# GitHub App ID — 6-7 digit number from the App settings page
APP_ID=

# Path to the App's private key (.pem file). Keep out of git.
PRIVATE_KEY_PATH=./private-key.pem

# Webhook secret — shared HMAC secret used by GitHub to sign webhook payloads
# Must match the secret set in the App settings page.
# Generate with: openssl rand -hex 32
WEBHOOK_SECRET=

# Anthropic API key for Claude Code / Agent SDK calls
ANTHROPIC_API_KEY=

# Base directory for ephemeral handler workdirs (cloned target repos).
# Each invocation gets a unique subdir. Stub handler doesn't yet write here.
OPENSPEC_FLOW_WORKDIR=/tmp/openspec-flow

# Keep workdirs after a handler finishes — useful for post-mortem debugging.
OPENSPEC_FLOW_KEEP_WORKDIR=false

# Chained mode: when set to "true", create-spec immediately invokes
# create-impl on top of the open spec branch (stacked PR). Useful for
# dev — see the whole chain run without merging spec first. Leave off
# in prod; the merge gate between spec and impl is the review point.
OPENSPEC_FLOW_CHAINED_MODE=false

# When set, the logger dual-streams: pretty output to stdout (dev
# pane) AND raw pino JSON to the file. JSON captures every structured
# field with no truncation — feed it back to pino-pretty later, grep,
# filter, or replay. Directory is created if missing.
LOG_PATH=logs/dev.log

# Port the Probot server listens on
PORT=3000

# Log verbosity: debug | info | warn | error
LOG_LEVEL=debug

# Optional: pin a sandbox repo for local manufactured events
# SANDBOX_REPO=dwmkerr/openspec-flow

# Webhook delivery uses smee.io — channel URL goes in `.smee-url` at
# repo root (created by hand: `echo https://smee.io/<channel> > .smee-url`)
# and as the App's Webhook URL in its settings page.

# OIDC token broker — set to enable the /api/token endpoint that
# exchanges a GitHub-signed OIDC ID token for an App installation
# token. Value should match the `audience` parameter the runner uses
# when requesting its OIDC token (workflow side: `audience=openspec-flow`).
# Leave unset to disable the broker.
OPENSPEC_FLOW_BROKER_AUDIENCE=openspec-flow