTSTRAP`, `GCP_GCLOUD_CREDENTIAL`, `GCLOUD_PROJECT`	`api.extraEnv` or Secret.	Optional gcloud ADC bootstrap in the API container.
`CLAUDE_MODEL`, `CODEX_MODEL`	`api.extraEnv` or request model override.	Harness model selection defaults. When set via `sandbox.extraEnv`, the chart also mirrors them into slackbotv2 and the Console so their model displays track the deployment.

API-RS

Env var or value	Set from	Controls
`RUST_LOG`	Chart sets `info`; override with `apiRs.extraEnv`.	Rust tracing filter for the API-RS binary and crates.
`OTEL_SERVICE_NAME`	`apiRs.extraEnv`; defaults to `centaur-api-rs`.	OpenTelemetry service name used by trace backends.
`CENTAUR_ENVIRONMENT`, `DEPLOY_ENV`, `ENVIRONMENT`	`apiRs.extraEnv` or deployment env.	Deployment environment resource attribute for telemetry.
`OTEL_TRACES_EXPORTER`	`apiRs.extraEnv`.	Set to `otlp` to force OTLP trace export, or `none`/`off` to disable it.
`OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`	`apiRs.extraEnv`.	Enables OTLP trace export to Tempo, Jaeger, or another OTLP collector.
`apiRs.metrics.scrapeAnnotations`	Helm value, default `true`.	Adds Prometheus scrape annotations to the API-RS Pod template and Service.
`apiRs.metrics.path`	Helm value, default `/metrics`.	Metrics scrape path for annotation-based discovery.
`apiRs.metrics.annotations`	Helm value.	Additional scrape annotations for Prometheus-compatible collectors.
`apiRs.activitySummary.*`	Helm values, default disabled.	Enables API-RS to summarize live session activity into durable `session.activity_summary` events.
`SLACK_BOT_TOKEN`	Explicit `secretKeyRef` from `secretManager.existingSecretName`.	Slack Web API access for api-rs Slack proxy and workflow Slack helpers.
`OPENAI_API_KEY`	Secret mounted into api-rs, or `apiRs.extraEnv` for local/dev overrides.	OpenAI credential for activity summaries; the feature stays disabled when no key is present.
`SESSION_ACTIVITY_SUMMARY_MODEL`	`apiRs.activitySummary.model`, default `gpt-5.4-nano`.	Model used for the short live activity sentence.

Sandbox lifecycle:

Env var or value	Set from	Controls
`SESSION_IDLE_TIMEOUT_MS`	`slackbotv2.extraEnv`; default is up to 3 hours.	Slackbot v2 execute idle timeout. After an execution reaches a terminal state, api-rs pauses the sandbox if no newer execution has used that sandbox. If `SESSION_MAX_DURATION_MS` is lower than 3 hours and this value is unset, Slackbot v2 caps the default idle timeout to the max duration.
`SESSION_MAX_DURATION_MS`	`slackbotv2.extraEnv`.	Optional per-execution max duration forwarded to api-rs. api-rs rejects requests where `idle_timeout_ms` is greater than `max_duration_ms`.
`apiRs.sandboxMaxLifetimeSecs` / `SESSION_SANDBOX_MAX_LIFETIME_SECS`	Helm value, default `259200` (72 hours).	Restart-surviving sandbox deletion backstop. The reaper stops any non-terminal sandbox older than this, regardless of whether it is running or suspended. Set `0` to disable max-lifetime reaping.
`apiRs.sandboxReapIntervalSecs` / `SESSION_SANDBOX_REAP_INTERVAL_SECS`	Helm value, default `300`.	How often api-rs sweeps observed sandboxes for max-lifetime expiry.

There is no separate suspended-only delete timer. Pausing is controlled by the per-execution idle timeout; deletion is controlled by sandbox max lifetime.

Execution tuning:

Env var	Set from	Controls
`EXECUTION_WORKER_CONCURRENCY`	`api.extraEnv`.	Max concurrent execution claims.
`EXECUTION_RESERVED_USER_SLOTS`	`api.extraEnv`.	Worker slots reserved for user-facing requests.
`EXECUTION_WORKER_LEASE_S`	`api.extraEnv`.	Execution claim lease duration.
`EXECUTION_SILENCE_TIMEOUT_S`, `EXECUTION_TOOL_SILENCE_TIMEOUT_S`, `EXECUTION_HARD_TIMEOUT_S`	`api.extraEnv`.	Execution watchdog and absolute timeouts.
`EXECUTION_WATCHDOG_POLL_S`, `EXECUTION_RECONCILE_INTERVAL_S`, `EXECUTION_STALE_RECOVERY_INTERVAL_S`	`api.extraEnv`.	Execution watchdog and reconciliation cadence.
`EXECUTION_RECONCILE_STARTUP_LIMIT`	`api.extraEnv`.	Max interrupted executions recovered at startup.
`EXECUTION_STREAM_EOF_RETRY_DELAY_S`	`api.extraEnv`.	Delay before retrying interrupted sandbox streams.
`THREAD_FAILURE_LOOP_WINDOW_S`, `THREAD_FAILURE_LOOP_THRESHOLD`	`api.extraEnv`.	Repeated thread failure detection.
`IDLE_TTL_S`, `SUSPENDED_RETENTION_S`, `MAX_ACTIVE_SANDBOX_SESSIONS`	`api.extraEnv`.	Sandbox cleanup limits.
`STREAM_EOF_REATTACH_MAX`, `STREAM_EOF_REATTACH_BACKOFF_S`	`api.extraEnv`.	Stream reattach retry behavior.
`SANDBOX_CROSS_THREAD_READS`	`api.extraEnv`.	Lets a sandbox token read any thread it has the key for (messages, status, attachments). Defaults to enabled. Set to `0` to confine reads to the token's own thread. Writes are always confined regardless.

Slackbot

Env var	Set from	Controls
`NODE_ENV`	Runtime env.	Development route listing and telemetry environment fallback.
`PORT`	Runtime env.	Slackbot HTTP port.
`SLACK_API_URL`	`slackbot.extraEnv`.	Optional Slack Web API base URL override.
`CENTAUR_API_URL`	Chart-rendered API service URL.	API base URL used by Slackbot.
`CENTAUR_SLACK_EVENTS_PATH`	`slackbot.extraEnv`.	Slack Events API route; defaults to `/api/webhooks/slack`.
`RUNTIME_ERROR_ALERT_CHANNEL`	`slackbot.runtimeErrorAlertChannel`.	Slack channel for runtime error alerts.
`SLACK_EVENT_DEDUP_TTL_MS`	`slackbot.extraEnv`.	Slack event dedupe window.
`SLACK_SIGNATURE_MAX_AGE_SECONDS`	`slackbot.extraEnv`.	Maximum accepted Slack signature age.
`LINEAR_API_KEY`	Secret or `slackbot.extraEnv`.	Enables Slack feedback commands to create Linear issues.
`SLACK_FEEDBACK_COMMANDS`, `SLACK_FEEDBACK_ALLOWED_CHANNELS`	`slackbot.extraEnv`.	Feedback slash commands and optional channel allowlist.
`SLACK_FEEDBACK_LINEAR_TEAM_ID`, `SLACK_FEEDBACK_LINEAR_PROJECT_ID`	`slackbot.extraEnv`.	Linear destination for feedback issues.
`SLACKBOT_EXTERNAL_ORG_ALLOWLIST`	`slackbot.extraEnv`.	Slack team ids allowed for external org handoff.
`SLACK_TEAM_ID`	`slackbot.extraEnv`.	Workspace team ID (e.g. `T01ABCD2EFG`) used to rewrite `https://*.slack.com/archives/...` URLs in final-delivery messages into native `slack://channel?team=...` deep links that open in the Slack app. Leave unset to keep archive URLs unchanged.
`COMMIT_SHA`	Build/deploy env.	Commit shown in Slackbot metadata.

Teamsbot

Env var	Set from	Controls
`PORT`	Runtime env.	Teamsbot HTTP port; defaults to `3100`.
`LOG_LEVEL`	Runtime env.	Teamsbot JSON log level: `debug`, `info`, `warn`, `error`, or `silent`.
`CENTAUR_API_URL`	Chart-rendered API service URL.	API base URL used by Teamsbot; local default is `http://127.0.0.1:8080`.
`CENTAUR_API_KEY`, `TEAMSBOT_API_KEY`	Secret/env fallback.	Static API key used by Teamsbot to call the API.
`TEAMSBOT_DATABASE_URL`, `DATABASE_URL`, `POSTGRES_URL`	Secret.	Teamsbot Postgres state store. The service refuses to boot without one unless tests/dev inject a state store.
`TEAMSBOT_STATE_KEY_PREFIX`	Runtime env.	Postgres state namespace; defaults to `centaur-teamsbot`.
`TEAMS_BOT_APP_ID`, `TEAMS_BOT_APP_PASSWORD`, `TEAMS_BOT_APP_TENANT_ID`	Secret.	Required Bot Framework app credentials.
`TEAMS_ALLOWED_TEAM_IDS`, `TEAMS_ALLOWED_CHANNEL_IDS`, `TEAMS_ALLOWED_TENANT_IDS`	`teamsbot.allowedTeamIds`, `teamsbot.allowedChannelIds`, `teamsbot.allowedTenantIds`.	Comma-separated allowlists. Empty means Teamsbot ignores all Teams messages. Personal chats require an allowed tenant id.
`TEAMS_REQUIRE_MENTION`	`teamsbot.requireMention`.	Requires a bot mention before activating a thread; defaults to `true`.
`TEAMS_DEFAULT_HARNESS_TYPE`	`sandbox.harnessEngine`.	Default harness requested for new Teams sessions. Existing harness conflicts retry on the session's current harness.
`SESSION_IDLE_TIMEOUT_MS`, `SESSION_MAX_DURATION_MS`	Runtime env.	Forwarded to api-rs execute. `TEAMS_IDLE_TIMEOUT_MS` and `TEAMS_MAX_DURATION_MS` override these for Teams only.
`TEAMS_ACTIVE_EXECUTION_TTL_MS`	Runtime env.	Stale execution timeout used to unwedge Teams threads after crashes.
`TEAMS_DOWNLOAD_ATTACHMENTS`	`teamsbot.downloadAttachments`.	Enables allowed Teams attachment downloads into base64 payloads; defaults to `false`.
`TEAMS_ATTACHMENT_MAX_BYTES`, `TEAMS_ATTACHMENT_ALLOWED_HOSTS`	Runtime env.	Attachment download size cap and HTTPS host allowlist.
`TEAMS_GRAPH_BEARER_TOKEN`, `TEAMS_GRAPH_TOKEN_SCOPE`	Runtime env or Secret.	Optional Graph auth fallback for Graph/SharePoint-backed attachment URLs.

Sandbox

API-set variables:

Env var	Set from	Controls
`AGENT_IMAGE`	`sandbox.image.*`.	Sandbox image used by the Kubernetes backend.
`AGENT_API_URL`	Chart-rendered API service URL.	Source for sandbox `CENTAUR_API_URL`; required by Kubernetes backend.
`CENTAUR_API_URL`, `CENTAUR_THREAD_KEY`, `CENTAUR_TRACE_ID`	API sandbox creation.	API callback, thread key, and trace id.
`AMP_MODE`, `AMP_THREAD_VISIBILITY`, `AMP_CONTINUE_THREAD_ID`	API env or resume path.	Amp mode and resume behavior.
`FIREWALL_HOST`, `HTTPS_PROXY`, `HTTP_PROXY`, `NO_PROXY` and lowercase variants	API sandbox creation.	Routes sandbox egress through per-sandbox iron-proxy.
`NODE_EXTRA_CA_CERTS`, `REQUESTS_CA_BUNDLE`, `SSL_CERT_FILE`, `GIT_SSL_CAINFO`	API sandbox creation.	Trust bundle for proxied TLS.
`PG_PROXY_PASSWORD_<SECRET_NAME>`, `<PG_DSN_SECRET_NAME>`	API per-sandbox proxy creation.	Proxied Postgres credentials for tools that declare `pg_dsn` secrets.

Kubernetes backend:

Env var	Set from	Controls
`KUBERNETES_NAMESPACE`, `POD_NAMESPACE`, `KUBERNETES_KUBECONFIG`	Chart namespace, downward API, or `api.extraEnv`.	Kubernetes client namespace/config.
`KUBERNETES_AGENT_IMAGE_PULL_POLICY`, `KUBERNETES_SANDBOX_IMAGE_PULL_SECRETS`	`sandbox.image.pullPolicy`, `global.imagePullSecrets`.	Sandbox image pull behavior.
`KUBERNETES_SANDBOX_RUNTIME_CLASS_NAME`, `KUBERNETES_SANDBOX_SERVICE_ACCOUNT_NAME`	`sandbox.runtimeClassName`, `api.extraEnv`.	Pod runtime class and service account.
`KUBERNETES_SANDBOX_CPU_LIMIT`, `KUBERNETES_SANDBOX_MEMORY_LIMIT`, `KUBERNETES_SANDBOX_CPU_REQUEST`, `KUBERNETES_SANDBOX_MEMORY_REQUEST`	`sandbox.resources.*`.	Sandbox pod resources.
`KUBERNETES_SANDBOX_READY_TIMEOUT_S`, `KUBERNETES_ATTACH_LOG_TAIL_LINES`	`api.extraEnv`.	Sandbox readiness and attach diagnostics.
`SESSION_SANDBOX_RUNNING_LIMIT`, `SESSION_SANDBOX_HOT_IDLE_GRACE_SECS`	`apiRs.sandboxRunningLimit`, `apiRs.sandboxHotIdleGraceSecs`.	Capacity admission for running-like sandboxes; discards ready warm sandboxes first, then pauses least-recently-active idle sessions outside the grace window.
`SESSION_SANDBOX_CLEANUP_INTERVAL_SECS`, `SESSION_SANDBOX_IDLE_CLEANUP_BACKSTOP_SECS`	`apiRs.sandboxCleanupIntervalSecs`, `apiRs.sandboxIdleCleanupBackstopSecs`.	DB-aware cleanup of unreferenced sandboxes and restart recovery for idle pauses. Persisted `idle_timeout_ms` is honored after restart; the backstop is the fallback for older execution rows without that metadata.
`KUBERNETES_SANDBOX_EXTRA_ENV`	`sandbox.extraEnv`.	JSON list copied into each sandbox.
`KUBERNETES_WORKFLOW_DIRS`	Chart-rendered from `overlays.sources[*].workflowsSubdir` (default `workflows`) using the sandbox repo-cache mount prefix.	Workflow-host sandbox discovery paths.
`KUBERNETES_FIREWALL_CA_SECRET_NAME`, `KUBERNETES_FIREWALL_CA_KEY_SECRET_NAME`	`firewall.existingCa*` or generated CA Secrets.	CA material for sandbox/proxy TLS interception.
`KUBERNETES_SECRET_ENV_NAME`, `KUBERNETES_SECRET_ENV_PREFIX`, `KUBERNETES_BOOTSTRAP_SECRET_NAME`	`secretManager.*`, `secrets.bootstrapSecretName`.	Secrets read by API-created proxy/sandbox pods.
`KUBERNETES_IRON_PROXY_IMAGE`, `KUBERNETES_IRON_PROXY_IMAGE_PULL_POLICY`, `KUBERNETES_IRON_PROXY_PORT`, `KUBERNETES_IRON_PROXY_MANAGEMENT_PORT`, `KUBERNETES_IRON_PROXY_HEALTH_PORT`	`ironProxy.*`.	Per-sandbox iron-proxy image and ports.
`FIREWALL_MANAGER_SECRET_SOURCE`, `FIREWALL_MANAGER_SECRET_TTL`, `KUBERNETES_FIREWALL_MANAGER_SECRET_SOURCE`	`ironProxy.secretSource`, `ironProxy.secretTtl`.	Secret source and cache TTL for rendered proxy config.
`FIREWALL_MANAGER_TOKEN_BROKER_TTL`	`tokenBroker.ttl`.	Proxy-side cache TTL for access tokens minted by iron-token-broker. Applied to every `brokered_token` secret.
`KUBERNETES_TOKEN_BROKER_NAME`, `KUBERNETES_TOKEN_BROKER_URL`	`tokenBroker.*`.	iron-token-broker Deployment name and ClusterIP URL. The chart owns the broker Deployment, Service, and NetworkPolicies; the API reconciles its ConfigMap and triggers a rolling restart when the rendered content changes.
`KUBERNETES_OP_CONNECT_HOST`, `KUBERNETES_OP_CONNECT_APP_NAME`, `KUBERNETES_OP_CONNECT_PORT`	Chart helper or `api.extraEnv`.	1Password Connect endpoint details.
`KUBERNETES_API_POD_LABEL_SELECTOR`	Chart-rendered labels or `api.extraEnv`.	API pod selector for API-managed proxy policies.
`KUBERNETES_EGRESS_DISCOVERY_ENABLED`, `KUBERNETES_EGRESS_SERVICE_NAMESPACE`, `KUBERNETES_CLUSTER_DOMAIN`, `KUBERNETES_EGRESS_TAILNET_FQDN_ANNOTATION`	`api.egressDiscovery.*`.	Egress service discovery for sandbox NetworkPolicies.
`REPOS_PATH`	`sandbox.reposPath`.	Repo cache path mounted into sandboxes.

Sandbox entrypoint and wrappers:

Env var	Set from	Controls
`CENTAUR_HARNESS_CONFIG_DIR`, `CENTAUR_HARNESS_ADAPTER`	Sandbox image or `sandbox.extraEnv`.	Harness config directory and optional adapter executable.
`CENTAUR_SKILL_DIRS`	Chart-rendered from `overlays.sources[*].skillsSubdir` (default `.agents/skills`) through `SESSION_SANDBOX_EXTRA_ENV`.	Ordered skill directories copied into the agent workspace.
`AGENT_REPO`, `AGENT_PERSONA`	Runtime assignment metadata.	Workspace repo clone and persona prompt.
`GOOGLE_APPLICATION_CREDENTIALS`	Sandbox entrypoint or `sandbox.extraEnv`.	Google ADC path; entrypoint creates a local stub when unset.
`CODEX_API_KEY`, `CODEX_HOME`, `CODEX_CONTINUE_THREAD_ID`	`sandbox.extraEnv` or runtime resume.	Codex auth/config/resume behavior.
`CODEX_AUTH_MODE`	`sandbox.extraEnv`.	Codex auth flow: `api_key` (default, hits `api.openai.com`) or `access_token` (hits `chatgpt.com` via the brokered ChatGPT login). See Codex Auth Modes.
`META_AI_API_KEY`	Secret mounted into api-rs.	Meta AI direct credential for Codex provider `responses` and Slack or Linear `--meta` selection.
`CODEX_MODEL_REASONING_SUMMARY`	`sandbox.extraEnv`.	Sets `model_reasoning_summary` in the Codex config (`auto`, `concise`, `detailed`, `none`). Codex >= 0.139 emits no reasoning summaries unless this is set, so renderers show no thinking trace.
`CODEX_MODEL_REASONING_EFFORT`	`sandbox.extraEnv`.	Overrides the codex `model_reasoning_effort` (baked into `harness/codex/config.toml`) by patching the per-sandbox `~/.codex/config.toml` at boot, without forking the image. One of `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`; an unknown value is ignored (the config default stands).
`CLAUDE_MODEL`, `CLAUDE_CONTINUE_SESSION_ID`	`sandbox.extraEnv` or runtime resume.	Claude model and resume behavior.
`CLAUDE_CODE_AUTH_MODE`	`sandbox.extraEnv`.	Claude Code auth flow: `api_key` (default, uses `ANTHROPIC_API_KEY`) or `access_token` (Claude.ai Pro or Max via the brokered OAuth login). See Claude Auth Modes.
`DEPLOY_ENV`, `ENVIRONMENT`, `TRACEPARENT`	Deployment env or wrapper-generated.	Runtime environment and trace context.
`CALL_TIMEOUT_SECONDS`	Sandbox env before running `call`.	Curl watchdog for API tool calls.
`SLACK_CHANNEL`, `SLACK_THREAD_TS`	Sandbox env.	File-upload helper target.

Workflows

Env var	Set from	Controls
`WORKFLOW_WORKER_CONCURRENCY`, `WORKFLOW_WORKER_LEASE_S`	`api.extraEnv`.	Workflow worker pool size and lease duration.
`WORKFLOW_RECONCILE_INTERVAL_S`, `WORKFLOW_RESUSPEND_BACKOFF_S`	`api.extraEnv`.	Workflow claim/reclaim cadence.
`WORKFLOW_SCHEDULE_TICK_INTERVAL_S`, `WORKFLOW_SCHEDULE_CATCHUP_LIMIT`, `WORKFLOW_SCHEDULE_MISFIRE_GRACE_S`	`api.extraEnv`.	Scheduled workflow timing and catch-up behavior.
`MY_THREAD_KEY`, `<WORKFLOW_NAME>_THREAD_KEY`, `<WORKFLOW_NAME>_SLACK_CHANNEL`	Workflow-specific env.	Fallback thread/channel targets for workflow agent steps.
`<WEBHOOK_SECRET_REF>`	API env or Secret named by a workflow `WebhookSpec`.	HMAC secret for public workflow webhooks, for example `GITHUB_WEBHOOK_SECRET`.

Slack ETL workflows:

Env var	Set from	Controls
`SLACK_ETL_ENABLED`	`apiRs.etl.slack.enabled`.	Master switch for Slack sync/backfill/context schedules.
`SLACK_SYNC_INTERVAL_SECONDS`, `SLACK_BACKFILL_INTERVAL_SECONDS`, `COMPANY_CONTEXT_DOCUMENTS_INTERVAL_SECONDS`	`apiRs.etl.slack.syncIntervalSeconds`, `apiRs.etl.slack.backfill.intervalSeconds`, `apiRs.etl.companyContextDocuments.intervalSeconds`.	Slack ETL schedule intervals.
`SLACK_SYNC_BACKFILL_LOOKBACK_DAYS`, `SLACK_SYNC_THREAD_LOOKBACK_DAYS`	`apiRs.etl.slack.syncBackfillLookbackDays`, `apiRs.etl.slack.syncThreadLookbackDays`.	Slack history/thread lookback windows.
`SLACK_SYNC_INDEX_PRIVATE_CHANNELS`	`apiRs.etl.slack.indexPrivateChannels`.	Includes private channels visible to the ETL token.
`SLACK_ETL_EXCLUDED_CHANNEL_PATTERNS`	`apiRs.etl.slack.excludedChannelPatterns`.	Comma-separated channel-name globs to skip.
`SLACK_BACKFILL_ENABLED`, `SLACK_BACKFILL_CHANNEL_BATCH_LIMIT`, `SLACK_BACKFILL_CHANNEL_PAGES_PER_JOB`	`apiRs.etl.slack.backfill.*`.	Backfill enablement and batch sizing.
`SLACK_RETENTION_ENABLED`, `SLACK_RETENTION_INTERVAL_MINUTES`, `SLACK_ETL_RETENTION_DAYS`, `SLACK_DM_RETENTION_DAYS`	`apiRs.etl.slack.retention.*`.	Slack retention enablement, cadence, and separate public ETL/DM TTLs.
`COMPANY_CONTEXT_DOCUMENTS_ENABLED`	`apiRs.etl.companyContextDocuments.enabled`.	Enables company-context projection when any ETL is on.
`COMPANY_CONTEXT_DOCUMENTS_MAX_WINDOW_SECONDS`	`apiRs.etl.companyContextDocuments.maxWindowSeconds`.	Maximum source `updated_at` window projected by one company-context documents run.

Google Workspace ETL workflows:

Env var	Set from	Controls
`GOOGLE_DRIVE_ETL_ENABLED`	`apiRs.etl.googleDrive.enabled`.	Enables Google Drive Docs sync.
`GOOGLE_DRIVE_SYNC_INTERVAL_SECONDS`	`apiRs.etl.googleDrive.syncIntervalSeconds`.	Google Drive Docs sync schedule interval.
`GOOGLE_CALENDAR_ETL_ENABLED`	`apiRs.etl.googleCalendar.enabled`.	Enables Google Calendar sync.
`GOOGLE_CALENDAR_SYNC_INTERVAL_SECONDS`	`apiRs.etl.googleCalendar.syncIntervalSeconds`.	Google Calendar sync schedule interval.

Linear ETL workflows:

Env var	Set from	Controls
`LINEAR_ETL_ENABLED`	`apiRs.etl.linear.enabled`.	Enables Linear project/issue/comment sync.
`LINEAR_SYNC_INTERVAL_SECONDS`	`apiRs.etl.linear.syncIntervalSeconds`.	Linear sync schedule interval.

Observability and Retention

Env var	Set from	Controls
`VICTORIAMETRICS_URL`, `VICTORIAMETRICS_PUSH_ENABLED`	`api.extraEnv`, `api.victoriaMetricsPushEnabled`.	Push-based API metrics.
`apiRs.metrics.*`	Helm values.	Pull-based scrape metadata for API-RS Prometheus metrics.
`CENTAUR_RETENTION_ATTACHMENTS_TTL_DAYS`, `CENTAUR_RETENTION_TRANSCRIPTS_TTL_DAYS`	`api.extraEnv`.	Attachment/transcript retention TTLs.
`CENTAUR_RETENTION_SWEEP_INTERVAL_SECONDS`, `CENTAUR_RETENTION_BATCH_SIZE`, `CENTAUR_RETENTION_DRY_RUN`	`api.extraEnv`.	Retention sweep cadence, batch size, and dry-run mode.
`TOOL_CALL_TIMEOUT_S`, `TOOL_BINARY_INLINE_MAX_BYTES`, `TOOL_BINARY_PREVIEW_BYTES`	`api.extraEnv`.	Tool execution timeout and binary result handling.

Local Scripts

Env var	Set from	Controls
`CENTAUR_NAMESPACE`, `CENTAUR_RELEASE`	Local shell or `.env`.	Namespace/release used by `just` and debug scripts.
`JUST_BUILD_SEQUENTIAL`	Local shell.	Builds service images sequentially.
`CENTAUR_API_URL`	Local shell.	API target for contrib scripts.
`MUESLI_API_KEY`	Local shell.	API key for the Muesli meeting ingest helper.
`MUESLI_CLI`, `MUESLI_HOST`, `MUESLI_PUSH_LOG`, `MUESLI_SLACK_CHANNEL`	Local shell.	Muesli meeting ingest helper behavior.