.env.example

APP_NAME=Zephyrus
APP_ENV=local
APP_KEY=
APP_DEBUG=true
APP_URL=http://localhost
STEP_UP_TTL_SECONDS=600
OIDC_STEP_UP_MAX_AGE_SECONDS=300
OIDC_STEP_UP_AMR=mfa,otp,hwk,webauthn
OIDC_STEP_UP_ACR=
GOVERNED_CHANGE_TTL_SECONDS=604800

LOG_CHANNEL=stack
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug

# Remote PostgreSQL database connection
# Non-production processes that target pgsql.acumenus.net (or the production
# user/schema identity) are forced into PostgreSQL transaction read-only mode.
# Production migrations are available only through the guarded deploy workflow.
DB_CONNECTION=pgsql
DB_HOST=demo.zephyrus.care
DB_PORT=5432
DB_DATABASE=zephyrus
DB_USERNAME=postgres
DB_PASSWORD=
DB_SCHEMA=prod

BROADCAST_DRIVER=log
CACHE_DRIVER=file
FILESYSTEM_DISK=local
QUEUE_CONNECTION=database
DB_QUEUE_CONNECTION=pgsql
DB_QUEUE_TABLE=jobs
DB_QUEUE=default
DB_QUEUE_RETRY_AFTER=360
QUEUE_FAILED_DRIVER=database-uuids
SESSION_DRIVER=file
SESSION_LIFETIME=120
# Production defaults to encrypted Secure cookies when these are omitted.
# Local plain-HTTP development may explicitly set both to false.
# SESSION_ENCRYPT=false
# SESSION_SECURE_COOKIE=false
SESSION_HTTP_ONLY=true
SESSION_SAME_SITE=lax

# Bounded API ingress and named rate-limit classes. Defaults are production-safe;
# tune only from measured load and keep machine credentials scoped per integration.
API_MAX_REQUEST_BYTES=1048576
STAFFING_IMPORT_MAX_REQUEST_BYTES=10485760
RATE_LIMIT_PUBLIC_HEALTH=30
RATE_LIMIT_CREDENTIAL_EXCHANGE=5
RATE_LIMIT_WEB_API=120
RATE_LIMIT_SENSITIVE_WEB_API=30
RATE_LIMIT_MACHINE_INGEST=120
RATE_LIMIT_MACHINE_AGENT=60
RATE_LIMIT_MOBILE_AUTH=60
RATE_LIMIT_MOBILE_API=120
NIGHTINGALE_CONTEXT_KEY=
NIGHTINGALE_CONTEXT_TTL_MINUTES=15
RATE_LIMIT_PATIENT_ENROLLMENT=5
RATE_LIMIT_PATIENT_CREDENTIAL_EXCHANGE=5
RATE_LIMIT_PATIENT_AUTH=30
RATE_LIMIT_PATIENT_API=90

# Care-pathway governance and every downstream serving surface are independent
# kill switches. Keep all disabled until the corresponding release gate has
# explicit institutional approval and deployment evidence.
CARE_PATHWAYS_GOVERNANCE_ENABLED=false
CARE_PATHWAYS_CATALOG_ENABLED=false
CARE_PATHWAYS_ASSIGNMENT_ENABLED=false
CARE_PATHWAYS_ROUNDS_ENABLED=false
CARE_PATHWAYS_STAFF_MOBILE_ENABLED=false
CARE_PATHWAYS_PATIENT_ENABLED=false
CARE_PATHWAYS_EDDY_REFERENCE_ENABLED=false
CARE_PATHWAYS_EDDY_INSTANCE_ENABLED=false
CARE_PATHWAYS_WRITEBACK_ENABLED=false
# Synthetic, read-only journey. This does not activate any clinical surface.
CARE_PATHWAYS_DEMO_ENABLED=false

# Hummingbird Patient is an independent patient identity/API realm. Every
# capability remains fail-closed until its explicit deployment gate is enabled.
NIGHTINGALE_ENABLED=false
NIGHTINGALE_ENROLLMENT_ENABLED=false
NIGHTINGALE_TOKEN_EXCHANGE_ENABLED=false
NIGHTINGALE_PROFILE_ENABLED=false
NIGHTINGALE_SESSION_MANAGEMENT_ENABLED=false
NIGHTINGALE_ENCOUNTERS_ENABLED=false
NIGHTINGALE_TODAY_ENABLED=false
NIGHTINGALE_PATHWAY_ENABLED=false
NIGHTINGALE_PATHWAY_HISTORY_DRAFTS_ENABLED=false
NIGHTINGALE_PATHWAY_SOURCE_RECONCILIATION_ENABLED=false
NIGHTINGALE_PATHWAY_HISTORY_RELEASES_ENABLED=false
NIGHTINGALE_PATHWAY_HISTORY_CURRENT_AFTER_MINUTES=30
NIGHTINGALE_PATHWAY_HISTORY_STALE_AFTER_MINUTES=240
NIGHTINGALE_TEACH_BACK_ENABLED=false
NIGHTINGALE_CARE_PREFERENCES_ENABLED=false
NIGHTINGALE_GOALS_ENABLED=false
NIGHTINGALE_ROUNDS_QUESTIONS_ENABLED=false
NIGHTINGALE_ROUNDS_SUMMARY_ENABLED=false
NIGHTINGALE_CARE_TEAM_ENABLED=false
NIGHTINGALE_MESSAGING_ENABLED=false
# Required before enabling any patient feature outside automated tests. Use an
# independent random value of at least 32 characters; never reuse APP_KEY.
NIGHTINGALE_HMAC_SECRET=
NIGHTINGALE_POLICY_VERSION=patient-disclosure-v1-draft
NIGHTINGALE_ACCESS_TTL_MINUTES=15
NIGHTINGALE_REFRESH_TTL_DAYS=14
NIGHTINGALE_ENROLLMENT_MAX_ATTEMPTS=5
NIGHTINGALE_REFERENCE_PROVISIONING_ENABLED=false
NIGHTINGALE_REFERENCE_ENCRYPTION_KEY_VERSION=
NIGHTINGALE_REFERENCE_CHALLENGE_TTL_MINUTES=10
# Messaging additionally fails closed until a multidisciplinary-approved local
# policy supplies urgent-help language, response expectations, and key labels.
NIGHTINGALE_MESSAGING_POLICY_STATUS=draft_requires_approval
NIGHTINGALE_MESSAGING_POLICY_VERSION=
NIGHTINGALE_MESSAGING_URGENT_GUIDANCE_VERSION=
NIGHTINGALE_MESSAGING_URGENT_GUIDANCE_TEXT=
NIGHTINGALE_MESSAGING_DEFAULT_RESPONSE_WINDOW=
NIGHTINGALE_MESSAGING_ENCRYPTION_KEY_VERSION=
NIGHTINGALE_MESSAGING_ENCRYPTION_KEY=
# JSON object of version -> base64:... decryption-only keys retained during
# governed rotation. Load from protected secret storage; never commit values.
NIGHTINGALE_MESSAGING_PREVIOUS_ENCRYPTION_KEYS_JSON=
# Optional override for the fully qualified class implementing
# PatientMessageHandoffReadiness. The built-in database handoff consumer is the
# default, but still reports unavailable until its separate staff policy,
# pilot-unit pools, memberships, and fresh worker heartbeat are all ready.
NIGHTINGALE_MESSAGING_HANDOFF_CONSUMER=
NIGHTINGALE_STAFF_MESSAGING_ENABLED=false
NIGHTINGALE_STAFF_MESSAGING_POLICY_STATUS=draft_requires_approval
NIGHTINGALE_STAFF_MESSAGING_PILOT_UNIT_IDS=
NIGHTINGALE_STAFF_MESSAGING_HEARTBEAT_TTL_SECONDS=120
NIGHTINGALE_STAFF_MESSAGING_BATCH_SIZE=100

# Browser-origin policy. Same-origin browser requests do not require CORS.
# List only explicitly approved cross-origin browser clients; never use "*".
CORS_ALLOWED_ORIGINS=
CORS_SUPPORTS_CREDENTIALS=false
CORS_MAX_AGE=600

# CSP defaults to self. Add only the public Reverb/Vite development endpoints
# actually used by this deployment, separated by commas.
CSP_ENABLED=true
CSP_REPORT_ONLY=false
CSP_CONNECT_SOURCES="http://localhost:5176,ws://localhost:5176,ws://localhost:8080"

# Governed transport lifecycle. Capacity is enforced against active assignments;
# lower values take effect after currently reserved work is released.
TRANSPORT_HANDOFF_REQUIRED_TYPES=inpatient,transfer,ems,care_transition
TRANSPORT_MOBILE_CAPABILITIES=ambulatory,wheelchair,stretcher,bed,courier
TRANSPORT_DEFAULT_PER_PAGE=25
TRANSPORT_MAX_PER_PAGE=100
TRANSPORT_INTERNAL_TEAM_NAME="Summit Patient Transport"
TRANSPORT_INTERNAL_TEAM_CAPACITY=26
TRANSPORT_CRITICAL_CARE_TEAM_NAME="Critical Care Transport"
TRANSPORT_CRITICAL_CARE_TEAM_CAPACITY=4
TRANSPORT_RIDE_HEALTH_CAPACITY=12
TRANSPORT_UBER_HEALTH_CAPACITY=12
TRANSPORT_LYFT_HEALTHCARE_CAPACITY=12
TRANSPORT_CONTRACTED_AMBULANCE_CAPACITY=4

MEMCACHED_HOST=127.0.0.1

REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379

MAIL_MAILER=smtp
MAIL_HOST=mailpit
MAIL_PORT=1025
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_ADDRESS="hello@example.com"
MAIL_FROM_NAME="${APP_NAME}"

RESEND_API_KEY=

AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET=
AWS_USE_PATH_STYLE_ENDPOINT=false

BROADCAST_CONNECTION=reverb

# App credentials. KEY is public (it appears in the ws:// URL) and is hardcoded in
# the Hummingbird mobile build, so keep it "zephyrus-key". SECRET is server-only —
# generate a strong value in production (e.g. `openssl rand -hex 24`).
REVERB_APP_ID=zephyrus
REVERB_APP_KEY=zephyrus-key
REVERB_APP_SECRET=zephyrus-secret
REVERB_ALLOWED_ORIGINS=localhost

# Broadcaster TRIGGER target (where the app POSTs events). In production set this to
# the LOCAL daemon (127.0.0.1) so a publish never hairpins out through the TLS edge.
REVERB_HOST="localhost"
REVERB_PORT=8080
REVERB_SCHEME=http

# Where the Reverb daemon binds. Apache mod_proxy_wstunnel fronts /app -> here.
REVERB_SERVER_HOST=127.0.0.1
REVERB_SERVER_PORT=8080

# PUBLIC endpoint advertised to mobile/web clients (the TLS host Apache terminates).
# Leave unset in local dev — it falls back to REVERB_HOST/PORT/SCHEME above.
# In production: REVERB_PUBLIC_HOST=zephyrus.acumenus.net / PORT=443 / SCHEME=https.
REVERB_PUBLIC_HOST="${REVERB_HOST}"
REVERB_PUBLIC_PORT="${REVERB_PORT}"
REVERB_PUBLIC_SCHEME="${REVERB_SCHEME}"

VITE_APP_NAME="${APP_NAME}"
VITE_REVERB_APP_KEY="${REVERB_APP_KEY}"
VITE_REVERB_HOST="${REVERB_PUBLIC_HOST}"
VITE_REVERB_PORT="${REVERB_PUBLIC_PORT}"
VITE_REVERB_SCHEME="${REVERB_PUBLIC_SCHEME}"
# Browser realtime is same-origin by default. Set false to force polling/SSE,
# or explicitly allow a separately hosted, CSP-approved Reverb endpoint.
VITE_REALTIME_ENABLED=true
VITE_REVERB_ALLOW_CROSS_ORIGIN=false

# Authentik OIDC (ships disabled; enable after the zephyrus-oidc app + secrets exist)
# LOCAL_AUTH_ENABLED=false declares the SSO-only policy: local password creation
# is refused for every non-break-glass account (ADM-IAM).
LOCAL_AUTH_ENABLED=true
LOCAL_REGISTRATION_ENABLED=false

# Audit presentation: client IPs are withheld from audit surfaces after this
# many days; raw IPs/emails additionally require the manageIdentity capability.
AUDIT_IP_RETENTION_DAYS=90
OIDC_ENABLED=false
OIDC_DISCOVERY_URL=https://auth.acumenus.net/application/o/zephyrus-oidc/.well-known/openid-configuration
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
OIDC_REDIRECT_URI=https://zephyrus.acumenus.net/auth/oidc/callback
OIDC_ALLOWED_GROUPS="Zephyrus Users"
OIDC_ADMIN_GROUPS="Zephyrus Admins"
# OIDC outbound traffic fails closed. Every discovery/issuer/authorization/
# token/JWKS host must be explicitly approved. Private networks remain denied
# unless the deployment has a reviewed internal-IdP exception.
OIDC_REQUIRE_HTTPS=true
OIDC_ALLOWED_HOSTS=auth.acumenus.net
OIDC_ALLOWED_PORTS=443
OIDC_ALLOWED_REDIRECT_URIS=https://zephyrus.acumenus.net/auth/oidc/callback
OIDC_REQUIRE_DNS_RESOLUTION=true
OIDC_ALLOW_PRIVATE_NETWORKS=false
OIDC_CONNECT_TIMEOUT_SECONDS=3
OIDC_TIMEOUT_SECONDS=8
OIDC_MAX_RESPONSE_BYTES=1048576
OIDC_REQUIRE_CLIENT_SECRET=true

# Integration endpoint policy. Configuration writes fail closed until each
# approved DNS host is listed. Wildcards must include the leading "*." and do
# not match the parent domain. All resolved addresses must be public.
INTEGRATION_REQUIRE_HTTPS=true
INTEGRATION_ALLOWED_HOSTS=
INTEGRATION_ALLOWED_PORTS=443
INTEGRATION_REQUIRE_DNS_RESOLUTION=true
INTEGRATION_FRESH_AFTER_MINUTES=15
INTEGRATION_STALE_AFTER_MINUTES=60
# Warehouse administration cadence tolerance (minutes): nightly BCMA/eMAR
# batches stay cutoff-qualified ('batch') within this window, 'stale' beyond.
ANCILLARY_WAREHOUSE_STALE_AFTER_MINUTES=1860

# Eddy — Process-Aware AI Agent (ships DISABLED + LOCAL-ONLY; enable after the
# eddy service + a BAA-covered provider policy exist). The browser never calls
# Eddy directly. Provider secrets (ANTHROPIC_API_KEY etc.) are read ONLY by the
# eddy service from its own env — never expose them to Vite/the client.
EDDY_ENABLED=false
EDDY_BASE_URL=http://eddy:8000             # dev (compose); prod=http://127.0.0.1:8001 behind Apache ProxyPass /eddy/
EDDY_PORT=8090                              # docker-compose host port
EDDY_TIMEOUT_SECONDS=30
EDDY_SHARED_SECRET=                         # HMAC for Laravel<->Eddy request bodies
EDDY_CALLBACK_TOKEN=                        # bearer Eddy uses on non-user telemetry callbacks

# Arena — Part X OCPM sidecar (object-centric process mining). Laravel proxies to
# it and caches discovered maps in arena.maps; it is stateless + PHI-free.
ARENA_ENABLED=false
ARENA_BASE_URL=http://arena:8100           # dev (compose); prod=http://127.0.0.1:8100 (systemd/uvicorn) or the arena container
FLOW4D_CONFORMANCE_ENABLED=false           # 4D Navigator per-patient adherence surface (composes with ARENA_ENABLED; [SU] owns prod enablement)
FLOW4D_PATHWAY_PROGRESS_ENABLED=false      # 4D Navigator governed-pathway progress in the journey drawer (composes with CARE_PATHWAYS_ASSIGNMENT_ENABLED; DRG serving stays dark until [SU]/clinical sign-off — plan G-9). Demo overlay is separate (CARE_PATHWAYS_DEMO_ENABLED).

# Governed enterprise integration runtime. Keep the outbound allowlist exact;
# private key material stays outside the repository under the configured root.
INTEGRATION_ALLOWED_HOSTS=fhir.epic.com
INTEGRATION_ALLOWED_PORTS=443
INTEGRATION_REQUIRE_HTTPS=true
INTEGRATION_REQUIRE_DNS_RESOLUTION=true
INTEGRATION_SECRET_FILE_ROOT=/etc/zephyrus/secrets
INTEGRATION_SECRET_MAX_BYTES=65536
INTEGRATION_FILE_SECRETS_ENABLED=true
INTEGRATION_VAULT_ENABLED=false
INTEGRATION_VAULT_ADDR=
INTEGRATION_VAULT_TOKEN=
INTEGRATION_VAULT_NAMESPACE=
INTEGRATION_VAULT_KV_VERSION=2
INTEGRATION_VAULT_ALLOWED_MOUNTS=
INTEGRATION_AWS_SECRETS_ENABLED=false
INTEGRATION_AWS_ACCESS_KEY_ID=
INTEGRATION_AWS_SECRET_ACCESS_KEY=
INTEGRATION_AWS_SESSION_TOKEN=
INTEGRATION_AWS_ALLOWED_REGIONS=
INTEGRATION_AWS_SECRETS_ENDPOINT_TEMPLATE=https://secretsmanager.%s.amazonaws.com
INTEGRATION_GCP_SECRETS_ENABLED=false
INTEGRATION_GCP_ACCESS_TOKEN=
INTEGRATION_GCP_CREDENTIALS_FILE=
INTEGRATION_GCP_ALLOWED_PROJECTS=
INTEGRATION_GCP_SECRET_MANAGER_URL=https://secretmanager.googleapis.com
INTEGRATION_AZURE_KEYVAULT_ENABLED=false
INTEGRATION_AZURE_ACCESS_TOKEN=
INTEGRATION_AZURE_TENANT_ID=
INTEGRATION_AZURE_CLIENT_ID=
INTEGRATION_AZURE_CLIENT_SECRET=
INTEGRATION_AZURE_ALLOWED_VAULTS=
INTEGRATION_AZURE_AUTHORITY_HOST=https://login.microsoftonline.com
INTEGRATION_AZURE_VAULT_DNS_SUFFIX=vault.azure.net

# Encrypted clinical payload authority. The KEK reference must resolve to
# `base64:<32 random bytes>` through one configured integration secret provider.
# Local storage is for approved sealed-host deployments and is rejected in
# production unless explicitly authorized. A production object disk must use a
# separately installed/configured Laravel filesystem adapter with private access.
CLINICAL_PAYLOADS_ENABLED=false
CLINICAL_PAYLOADS_DISK=clinical-payloads
CLINICAL_PAYLOADS_LOCAL_ROOT=/var/lib/zephyrus/clinical-payloads
CLINICAL_PAYLOADS_KEK_REF=
CLINICAL_PAYLOADS_COMPRESSION=gzip
CLINICAL_PAYLOADS_COMPRESSION_LEVEL=6
CLINICAL_PAYLOADS_MAX_BYTES=10485760
CLINICAL_PAYLOADS_DEFAULT_RETENTION_POLICY=clinical-payload-default
CLINICAL_PAYLOADS_DEFAULT_RETENTION_DAYS=2555
CLINICAL_PAYLOADS_ALLOW_LOCAL_IN_PRODUCTION=false
CLINICAL_PAYLOADS_LEGACY_READ_ENABLED=true
CLINICAL_PAYLOADS_INTEGRITY_SAMPLE_LIMIT=25
CLINICAL_PAYLOADS_RETENTION_BATCH_LIMIT=100
CLINICAL_PAYLOADS_READINESS_PROBE_ENABLED=true
CLINICAL_PAYLOADS_READINESS_PROBE_TTL_SECONDS=60
# Production object storage: set CLINICAL_PAYLOADS_DISK=clinical-payloads-s3.
CLINICAL_PAYLOADS_S3_ACCESS_KEY_ID=
CLINICAL_PAYLOADS_S3_SECRET_ACCESS_KEY=
CLINICAL_PAYLOADS_S3_SESSION_TOKEN=
CLINICAL_PAYLOADS_S3_REGION=us-east-1
CLINICAL_PAYLOADS_S3_BUCKET=
CLINICAL_PAYLOADS_S3_ENDPOINT=
CLINICAL_PAYLOADS_S3_PATH_STYLE=false
CLINICAL_PAYLOADS_S3_SSE=aws:kms
CLINICAL_PAYLOADS_S3_KMS_KEY_ID=

INTEGRATION_HEALTH_TIMEOUT_SECONDS=10
INTEGRATION_OBSERVATION_FRESH_SECONDS=180
INTEGRATION_RETRY_BUDGET_PER_RUN=3
INTEGRATION_CIRCUIT_BREAKER_TRIP_FAILURES=5
INTEGRATION_CIRCUIT_BREAKER_OPEN_SECONDS=60
INTEGRATION_CIRCUIT_BREAKER_HALF_OPEN_LEASE_SECONDS=30
INTEGRATION_RATE_LIMIT_DEFAULT_RETRY_SECONDS=60

# PHI-safe OpenTelemetry export (default off). Prefer a loopback Collector
# agent; remote endpoints require HTTPS and an explicit allowed host.
OBSERVABILITY_METRICS_ENABLED=false
OBSERVABILITY_EXPORTER=memory
OTEL_SERVICE_NAME=zephyrus
OTEL_SERVICE_NAMESPACE=zephyrus
OTEL_SERVICE_VERSION=unknown
OTEL_DEPLOYMENT_ENVIRONMENT=production
OTEL_EXPORTER_OTLP_ENDPOINT=http://127.0.0.1:4318
OTEL_EXPORTER_OTLP_ALLOWED_HOSTS=127.0.0.1,::1,localhost
OTEL_EXPORTER_OTLP_HEADERS_SECRET_REF=
OTEL_EXPORTER_OTLP_COMPRESSION=gzip
OTEL_EXPORTER_OTLP_TIMEOUT_SECONDS=0.25
OTEL_EXPORTER_OTLP_RETRY_DELAY_MS=50
OTEL_EXPORTER_OTLP_MAX_RETRIES=0
INTEGRATION_QUEUE_WARNING_DEPTH=25
INTEGRATION_QUEUE_CRITICAL_DEPTH=100
INTEGRATION_QUEUE_WARNING_AGE_SECONDS=120
INTEGRATION_QUEUE_CRITICAL_AGE_SECONDS=600
INTEGRATION_FHIR_POLL_CADENCE_MINUTES=15
INTEGRATION_FHIR_PAGE_SIZE=100
INTEGRATION_FHIR_PAGE_LIMIT=10
INTEGRATION_FHIR_RESOURCE_LIMIT=1000
EPIC_FHIR_CLIENT_ID=
EPIC_FHIR_PRIVATE_KEY_REF=
EPIC_FHIR_KEY_ID=
EPIC_FHIR_FACILITY_KEY=
SYNTHETIC_INTEGRATION_FACILITY_KEY=
EPIC_FHIR_BASE_URL=https://fhir.epic.com/interconnect-fhir-oauth/api/FHIR/R4
EPIC_SMART_CONFIGURATION_URL=https://fhir.epic.com/interconnect-fhir-oauth/api/FHIR/R4/.well-known/smart-configuration
EPIC_FHIR_TOKEN_URL=https://fhir.epic.com/interconnect-fhir-oauth/oauth2/token
ARENA_PORT=8110                            # docker-compose host port
ARENA_TIMEOUT_SECONDS=60
ARENA_CACHE_TTL_SECONDS=900                # discovered-map cache lifetime
ARENA_AI_ENABLED=false                     # Part X (X4) governed AI copilot; independent of ARENA_ENABLED, ships off
ARENA_AI_FITNESS_FLOOR=0.80                # withhold a copilot-proposed map below this DFG-fitness (conformance gate)

# Administration system-health evidence. The backup marker is written only by
# the backup verifier after a successful, restorable backup check. The TLS path
# points to the public certificate (never a private key). Blank means unknown.
ADMIN_HEALTH_FRESH_FOR_SECONDS=180
ADMIN_HEALTH_EXPECTED_DB_REPLICAS=0
ADMIN_HEALTH_BACKUP_EVIDENCE_PATH=
ADMIN_HEALTH_BACKUP_WARNING_AGE_HOURS=26
ADMIN_HEALTH_BACKUP_CRITICAL_AGE_HOURS=48
ADMIN_HEALTH_TLS_CERTIFICATE_PATH=
ADMIN_HEALTH_TLS_WARNING_DAYS=30
ADMIN_HEALTH_TLS_CRITICAL_DAYS=14
ADMIN_HEALTH_RUNBOOK_BASE_URL=

# Virtual Rounds — asynchronous/hybrid multidisciplinary rounds (plan
# 2026-07-11-virtual-rounds-4d-eddy). Flags gate routes/UI/jobs; off = 404
# invisible, existing audit data is never deleted. Later-phase flags ship off.
VIRTUAL_ROUNDS_ENABLED=false
VIRTUAL_ROUNDS_FAMILY_ENABLED=false        # Phase 5: guest RSVP/questions surface
VIRTUAL_ROUNDS_WRITEBACK_ENABLED=false     # Phase 7: EHR writeback adapter
VIRTUAL_ROUNDS_EDDY_ENABLED=false          # Phase 6: Eddy rounds tour (shadow mode)
VIRTUAL_ROUNDS_EXTERNAL_NOTIFICATIONS_ENABLED=false  # Phases 4-5: outbound channels
VIRTUAL_ROUNDS_PATIENT_QUESTION_BRIDGE_ENABLED=false # Staff-mediated patient-message promotion only

# Home Hospital (HOME) — acute Hospital-at-Home virtual ward (ACUM-PRD-HAH-001,
# docs/home-hospital/). Flags gate routes/nav/seeds; off = 404 invisible,
# existing episode/audit data is never deleted. Later-phase flags ship off.
HOME_HOSPITAL_ENABLED=false
HOME_HOSPITAL_RPM_INGEST_ENABLED=false     # Phase 1: RPM vitals ingestion pipeline
HOME_HOSPITAL_EDDY_ENABLED=false           # Phase 3: Eddy home action catalog
EDDY_ALLOW_CLOUD=false                      # master kill-switch for any frontier egress
EDDY_DEFAULT_PROVIDER_MODE=local_first
EDDY_PHI_DETECTION_ENABLED=true
EDDY_PHI_BLOCK_ON_DETECTION=true
EDDY_CLOUD_MONTHLY_BUDGET_USD=500.0
EDDY_CLOUD_BUDGET_CUTOFF_THRESHOLD=0.95
EDDY_CLOUD_BUDGET_ALERT_THRESHOLDS=0.50,0.80,0.95

# --- read ONLY by the eddy service (never by Laravel/Vite) ---
ANTHROPIC_API_KEY=
OLLAMA_BASE_URL=http://host.docker.internal:11434
EDDY_OLLAMA_MODEL=puyangwang/medgemma-27b-it:q4_0
# Pre-load the local model at boot. Recommended TRUE in prod: a cold 27B q4_0 load
# (~75-180s) otherwise lands on the first user request and can exceed the adapter
# timeout; once warm, replies are ~6s.
EDDY_WARMUP_ON_STARTUP=true
EDDY_AGENT_MODEL=claude-opus-4-8
EDDY_AGENT_EFFORT=xhigh
EDDY_CLOUD_CHAT_MODEL=claude-sonnet-4-6
EDDY_AGENT_LOCAL_BASE_URL=http://claude-router:8787   # Anthropic-compatible proxy -> Ollama (compose); systemd host: dedicated port e.g. http://127.0.0.1:8788 (8787 may be taken by darkstar)
EDDY_AGENT_LOCAL_MODEL=qwen3:8b                       # tool-calling local model (NOT MedGemma); validated 6/6 on the Eddy catalog, ~95 tok/s (docs/plans/EDDY-LOCAL-AGENT-PATH.md)
EDDY_AGENT_MAX_TURNS=24
EDDY_AGENT_MAX_BUDGET_USD=5.0
EDDY_AGENT_APPROVAL_TIMEOUT_SECONDS=600

# Zephyrus 2.0 cockpit (P1 serving layer, P2 overview)
COCKPIT_OVERVIEW_ENABLED=true               # false = /dashboard falls back to the pre-2.0 four-band layout (rollback path)
COCKPIT_OVERVIEW_REDIRECTS=true             # false = the five legacy /dashboard/* overviews serve their original pages again (P4a rollback)
COCKPIT_HIDE_DEMO_DOMAINS=false             # true on real deployments: hide all-demo domains (Quality/Service/Financial) until live

# Synthetic operations rehearsal. Keep disabled for every real tenant.
DEMO_DATA_ENABLED=false
DEMO_DATA_FACILITY_ALLOWLIST=SUMMIT_REGIONAL
DEMO_DATA_SCHEDULE_ENABLED=false
DEMO_DATA_SCHEDULE_TIME=05:15

# Canonical staffing shift/availability projection. The materializer scopes
# roster assignments to this facility and stores all shift boundaries in UTC.
STAFFING_DEFAULT_FACILITY_KEY=SUMMIT_REGIONAL
STAFFING_DEFAULT_TIMEZONE=America/New_York
STAFFING_MATERIALIZATION_DAYS=28
STAFFING_MATERIALIZATION_SCHEDULE_ENABLED=true
STAFFING_MATERIALIZATION_SCHEDULE_TIME=04:10
COCKPIT_METRIC_VALUES_RETENTION_DAYS=90     # ops.metric_values snapshot-grain retention (aligned to TREND_DAYS)
COCKPIT_ALERT_OPEN_HOLDS=2                  # P6 flap-damping: consecutive alerting snapshots before an alert OPENS
COCKPIT_ALERT_CLEAR_HOLDS=3                 # P6 flap-damping: consecutive normal snapshots before an open alert CLEARS
COCKPIT_ALERT_RECONCILE_INTERVAL=30         # seconds; burst rebuilds inside this window serve reads without counting holds
COCKPIT_ALERT_TTL_HOURS=72                  # TTL re-raise: an alert open longer than this closes to history and re-derives fresh; 0 disables
TEAMS_ALERT_WEBHOOK_URL=                    # P6 alert fan-out Teams lane; empty = inert (crit + opted-in warn only)

# Rolling demo (config/demo.php) — enables zephyrus:demo-refresh mutations + schedule.
DEMO_MODE=false
DEMO_SCENARIO=summit-reference

# Optional non-production bootstrap identity. UserSeeder skips production and
# creates no identity unless all three values are explicit, DEMO_MODE is true,
# and the password is at least 16 characters. First login must change it.
DEMO_BOOTSTRAP_USERNAME=
DEMO_BOOTSTRAP_EMAIL=
DEMO_BOOTSTRAP_PASSWORD=

# Anonymous demo session bootstrap is separate from DEMO_MODE and is always
# refused in production. Keep disabled unless running a sealed local demo.
DEMO_AUTO_LOGIN_ENABLED=false
DEMO_AUTO_LOGIN_USERNAME=
DEMO_SHOW_CREDENTIALS=false

# Patient Flow 4D facility model assets. Must NOT live under /vendor/* — that
# URL namespace is blocked by the edge ModSecurity sensitive-path rule.
ZEPHYRUS_500_MODEL_URL=/facility-models/zep-500/hospital_model.glb
ZEPHYRUS_500_TILESET_URL=/facility-models/zep-500/tileset.json