Environment variables
The control plane, schedulers, runtime manager, in-VM harness and dashboard read environment variables for configuration, and every one is listed here with its default, what it does and the line of code that reads it. Local development needs none of them: make run-api sets the database, Redis and S3 values, and each security variable has a dev default or is skipped with a warning. In production, a variable marked required in prod must be set, or the process refuses to start (the harness refuses to run the workload) when PAL_ENV is prod, production or staging. Start from the checklist below, then see Operations for how the Helm chart supplies the values.
Every variable is spelled PAL_*. Flag values accept 1, true or on unless a row says otherwise. A production process missing a required value logs it by name and exits at startup.
Production checklist
Section titled “Production checklist”| Service | Must be set |
|---|---|
| Control plane | JWT_SECRET, PAL_RECEIPT_SECRET, PAL_CREDENTIAL_KEY, PAL_GRPC_SERVICE_TOKEN, PAL_APP_DB_PASSWORD (turns on row-level security; missing it is fatal unless PAL_RLS_ENFORCE=0), PAL_CONTROL_PLANE_TLS_CERT/_KEY, PAL_SCHEDULER_GRPC_ADDR, PAL_RUNTIME_MANAGER_TLS_CA/_CERT/_KEY |
| Runtime scheduler | PAL_GRPC_SERVICE_TOKEN, SCHEDULER_NODE_TOKEN, PAL_DEFAULT_MANAGER_ADDR, manager TLS CA and client cert |
| Runtime manager | PAL_GRPC_SERVICE_TOKEN, PAL_MANAGER_TLS_CA/_CERT/_KEY |
| Harness | PAL_WORKLOAD_UID, PAL_HARNESS_EXEC_TOKEN |
| Notifier | PAL_GRPC_SERVICE_TOKEN, PAL_NOTIFIER_SIGNING_KEY (32+ bytes; signs outbound webhooks) |
The control plane also refuses to start in prod with PAL_TWILIO_WEBHOOK_AUTH=off or PAL_USE_CLAUDE_CODE=1, and the scheduler refuses PAL_DIALER=stub.
All variables
Section titled “All variables”Filter by name, service or meaning, pick a group, or show only the variables a production process refuses to start without. Each row links to the line that reads it.
| Variable | Default | Meaning | Read in |
|---|---|---|---|
AGENT_IMAGE | ghcr.io/pal/agent-runner:latest | Default workload image (docker, kata). | Runtime manager |
ANTHROPIC_API_KEY | unset | Same, for Anthropic. | Control plane: models, knowledge, flags |
AWS_ACCESS_KEY_ID | unset | Snapshot-tier credentials. | Runtime manager |
AWS_SECRET_ACCESS_KEY | unset | Snapshot-tier credentials. | Runtime manager |
BUNDLE_S3_BUCKET | pal-bundles | Bundle bucket. | Runtime manager |
BUNDLE_S3_ENDPOINT | http://localhost:9000 | Where agent bundles are fetched from. | Runtime manager |
DATABASE_URL | postgres://localhost:5432/pal?sslmode=disable | Postgres DSN (pgvector image). Also read by cmd/migrate and the cron scheduler. | Control plane: listeners, stores, process |
DOCKER_SOCKET | /var/run/docker.sock | Docker socket path. | Runtime manager |
FC_BINARY_PATH | found on PATH | Firecracker binary. | Runtime manager |
FC_BRIDGE | unset | Host bridge for VM taps. | Runtime manager |
FC_KERNEL_PATH | /opt/pal/vmlinux | Guest kernel. | Runtime manager |
FC_ROOTFS_PATH | /opt/pal/rootfs.ext4 | Base rootfs image. | Runtime manager |
FIRECRACKER_CHROOT_BASE | /srv/jailer | Jailer chroot base. | Runtime manager |
FIRECRACKER_JAILER_GID | 100 | Gid the jailer drops to. | Runtime manager |
FIRECRACKER_JAILER_PATH | unset (no jailer) | Run Firecracker under this jailer binary. | Runtime manager |
FIRECRACKER_JAILER_UID | 123 | Uid the jailer drops to. | Runtime manager |
GOOGLE_CLIENT_ID | unset | Enables "Sign in with Google" (with the secret). | Control plane: sign-up, mail, OAuth |
GOOGLE_CLIENT_SECRET | unset | Google OAuth client secret. | Control plane: sign-up, mail, OAuth |
HTTP_ADDR | :8080 | REST listen address. | Control plane: listeners, stores, process |
JWT_SECRETprod | dev default (public) | Signs dashboard JWTs. Unset or the dev default is fatal in prod. **Required in prod.** | Control plane: auth, secrets, trust boundaries |
KATA_RUNTIME_NAME | kata-runtime | Docker runtime name registered for Kata. | Runtime manager |
LISTEN_ADDR | :50051 | gRPC listen address (the tenant-trust boundary). | Control plane: listeners, stores, process |
LOG_LEVEL | info | Log level. | Control plane: listeners, stores, process |
NEXT_PUBLIC_API_URL | http://localhost:8080 | Control-plane URL for the browser and the kiosk page. | Dashboard (Next.js) |
NEXT_PUBLIC_DEMO_MODE | unset | 1 shows the demo affordances on the login page. | Dashboard (Next.js) |
NEXT_PUBLIC_PAL_BRIDGE_URL | unset | Public fallback for the same URL, and the Surfaces page probe. | Dashboard (Next.js) |
NEXT_PUBLIC_PAL_IMESSAGE_BRIDGE_URL | unset | Public fallback, and the Surfaces page probe. | Dashboard (Next.js) |
NEXT_PUBLIC_TURNSTILE_SITE_KEY | unset | Turnstile site key; renders the captcha widget. | Dashboard (Next.js) |
NODE_ADVERTISE_ADDR | LISTEN_ADDR with 0.0.0.0 as localhost | Address the scheduler dials back; set it on multi-host. | Runtime manager |
NODE_ENV | set by Next.js | production marks the session cookie Secure. | Dashboard (Next.js) |
NODE_NAME | HOSTNAME-derived | Node name reported to the scheduler. | Runtime manager |
NODE_REGION | local | Region label for placement. | Runtime manager |
NODE_ZONE | local-a | Zone label. | Runtime manager |
OAUTH_BASE_URL | http://localhost:8080 | Public base URL for connector OAuth redirect URIs. | Control plane: sign-up, mail, OAuth |
OAUTH_CLIENT_ID_ | unset | Per-connector OAuth client id; connector id upper-cased, - as _ (for example OAUTH_CLIENT_ID_GITHUB). | Control plane: sign-up, mail, OAuth |
OAUTH_CLIENT_SECRET_ | unset | The matching client secret. | Control plane: sign-up, mail, OAuth |
OAUTH_DASHBOARD_URL | http://localhost:3001 | Dashboard base URL used in emailed verify/reset links and OAuth redirects. | Control plane: sign-up, mail, OAuth |
OAUTH_REDIRECT_BASE | http://localhost:8080 | Base URL for the Google sign-in redirect URI. Set it to the public API URL. | Control plane: sign-up, mail, OAuth |
OPENAI_API_KEY | unset | Platform-level fallback provider key, used when a tenant has none configured. | Control plane: models, knowledge, flags |
OTEL_EXPORTER_OTLP_ENDPOINT | unset | Standard OTLP endpoint; setting it also enables tracing. | Control plane: models, knowledge, flags |
PAL_AGENT_DIR | unset | Agent directory the Python runtime runner loads when none is passed. | sdk-python |
PAL_AGENT_HANDOFF_MESSAGE | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_AGENT_HANDOFF_PAUSE_HOURS | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_AGENT_IDENTITY_ED25519_SEED | unset | Seed for Ed25519 agent identity tokens (preferred over the HMAC secret). | control-plane |
PAL_AGENT_IDENTITY_SECRET | unset | HMAC secret for per-instance agent identity tokens. | control-plane |
PAL_AGENT_IDENTITY_TTL | 1h | Identity token lifetime (Go duration). | control-plane |
PAL_AGENT_INSTANCE_ID | set by the control plane | Injected into spawned workloads, not an operator setting. | control-plane, harness, runtime-manager, runtime-scheduler |
PAL_AGENT_INSTANCE_TOKEN | set by the control plane | Injected into spawned workloads, not an operator setting. | control-plane, harness, runtime-manager, runtime-scheduler |
PAL_AGENT_NAME | set at spawn | Agent name of the running workload. | imessage-bridge, sdk-python, surface-gateway, whatsapp-bridge |
PAL_AGENT_PAUSE_MIN | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_AGENT_VERSION | set at spawn | Agent version of the running workload. | sdk-python |
PAL_AGENT_VERSION_ID | — | Not documented yet; see the source. | harness, runtime-manager |
PAL_ALLOW_FULL_COPY_FORK | — | Not documented yet; see the source. | runtime-manager |
PAL_ALLOW_RUNC_STANDARD | off | 1/true/yes/on lets the standard class run on plain runc (admin override). | runtime-manager |
PAL_ALLOW_SECRET_STUB | off | 1: read secrets from the harness's own env instead of the manager. Dev only; never in production. | harness |
PAL_API_KEY | unset | Appears only in the generated "view code" samples; the dashboard itself does not read it. | cli, sdk-go, sdk-python, web |
PAL_API_PORT | — | Not documented yet; see the source. | scripts |
PAL_API_TOKEN | — | Not documented yet; see the source. | bridge-core, cli, scripts, whatsapp-bridge |
PAL_API_URL | http://localhost:8080 | Control-plane URL for server-side calls (checked before NEXT_PUBLIC_API_URL). | bridge-core, cli, scripts, sdk-go, sdk-python, web |
PAL_APP_DB_PASSWORDprod | unset | Password of the non-superuser pal_app role used when RLS is enforced. Setting it turns RLS on in production; if it is missing, startup is fatal unless PAL_RLS_ENFORCE=0. **Required in prod.** | cli, control-plane, helm, workflow-engine |
PAL_APP_DB_USER | pal_app | Restricted database role that tenant-scoped work connects as when RLS is enforced. | control-plane, workflow-engine |
PAL_APPT_INGEST | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_ARTICLE_READ | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_ATTENTION_DEDUP_MIN | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_AUDIT_RETENTION_DAYS | 365 | Retention for audit events. | control-plane |
PAL_AUTHZ_ENFORCEprod | on in production, off in dev | Scope enforcement for API keys and kiosk sessions is on by default in production (PAL_ENV=production|staging) and off in dev. =0 opts out (logged as a warning); =1 forces it on in dev. A key missing the endpoint's scope then gets 403. Dashboard sessions are always limited to their role's scopes, whatever this says. | control-plane |
PAL_JWT_TTL | 12h | Session JWT lifetime (Go duration, 5m to 24h). Out of range or unparseable stops startup. Tokens with a longer lifetime are refused. No refresh token: users sign in again after it. | control-plane |
PAL_DASHBOARD_TRUSTED_PROXIES | empty | Comma-separated CIDRs of the ingress in front of the dashboard. Only from these peers does the /api/pal proxy read the client from X-Forwarded-For; otherwise the TCP peer is the client. Either way it sends the control plane one hop and never the browser's header. Helm sets it from controlPlane.trustedProxies. | web |
PAL_BATCH_MAX_ITEMS | 1000 | Maximum items in one POST /v1/batches request (ADR 0033). | control-plane |
PAL_BENCH_IMAGE | — | Not documented yet; see the source. | scripts |
PAL_BENCH_TENANT | — | Not documented yet; see the source. | scripts |
PAL_BILLING_GRACE_DAYS | 7 | Days of dunning grace before a failed payment drops the tenant to free limits (0 to 60). Data is never deleted. | control-plane |
PAL_BILLING_SYNC_INTERVAL | 1h | Cadence of the dunning sweep and the meter export. | control-plane |
PAL_BRIDGE_AGENT_TIMEOUT_MS | — | Not documented yet; see the source. | bridge-core |
PAL_BRIDGE_BIND | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_BRIDGE_EMAIL | — | Not documented yet; see the source. | bridge-core, scripts, whatsapp-bridge |
PAL_BRIDGE_HEARTBEAT_TOKEN | unset | Shared token for POST /v1/surfaces/whatsapp/heartbeat. | control-plane, whatsapp-bridge |
PAL_BRIDGE_ORIGIN | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_BRIDGE_PASSWORD | — | Not documented yet; see the source. | bridge-core, scripts, whatsapp-bridge |
PAL_BRIDGE_RETRY_ATTEMPTS | 3 | Retries for 429/503/network errors to the control plane. | bridge-core |
PAL_BRIDGE_RETRY_BASE_MS | 500 | Backoff base step. | bridge-core |
PAL_BRIDGE_RETRY_MAX_MS | 4000 | Backoff cap (full jitter). | bridge-core |
PAL_BRIDGE_SEND_DEDUP_MS | — | Not documented yet; see the source. | imessage-bridge |
PAL_BRIDGE_SEND_MAX_ENTRIES | — | Not documented yet; see the source. | imessage-bridge |
PAL_BRIDGE_TOKEN | unset | Token the WhatsApp bridge validates. | control-plane, imessage-bridge, web, whatsapp-bridge |
PAL_BRIDGE_URL | unset | WhatsApp bridge base URL. | bridge-core, control-plane, scripts, web |
PAL_BROWSER_SKILL | off | on/1/true enables browser-as-skill. | control-plane |
PAL_BUILD_SHA | — | Not documented yet; see the source. | bridge-core |
PAL_BUNDLE_URI | — | Not documented yet; see the source. | runtime-manager |
PAL_CALL_COMMITMENTS_FILE | — | Not documented yet; see the source. | bridge-core |
PAL_CALLBACK_SIGNING_SECRETprod | unset | Key for the HMAC-SHA256 X-Pal-Signature on run and batch callbacks. Fatal in prod when unset; in dev a well-known default is used. **Required in prod.** | control-plane |
PAL_CC_MEASUREMENT_PATH | unset | File holding the launch measurement. | harness |
PAL_CC_TECH | unset | Confidential-computing technology to report. | harness, runtime-manager |
PAL_CLAIM_VERIFY | on | Claim-verify guard on completed-action claims. 0/off/false disables; read on every call. | control-plane |
PAL_CLAUDE_BINARY | found on PATH | Explicit path to that binary. | control-plane |
PAL_COMMITMENT_LEDGER | on | 0 disables closing open commitments from verbatim evidence. | imessage-bridge, whatsapp-bridge |
PAL_COMMUTE | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_COMPLEXITY_ROUTING | on | Complexity-based model routing. 0/off/false disables. | control-plane |
PAL_CONCIERGE | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_CONFIDENCE_CALIBRATE | off | Lowers the score by the step type's realized regret rate. | control-plane |
PAL_CONFIDENCE_ESTIMATOR | verbalization | self-consistency (also self_consistency, sampling) polls the model; anything else uses the heuristic. | control-plane |
PAL_CONFIDENCE_GATE | off | 1/true/on diverts low-confidence tool and connector steps to approval. See Human-in-the-loop. | control-plane |
PAL_CONFIDENCE_GATE_THRESHOLD | 0.75 | Minimum score in [0,1] for auto-execution. | control-plane |
PAL_CONFIDENCE_SAMPLES | 5 (1 to 9) | Independent judgments per self-consistency estimate; each is one LLM call. | control-plane |
PAL_CONFIDENTIAL | unset | Marks a confidential-computing VM for attestation. | harness, runtime-manager |
PAL_CONTROL_PLANE_ENDPOINTS | unset | Ordered, comma-separated control-plane endpoints, primary region first; the data-plane agent fails over down the list. | data-plane-agent |
PAL_CONTROL_PLANE_FAILBACK_INTERVAL | 60s | How often the data-plane agent probes the primary endpoint to fail back after a failover. | data-plane-agent |
PAL_CONTROL_PLANE_TLS_CA | — | Not documented yet; see the source. | gateway |
PAL_CONTROL_PLANE_TLS_CERTprod | unset | PEM path for the gRPC server certificate. Both cert and key, or neither; one alone is always fatal. Prod requires them. **Required in prod.** | control-plane |
PAL_CONTROL_PLANE_TLS_KEYprod | unset | PEM path for the matching key. **Required in prod.** | control-plane |
PAL_CONTROL_PLANE_URL | unset | Control plane's own public URL (errand callbacks); also what the manager uses for the secret relay. | control-plane, gateway, imessage-bridge, runtime-manager, whatsapp-bridge |
PAL_CORS_ORIGINS | http://localhost:3001 | Comma-separated allowed browser origins. Public endpoints (receipt verify, /.well-known/*) stay open. | control-plane |
PAL_CREDENTIAL_KEYprod | unset (plaintext in dev) | 32-byte AES-256-GCM key that encrypts provider keys and connector tokens at rest. Fatal in prod when unset or malformed. **Required in prod.** | control-plane |
PAL_CROSS_APP | off | on/1/true enables cross-app workflows. | control-plane |
PAL_DASHBOARD_PORT | — | Not documented yet; see the source. | scripts |
PAL_DASHBOARD_URL | — | Not documented yet; see the source. | bridge-core |
PAL_DECLARED_SECRETS | set at spawn | Secret refs the spec declared. | harness |
PAL_DEFAULT_CALENDAR | Home / Calendar / Personal / Work | Calendar used when a booking names none. | bridge-core, imessage-bridge |
PAL_DEFAULT_MANAGER_ADDRprod | unset | Manager address for the log-stream proxy and the health sweep. | cli, control-plane, runtime-scheduler, scripts |
PAL_DEFAULT_TENANT_ID | 00000000-0000-0000-0000-000000000001 | Tenant that single-owner background jobs act for. | bridge-core, control-plane, imessage-bridge, scripts |
PAL_DEFAULT_TIMEZONE | UTC | IANA zone for cron matching and the budget day boundary when a schedule sets none. | control-plane |
PAL_DELIVERY_WATCH_MS | — | Not documented yet; see the source. | imessage-bridge |
PAL_DIALER | unset | stub forces the stub dialer. Fatal in prod. | runtime-scheduler |
PAL_DIGEST_HOUR | — | Not documented yet; see the source. | bridge-core |
PAL_DIGEST_NARRATIVE | — | Not documented yet; see the source. | bridge-core |
PAL_DISLIKE_FILE | — | Not documented yet; see the source. | bridge-core |
PAL_DISLIKE_LLM_CLUSTER | on | 0 disables the LLM clustering pass of the thumbs-down learning loop (the deterministic pass always runs). | bridge-core |
PAL_DL_SIGNING_SECRET | unset | Signing secret for short-lived document download links. | control-plane |
PAL_DOC_INGEST | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_DP_MAX_STREAMS_PER_TENANT | 10 | Concurrent data-plane run streams per tenant. | control-plane |
PAL_DRAFT_APPROVALS | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_DRAFT_CONFIRM | off | iMessage: on holds LOW-confidence replies for owner approval. | imessage-bridge |
PAL_DRAFT_HIGH_STAKES | off | WhatsApp: on holds LOW-confidence replies for owner approval. | whatsapp-bridge |
PAL_DRAIN_GRACE_SECS | 25 | Grace period on SIGTERM drain. | harness |
PAL_DRAIN_TIMEOUT | 30s | Graceful-shutdown drain window (Go duration). | control-plane |
PAL_EGRESS_ALLOWED_PORTS | 443 | Comma list of ports the broker will dial. | harness, runtime-manager |
PAL_EGRESS_BIND | 127.0.0.1:3128 | Listen address of the in-guest egress proxy. | harness |
PAL_EGRESS_CA_PEM | unset | Per-VM CA the broker uses to terminate TLS for injecting hosts. | harness |
PAL_EGRESS_FAIL_CLOSED | off in dev | 1 refuses to boot without the iptables REDIRECT rule. Always on in prod; 0 is ignored there with a warning. | harness, runtime-manager |
PAL_EGRESS_MODE | guest | broker (Firecracker only) gives VMs no NIC and enforces egress on the host over vsock. See Egress and credentials. | harness, runtime-manager |
PAL_EGRESS_PLAIN_INJECT | unset | 1 permits credential injection over plain HTTP on port 80. Off by default. | runtime-manager |
PAL_EGRESS_RULES | [] | JSON [{pattern, http_methods, rate_bps}] declared egress. | harness, runtime-manager |
PAL_EGRESS_VSOCK_PORT | 3128 | Broker-mode vsock port to the host broker. | harness |
PAL_EMBED_CONCURRENCY | 4 (1 to 32) | Parallel embedding calls. | control-plane |
PAL_EMBED_MODEL | text-embedding-3-small | Embedding model for knowledge and memory. | control-plane |
PAL_ENERGY | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_ENV | unset (dev) | prod, production or staging turns on every production startup guard in this table. The Helm chart defaults it to production. | control-plane, gateway, harness, model-router, runtime-manager, runtime-scheduler, surface-gateway, workflow-engine |
PAL_ENV_FILE | — | Not documented yet; see the source. | scripts |
PAL_EPISODES_FILE | — | Not documented yet; see the source. | bridge-core |
PAL_ERRAND | off | Enables outbound errand calls. | control-plane |
PAL_ERRAND_PUBLIC_URL | unset | Public URL for errand webhooks. | control-plane |
PAL_EVENT_SCOUT | on | 0 disables the weekly event scan (commands still work). | imessage-bridge |
PAL_EVENT_SCOUT_AGENT | event-scout | Registered agent name event-scout sessions run under. | imessage-bridge, whatsapp-bridge |
PAL_EVENT_SCOUT_AUDIENCE | built-in default | Audience the event scout curates for. | bridge-core |
PAL_EVENT_SCOUT_LOCATION | built-in default | Location the event scout searches around. | bridge-core |
PAL_EVENT_SCOUT_WA | off | 1 enables the scheduled event scan on WhatsApp too. | whatsapp-bridge |
PAL_FENCE_EPOCH | unset | Positive-integer fencing epoch for failover; a stale region cannot write after a newer epoch is promoted. See docs/runbooks/region-failover.md. | control-plane |
PAL_FOCUS | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_FORK_CONCURRENCY | 16 | Concurrent fork spawns. | runtime-scheduler |
PAL_FREE_TIER_COST_USD_PER_DAY | 2.00 | Tenant-wide LLM spend cap applied to new tenants. | control-plane |
PAL_FREE_TIER_MAX_VMS | 2 | Concurrent sandbox VMs for new tenants. | control-plane |
PAL_FREE_TIER_RUNTIME_COST_USD_PER_DAY | 1.00 | Sandbox spend cap for new tenants. | control-plane |
PAL_GMAIL_INGEST | — | Not documented yet; see the source. | imessage-bridge |
PAL_GMAIL_POLL_SEC | — | Not documented yet; see the source. | imessage-bridge |
PAL_GMAIL_POLL_STATE | — | Not documented yet; see the source. | bridge-core |
PAL_GRPC_ENDPOINT | — | Not documented yet; see the source. | sdk-python |
PAL_GRPC_INSECURE | off | 1 lets a prod-like process serve or dial internal gRPC without mutual TLS, with a loud warning. | gateway, pal-grpc-tls-rs |
PAL_GRPC_SERVICE_TOKENprod | unset | Shared service token for the gRPC trust boundaries. Set the same value on the control plane, gateway, workflow engine, runtime scheduler, model router and runtime manager. Fatal in prod when unset; dev warns and allows unauthenticated calls. **Required in prod.** | cli, control-plane, data-plane-agent, gateway, imessage-bridge, model-router, runtime-manager, runtime-scheduler, scheduler, surface-gateway, whatsapp-bridge, workflow-engine |
PAL_GRPC_TLS_ALLOWED_PEERS | unset | Comma-separated SPIFFE ids (spiffe://pal.internal/svc/<name>) this server accepts. Per-VM guest certificates are always refused. | pal-grpc-tls-rs |
PAL_GRPC_TLS_CA | unset | CA bundle for mutual TLS on internal gRPC hops (ADR 0043). Set with _CERT and _KEY. | gateway, pal-grpc-tls-rs |
PAL_GRPC_TLS_CERT | unset | This process's service certificate for internal gRPC mutual TLS. | pal-grpc-tls-rs |
PAL_GRPC_TLS_KEY | unset | Private key for PAL_GRPC_TLS_CERT. | pal-grpc-tls-rs |
PAL_HAIKU_MODEL | claude-haiku-4-5-20251001 | Concrete model behind the small tier. | control-plane |
PAL_HARNESS_EXEC_ADDR | 0.0.0.0:50056 | Listen address of the one-shot exec server. | harness, runtime-manager |
PAL_HARNESS_EXEC_PORT | 50056 | Port of the harness exec channel. | runtime-manager |
PAL_HARNESS_EXEC_TOKENprod | unset | Token the Exec RPC requires. Must be set in prod and staging. **Required in prod.** | harness, runtime-manager |
PAL_HARNESS_READY_TIMEOUT_MS | 5000 | How long resume and fork wait for the harness. | runtime-manager |
PAL_HEALTH | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_HEALTH_SWEEP_INTERVAL | 60s | Peer-service health sweep period. 0 or off disables it. | control-plane |
PAL_HISTORY_REPLY | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_HOME | ~/.pal | CLI config and credentials directory. | cli |
PAL_HOOK_BURST | 10 | Per-trigger burst. | control-plane |
PAL_HOOK_RATE_PER_MIN | 60 | Per-trigger rate limit on POST /v1/hooks/{id}. | control-plane |
PAL_IMAGE_ALLOWED_REPOS | — | Not documented yet; see the source. | runtime-manager |
PAL_IMESSAGE_AGENT_NAME | — | Not documented yet; see the source. | imessage-bridge |
PAL_IMESSAGE_AUTOSTART | — | Not documented yet; see the source. | imessage-bridge |
PAL_IMESSAGE_BRIDGE_BIND | — | Not documented yet; see the source. | imessage-bridge |
PAL_IMESSAGE_BRIDGE_ORIGIN | — | Not documented yet; see the source. | imessage-bridge |
PAL_IMESSAGE_BRIDGE_PORT | — | Not documented yet; see the source. | imessage-bridge |
PAL_IMESSAGE_BRIDGE_TOKEN | unset | Token the iMessage bridge validates (a different variable from the WhatsApp one). | control-plane, imessage-bridge, web, whatsapp-bridge |
PAL_IMESSAGE_BRIDGE_URL | unset | iMessage bridge base URL. | bridge-core, control-plane, scripts, web, whatsapp-bridge |
PAL_IMESSAGE_OWNER_HANDLE | unset | Owner iMessage handle for dedicated-bot mode; unset falls back to self-chat detection. | imessage-bridge, scripts |
PAL_IMMIGRATION_SENTINEL | off | on enables the document-deadline sentinel, which derives deadlines from documents and mail (control plane). | control-plane |
PAL_INPUT | — | Not documented yet; see the source. | runtime-manager, sdk-python |
PAL_INTROSPECT_DRYRUN | — | Not documented yet; see the source. | scripts |
PAL_INTROSPECT_MAX_SECONDS | — | Not documented yet; see the source. | scripts |
PAL_INTROSPECT_MODEL | — | Not documented yet; see the source. | scripts |
PAL_IPHONE_SIGNALS | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_IPHONE_SIGNALS_SEC | — | Not documented yet; see the source. | imessage-bridge |
PAL_JARVIS_BRIEF_CHANNEL | unset | Channel for the brief. | control-plane |
PAL_JARVIS_BRIEF_HOUR | unset (brief off) | Hour 0 to 23 for the morning brief push. | control-plane |
PAL_JARVIS_STREAM | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_JOURNAL_PATH | — | Not documented yet; see the source. | sdk-python |
PAL_JOURNAL_RETENTION_DAYS | 90 | Retention for journal_events. | control-plane |
PAL_KB_MIN_SCORE | 0.2 | Cosine floor for a knowledge-base vector hit; below it the full-text fallback runs. | control-plane |
PAL_KIOSK | off | Demo mode: anonymous throwaway workspaces. Refuses to start unless RLS and authz enforcement are on and JWT_SECRET is non-default. | control-plane |
PAL_KIOSK_ALLOW_PROD | off | Required to run kiosk mode under a production-like PAL_ENV. | control-plane |
PAL_KIOSK_IP_PER_HOUR | 3 | New workspaces per client IP per hour. | control-plane |
PAL_KIOSK_MAX_SESSIONS | 20 | Concurrent kiosk workspaces. | control-plane |
PAL_KIOSK_SWEEP_SEC | 60 | Expiry sweep period in seconds. | control-plane |
PAL_KIOSK_TTL_MIN | 30 | Workspace lifetime in minutes. | control-plane |
PAL_LIFE_EVENT_AUTOACT | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_LIFE_EVENTS | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_LIFE_EVENTS_ACTED | — | Not documented yet; see the source. | bridge-core |
PAL_LIFE_EVENTS_AUTOACT_STATE | — | Not documented yet; see the source. | bridge-core |
PAL_LIFE_EVENTS_PREFS | — | Not documented yet; see the source. | bridge-core |
PAL_LIVE_WATCH | on | 0/off disables live watches (follow-ups on a flight, game or outage a contact mentioned). | imessage-bridge, whatsapp-bridge |
PAL_LLM_BASEURL_ANTHROPIC | unset | Same, for Anthropic. | control-plane |
PAL_LLM_BASEURL_OPENAI | unset | Points OpenAI calls at a fixture or proxy base URL (used by demo mode and the replay server). | control-plane |
PAL_LLM_MAX_TURNS | 12 (cap 40) | Tool-loop turn limit per completion. | control-plane |
PAL_MAC_USAGE | off | on enables the owner-only Mac app-usage signal (summaries only, fails closed). | imessage-bridge |
PAL_MAC_USAGE_SEC | 1800 | Mac app-usage refresh interval in seconds (min 60). | imessage-bridge |
PAL_MAIL_FROM | PAL <no-reply@localhost> | From address for smtp and http. | control-plane |
PAL_MAIL_HTTP_TOKEN | unset | Bearer token for the http driver. | control-plane |
PAL_MAIL_HTTP_URL | unset | Endpoint for the http driver. | control-plane |
PAL_MAIL_INDEX | on | 0/off disables the owner-only search over the local Apple Mail index. | imessage-bridge |
PAL_MAILER | log | log, smtp or http. | control-plane |
PAL_MANAGER_ADDR | from spawn.json | Manager address; in broker mode the manager's name, dialed over vsock. | cli, harness, runtime-manager |
PAL_MANAGER_SERVER_NAME | manager.pal.internal | TLS server name used to verify the manager. | harness |
PAL_MANAGER_TLS_CAprod | unset | CA that harness and caller client certs must chain to. Fail-closed in prod, plaintext with a warning in dev. **Required in prod.** | harness, runtime-manager |
PAL_MANAGER_TLS_CERTprod | unset | Manager server certificate (PEM). **Required in prod.** | runtime-manager |
PAL_MANAGER_TLS_KEYprod | unset | Manager server key (PEM). **Required in prod.** | runtime-manager |
PAL_MANAGER_VSOCK_PORT | unset | Broker mode: vsock port of the control channel. | harness |
PAL_MAX_FORK_COUNT | 100 (ceiling 1000) | Per-call cap on POST /v1/runtime/vms/{id}/fork. | control-plane, runtime-scheduler |
PAL_MAX_RESTARTS | 5 | Workload restart limit. | harness |
PAL_MEASUREMENT_GATE | — | Not documented yet; see the source. | runtime-manager |
PAL_MEMORY_DISTILL | off | 1/true/on enables LLM memory distillation. | control-plane |
PAL_MEMORY_DISTILL_INTERVAL | 6h (min 1m) | Distillation period. | control-plane |
PAL_MEMORY_INGEST | on | Background memory ingest. off disables. | control-plane |
PAL_MEMORY_INGEST_INTERVAL | 15m (min 1m) | Ingest period. | control-plane |
PAL_METRICS_ADDR | :9464 | Separate Prometheus /metrics listener. Unauthenticated and labelled with agent names, so scrape it from Prometheus only, never through ingress. | control-plane |
PAL_MODEL_ROUTER_ADDR | unset | Model router address; also a health-sweep target. | control-plane, workflow-engine |
PAL_MULTI_STEP_PLANNER | on | Multi-step planner. 0/off/false disables. | control-plane |
PAL_NATURAL_CHAT_MODEL | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_NEWS_DIGEST_HOUR | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_NEWS_PROACTIVE | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_NOTIFIER_ALLOW_PRIVATE | unset | 1 lets webhook/Slack/Discord deliveries reach loopback, private and fake-IP (198.18.0.0/15) addresses, for local receivers. Dev only: ignored in prod, where webhook deliveries also require https. Metadata/link-local is refused everywhere. | notifier |
PAL_NOTIFIER_SIGNING_KEYprod | unset | Root secret for notifier webhook signatures. Each tenant's key is HKDF-SHA256(this, info pal-notifier-webhook-v1|<tenant_id>, 32 bytes); the header is X-Pal-Signature: t=<unix>,v1=<hex HMAC-SHA256(key, "<t>.<body>")>. Fatal in prod when unset or shorter than 32 bytes; dev uses a well-known default. **Required in prod.** | notifier |
PAL_NO_PROXY | 127.0.0.1,localhost,::1,169.254.169.254 | Overrides the injected NO_PROXY. | harness, runtime-manager |
PAL_NODE_LABEL_GVISOR | unset | Node label that marks gVisor-capable nodes. | runtime-manager |
PAL_NODE_LABEL_KATA | unset | Node label that marks Kata-capable nodes. | runtime-manager |
PAL_NODE_MEMORY_BYTES | detected | Override the advertised memory in bytes. Default: detected, else 8 GiB with a warning. | runtime-manager |
PAL_NODE_VCPU_MILLIS | detected | Override the advertised CPU capacity in millicores. Default: detected parallelism x 1000. | runtime-manager |
PAL_NONENGLISH_DRAFT | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_NUDGE_VOICE | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_OCR_PYTHON | — | Not documented yet; see the source. | imessage-bridge |
PAL_OCR_SCRIPT | — | Not documented yet; see the source. | imessage-bridge |
PAL_OFFLINE_ALERT_AFTER_SEC | — | Not documented yet; see the source. | bridge-core |
PAL_OPENAI_API_KEY | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_OPUS_MODEL | claude-opus-4-8 | Concrete model behind the large tier. | control-plane, whatsapp-bridge |
PAL_OTEL_ENABLED | unset | 1 enables tracing (with an OTLP endpoint). | control-plane, gateway, model-router, runtime-manager |
PAL_OTLP_SOCKET | set at spawn | Unix socket for workload OTLP. | harness |
PAL_OWNER_CHAT_NL | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_OWNER_EMAIL | unset | Owner email: brief fallback and memory-ingest identity. | bridge-core, control-plane, imessage-bridge, scripts, whatsapp-bridge |
PAL_OWNER_NAME | unset | Owner first name for briefs and calls. | bridge-core, control-plane, imessage-bridge, scripts, whatsapp-bridge |
PAL_OWNER_PHONE | unset | Owner number for the morning brief by SMS. | control-plane, imessage-bridge, whatsapp-bridge |
PAL_OWNER_PROFILE | ~/.pal/owner-profile.md | Owner profile markdown (facts, relationships, style lessons), hot-reloaded. | bridge-core |
PAL_OWNER_TELEGRAM_BOT_TOKEN | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_OWNER_TELEGRAM_CHAT_ID | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_OWNER_TIMEZONE | process tz | IANA timezone for quiet hours, digests and calendar lookups. | bridge-core, imessage-bridge, scripts, whatsapp-bridge |
PAL_OWNER_VERIFY_PIN | unset | PIN for the owner's Twilio line; unset authorizes on caller ID alone (spoofable). | control-plane |
PAL_OWNER_VERIFY_TTL | 12h | How long a PIN verification lasts. | control-plane |
PAL_PAUSE_WARN | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_PERSONAL_DOCS_BRIDGE_URL | unset | Overrides the bridge URL for the personal-docs tool. | control-plane |
PAL_PERSONAL_DOCS_MAX_CHARS | — | Not documented yet; see the source. | bridge-core |
PAL_PERSONAL_DOCS_MAX_RESULTS | — | Not documented yet; see the source. | bridge-core |
PAL_PERSONAL_DOCS_OCR_MAX_PAGES | 3 | Max PDF pages rendered and OCR-ed per file. | bridge-core |
PAL_PERSONAL_DOCS_ROOTS | ~/Documents:~/Desktop:~/Downloads:iCloud Drive | Colon-separated roots the personal-docs search may read. Everything else is blocked. | bridge-core, imessage-bridge, whatsapp-bridge |
PAL_PG_MAX_CONN_IDLE_TIME | 30m | Max connection idle time. | control-plane |
PAL_PG_MAX_CONN_LIFETIME | 1h | Max connection lifetime. | control-plane |
PAL_PG_MAX_CONNS | 20 | Postgres pool size. | control-plane |
PAL_PROACTIVE_NUDGES | on | 0 disables anticipation nudges (pre-meeting, overdue reply, dates, commitments). | imessage-bridge, whatsapp-bridge |
PAL_PROACTIVE_RECALL | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_PUBLIC_BASE_URL | unset | Public URL override for Twilio callbacks. | control-plane |
PAL_PUSHOVER_TOKEN | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_PUSHOVER_USER | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_QUIET_END | 6 | Quiet hours end (24h); the queue replays with morning pacing. | bridge-core |
PAL_QUIET_QUEUE_MAX | 200 | Max messages buffered overnight per bridge. | imessage-bridge |
PAL_QUIET_REPLAY_GAP_CEIL_MS | — | Not documented yet; see the source. | imessage-bridge |
PAL_QUIET_REPLAY_GAP_FLOOR_MS | — | Not documented yet; see the source. | imessage-bridge |
PAL_QUIET_START | 1 | Quiet hours start (24h). Inbound is queued, not answered. | bridge-core |
PAL_RCS_INBOUND | off | on accepts inbound RCS. | control-plane |
PAL_READ_ONLY | off | 1/true/on makes this region a read-only standby that rejects writes; 0/false/off is writable. Anything else fails startup. | control-plane |
PAL_REAPER_INTERVAL_SECS | 15 | Orphan-VM reaper period (minimum 1). | runtime-manager |
PAL_RECEIPT_ED25519_SEED | unset | Seed for the Ed25519 receipt key. Unset: receipts fall back to HMAC and cannot be verified offline by third parties. | control-plane |
PAL_RECEIPT_SECRETprod | dev default | HMAC secret for run receipts and marketplace invocation signatures. Fatal in prod when unset. **Required in prod.** | control-plane |
PAL_RECOVERY_INTERVAL | 30s | Crash-recovery sweep period. | control-plane |
PAL_REDIS_POOL_SIZE | 20 | Redis pool size. | control-plane |
PAL_REFERENCE_MEASUREMENTS | — | Not documented yet; see the source. | runtime-manager |
PAL_REGION | unset | Region label for active-passive multi-region (lowercase [a-z0-9-], 1-63 chars). A malformed value fails startup. ADR 0046. | control-plane |
PAL_REPLY_MODEL_TIER | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_REQUIRE_REFLINK | — | Not documented yet; see the source. | runtime-manager |
PAL_RESUME | — | Not documented yet; see the source. | control-plane, harness, runtime-manager |
PAL_RLIMIT_AS_BYTES | unset (no cap) | Address-space limit applied to the workload. | harness |
PAL_RLS_ENFORCEprod | on in production when PAL_APP_DB_PASSWORD is set | Row-level security is on in production whenever PAL_APP_DB_PASSWORD is set. Without that password the control plane refuses to start unless you set PAL_RLS_ENFORCE=0. 1 enforces it elsewhere through the pal_app pool. | cli, control-plane, workflow-engine |
PAL_ROUTE_STRATEGY | balanced | balanced, cheap, quality or fast for model: auto. | control-plane |
PAL_RUN_DIR | /run/pal | Directory for sockets (secrets.sock). | harness |
PAL_RUN_ID | set at spawn | Run id of the running workload. | harness, runtime-manager, sdk-python, sdk-ts |
PAL_RUN_LEASE_TTL | 60s | Run lease length; renewed every third of it while a run executes. | control-plane |
PAL_RUNTIME | set by the platform | true inside a running agent: enables the production sidecar in the SDK. | sdk-python, sdk-ts |
PAL_RUNTIME_CLASS | unset | RuntimeClass the pod runs under (attestation). | harness, runtime-manager |
PAL_RUNTIME_LOG_RETENTION_DAYS | 14 | Retention for runtime_vm_logs. | control-plane |
PAL_RUNTIME_MANAGER_ADDR | unset | Runtime manager, for exec, pause and fork calls. Unset: those routes are unavailable. | control-plane, workflow-engine |
PAL_RUNTIME_MANAGER_TLS_CAprod | unset | CA used to verify the manager. Prod requires mTLS to the manager; dev allows plaintext. **Required in prod.** | control-plane, runtime-scheduler, workflow-engine |
PAL_RUNTIME_MANAGER_TLS_CERTprod | unset | Client certificate (both cert and key, or neither). Prod requires it. **Required in prod.** | control-plane, runtime-scheduler, workflow-engine |
PAL_RUNTIME_MANAGER_TLS_KEYprod | unset | Client key. **Required in prod.** | control-plane, runtime-scheduler, workflow-engine |
PAL_RUNTIME_RELAY_ALLOW_INSECURE | unset | 1 allows a non-TLS relay URL (dev only). | runtime-manager |
PAL_RUNTIME_SECRET_TOKEN | unset | Pre-shared token for the manager-to-control-plane secret relay. Unset: POST /v1/runtime/secrets/resolve returns 403. | control-plane, runtime-manager |
PAL_RUNTIME_TERMINAL_GRACE | 10m | How long after a VM turns terminal the control plane still accepts its late log and audit reports. 0 disables the window. | control-plane |
PAL_RUNTIMECLASS_GVISOR | unset | Kubernetes RuntimeClass for gVisor. Unset: that class is refused (fail-closed). | runtime-manager |
PAL_RUNTIMECLASS_KATA | unset | RuntimeClass for Kata. | runtime-manager |
PAL_RUNTIMECLASS_KATA_CC | unset | RuntimeClass for confidential Kata. | runtime-manager |
PAL_RUNTIMECLASS_WASM | unset | RuntimeClass for Wasm pods. | runtime-manager |
PAL_SCHEDULER_GRPC_ADDRprod | unset (stub scheduler) | Runtime scheduler, for example localhost:50055. Unset uses a stub that fabricates VM ids and spawns nothing, so prod refuses to start. **Required in prod.** | cli, control-plane, scripts |
PAL_SCREEN_OCR | — | Not documented yet; see the source. | bridge-core |
PAL_SCREEN_OCR_BLOCK | — | Not documented yet; see the source. | bridge-core |
PAL_SCREEN_OCR_END_HOUR | — | Not documented yet; see the source. | bridge-core |
PAL_SCREEN_OCR_INTERVAL_MS | — | Not documented yet; see the source. | bridge-core |
PAL_SCREEN_OCR_MAX_CHARS | — | Not documented yet; see the source. | bridge-core |
PAL_SCREEN_OCR_RING | — | Not documented yet; see the source. | bridge-core |
PAL_SCREEN_OCR_START_HOUR | — | Not documented yet; see the source. | bridge-core |
PAL_SCREEN_OCR_TTL_MS | — | Not documented yet; see the source. | bridge-core |
PAL_SECRET_RESOLVER | — | Not documented yet; see the source. | runtime-manager |
PAL_SECRETS_SOCKET | /run/pal/secrets.sock | Unix socket the workload asks for secrets on. | harness |
PAL_SELFCHAT_MAX_REPLIES | — | Not documented yet; see the source. | imessage-bridge |
PAL_SELFCHAT_WINDOW_MS | — | Not documented yet; see the source. | imessage-bridge |
PAL_SESSION_VM_IDLE_TTL | 30m | Idle time before a session's sandbox VM is reaped. | control-plane |
PAL_SHORTCUT_OUT | — | Not documented yet; see the source. | scripts |
PAL_SHORTCUT_PORT | — | Not documented yet; see the source. | scripts |
PAL_SHORTCUT_SRC | — | Not documented yet; see the source. | scripts |
PAL_SHORTCUT_WEB | — | Not documented yet; see the source. | scripts |
PAL_SIDE_EFFECT_RETENTION_DAYS | 30 | Retention for side_effect_receipts. | control-plane |
PAL_SIGNAL_TOKEN | unset | Shared secret for /v1/signals (header x-pal-signal-token). Unset: the endpoint is 401. | control-plane, scripts, web |
PAL_SIGNAL_URL | — | Not documented yet; see the source. | scripts |
PAL_SIGNALS_LEGACY_OWNER_TENANT | dev tenant | Tenant the shared-token /v1/signals path mirrors into; off disables that path. Set it on multi-tenant deployments. | control-plane |
PAL_SIGNALS_RETENTION_DAYS | 30 | Retention of tenant device_signals rows. | control-plane |
PAL_SIGNUP_INVITE_SECRET | unset | HMAC key for invite codes. Required for invite mode. | control-plane |
PAL_SIGNUP_MODE | closed in prod, open in dev | open, invite or closed. Any other value stops startup. | control-plane |
PAL_SMTP_ADDR | unset | host:port; required for smtp. | control-plane |
PAL_SMTP_PASSWORD | unset | SMTP password. | control-plane |
PAL_SMTP_USER | unset | SMTP user (PLAIN auth). | control-plane |
PAL_SONNET_MODEL | claude-sonnet-4-6 | Concrete model behind the mid tier. | control-plane |
PAL_SPAWN_BURST | 20 | Per-tenant spawn burst. | control-plane |
PAL_SPAWN_RATE_PER_MIN | 120 | Per-tenant VM spawn rate limit. | control-plane |
PAL_SPOUSE_AGENT | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_STATE_DIR | — | Not documented yet; see the source. | web |
PAL_STEP_GOAL | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_STRIPE_API_BASE | Stripe API | Stripe API origin override (tests, egress proxy). | control-plane |
PAL_STRIPE_METER_RUNS | pal_runs | Stripe meter event name for runs. | control-plane |
PAL_STRIPE_METER_TOKENS | pal_tokens | Stripe meter event name for token usage. | control-plane |
PAL_STRIPE_PLAN_PRICES | unset | Optional pro=price_…,team=price_… override of plan price ids. | control-plane |
PAL_STRIPE_SECRET_KEY | unset | Turns billing on (ADR 0049). Unset: GET /v1/billing reports enabled:false and checkout, portal and webhook answer 404. Never logged. | control-plane |
PAL_STRIPE_WEBHOOK_SECRET | unset | Stripe webhook signing secret. Required when billing is on; prod refuses to start without it. Never logged. | control-plane |
PAL_STUB_NOT_A_REAL_SECRET | — | Not documented yet; see the source. | harness |
PAL_SUPPRESS_SPAM | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_TENANT_ID | set at spawn | Tenant id of the running workload. | bridge-core, cli, harness, imessage-bridge, runtime-manager, sdk-python, surface-gateway |
PAL_TLS_CERT | — | Not documented yet; see the source. | gateway |
PAL_TLS_KEY | — | Not documented yet; see the source. | gateway |
PAL_TOPIC_INDEX | — | Not documented yet; see the source. | bridge-core |
PAL_TRACE_PARENT | set at spawn | W3C trace parent for the spawn. | harness, runtime-manager |
PAL_TRUST_DOMAIN | pal.internal | SPIFFE trust domain make dev-certs uses for local service certificates. | scripts |
PAL_TRUSTED_PROXIES | empty | CIDRs whose X-Forwarded-For is trusted for rate-limit keys. | control-plane |
PAL_TURNSTILE_SECRET | unset | Cloudflare Turnstile secret. Setting it requires a captcha on every sign-up. | control-plane |
PAL_TWILIO_NUMBER | from the Twilio connector | SMS sending number override. | control-plane |
PAL_TWILIO_WEBHOOK_AUTH | on | off skips Twilio signature checks. Fatal in prod. | control-plane |
PAL_USAGE_DAILY_RETENTION_DAYS | 400 | Retention for agent_usage_daily. | control-plane |
PAL_USE_CLAUDE_CODE | unset | 1 routes through a local claude binary. Fatal in prod. | control-plane |
PAL_USE_MODEL_ROUTER | off | 1/true/on sends plain completions through the model router; any router error falls back to the direct provider. | control-plane |
PAL_USE_REST | — | Not documented yet; see the source. | cli |
PAL_VERIFY_SIGNATURES | — | Not documented yet; see the source. | runtime-manager |
PAL_VM_CERT_DIR | — | Not documented yet; see the source. | runtime-manager |
PAL_VM_ID | set at spawn | This VM's id. | harness, runtime-manager |
PAL_VM_SIGNING_CA_CERT | falls back to the manager CA | CA that signs per-VM certificates. | runtime-manager |
PAL_VM_SIGNING_CA_KEY | falls back to the manager key | Its key. | runtime-manager |
PAL_VM_TLS_CERT | set at spawn | Per-VM client certificate path. | harness, runtime-manager |
PAL_VM_TLS_KEY | set at spawn | Per-VM client key path. | harness, runtime-manager |
PAL_VOICE_CACHE_PUBLIC_URL | — | Not documented yet; see the source. | imessage-bridge, whatsapp-bridge |
PAL_VOICE_CALLER_ID | Twilio DID | Caller ID shown on outbound calls; must be a Twilio number or verified caller ID. | imessage-bridge, whatsapp-bridge |
PAL_VOICE_FLOOR | on | 0/off disables the authorship floor that suppresses drafts that do not sound like the owner. | imessage-bridge, whatsapp-bridge |
PAL_VOICE_LANG | — | Not documented yet; see the source. | bridge-core |
PAL_VOICE_OUT | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_VOICE_OUT_VOICE | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_VOICE_REASONING | off | on replaces the heuristic style profile with an LLM-reasoned owner-voice profile. | bridge-core |
PAL_VOICE_REFINE | on | 0/off disables critique-refine of MEDIUM/LOW drafts against the owner's real messages. | imessage-bridge, whatsapp-bridge |
PAL_VOICE_SMS_HEADSUP | on | Texts a one-line heads-up before an outbound conference call. | imessage-bridge, whatsapp-bridge |
PAL_WA_HISTORY_BACKFILL | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_WA_HISTORY_FILE | bridge default | Path of the WhatsApp history file the world model reads. | imessage-bridge |
PAL_WA_HISTORY_MAX_BYTES | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_WA_OWNER_JID | unset | Owner WhatsApp JID (dedicated-bot mode); also scopes the self-chat slice of WhatsApp history. | imessage-bridge, scripts, whatsapp-bridge |
PAL_WA_READ_RECEIPTS | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_WA_REPLAY_STAGGER | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_WA_REPLAY_STAGGER_MAX_MS | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_WA_REPLAY_STAGGER_MIN_MS | — | Not documented yet; see the source. | whatsapp-bridge |
PAL_WEBSEARCH_MODEL | claude-sonnet-4-6 | Anthropic model for the built-in web_search tool. | control-plane |
PAL_WEBSEARCH_OPENAI_MODEL | gpt-4o-mini-search-preview | OpenAI fallback model for web_search. | control-plane |
PAL_WHATSAPP_BRIDGE_URL | unset | WhatsApp bridge URL for the personal-docs tool. | control-plane, imessage-bridge |
PAL_WORKFLOW_ENGINE_ADDR | unset | Workflow engine address, a health-sweep target. | control-plane |
PAL_WORKLOAD_ARGV | from spawn.json | Workload arguments. | harness |
PAL_WORKLOAD_CMD | from spawn.json | Workload command line. | harness |
PAL_WORKLOAD_GID | uid | Workload gid. | harness |
PAL_WORKLOAD_GID_DEFAULT | same as the uid | Workload gid. | runtime-manager |
PAL_WORKLOAD_UIDprod | unset | Uid the workload, exec and shell children run as; also the only uid admitted to the secrets socket. In prod the harness refuses to start without it. **Required in prod.** | harness, runtime-manager |
PAL_WORKLOAD_UID_DEFAULT | 1000 | Workload uid written to spawn.json; a caller-supplied PAL_WORKLOAD_UID is dropped. | runtime-manager |
PAL_WORKSPACE | /workspace | Root the in-VM file tools are confined to. | harness |
PAL_WORLD_MODEL | on | 0 disables the present-tense self-model refresh from mail and calendar. | imessage-bridge |
PAL_WORLD_MODEL_HOURS | 6 | World-model refresh interval in hours. | imessage-bridge |
REDIS_URL | redis://localhost:6379/0 | Redis for rate limits, pub/sub and queues. | Control plane: listeners, stores, process |
RUNTIME_BACKEND | k8s | Backend: k8s, docker, firecracker, kata or wasm. | Runtime manager |
RUST_LOG | unset | Standard Rust log filter. | In-VM harness |
S3_ACCESS_KEY | falls back to AWS_ACCESS_KEY_ID, then pal | Object-store access key. | Control plane: listeners, stores, process |
S3_BUCKET | pal-bundles-dev | Bucket name. | Control plane: listeners, stores, process |
S3_ENDPOINT | unset | S3-compatible endpoint for agent bundles and attachments. | Control plane: listeners, stores, process |
S3_REGION | unset | Signing region. | Control plane: listeners, stores, process |
S3_SECRET | falls back to AWS_SECRET_ACCESS_KEY, then palsecret | Object-store secret. Set real values outside dev. | Control plane: listeners, stores, process |
SCHEDULER_NODE_TOKENprod | unset | Token that node heartbeats must present. Fatal in prod when unset; dev warns. **Required in prod.** | Runtime scheduler (placement) |
SCHEDULER_TENANT_MAX_VMS | 20 | Default per-tenant concurrent VM cap. | Runtime scheduler (placement) |
SCHEDULER_TOKEN | unset | Heartbeat token (the scheduler's SCHEDULER_NODE_TOKEN). | Runtime manager |
SCHEDULER_URL | unset | Runtime scheduler address for node heartbeats. | Runtime manager |
SCHEDULER_WEIGHT_COST | 0.10 | Placement score weight. | Runtime scheduler (placement) |
SCHEDULER_WEIGHT_FAIR_SHARE | 0.15 | Placement score weight. | Runtime scheduler (placement) |
SCHEDULER_WEIGHT_HEALTH | 0.10 | Placement score weight. | Runtime scheduler (placement) |
SCHEDULER_WEIGHT_REGION | 0.25 | Placement score weight. | Runtime scheduler (placement) |
SCHEDULER_WEIGHT_WARM_POOL | 0.40 | Placement score weight. | Runtime scheduler (placement) |
SEED_DEV | unset | 1/true: cmd/migrate seeds the dev tenant and admin user. | Control plane: listeners, stores, process |
SLACK_SIGNING_SECRET | unset | Verifies Slack slash commands. Unset in prod: unsigned commands are refused. | Control plane: auth, secrets, trust boundaries |
SNAPSHOT_DIR | /var/lib/pal/snapshots | Local snapshot store root. | Runtime manager |
How this list was built
Section titled “How this list was built”scripts/gen-env-data.mjs greps the code on master for every PAL_* read: Go os.Getenv and its helpers, Rust std::env::var, process.env in TypeScript, Python os.environ, and shell expansions in scripts/. Tests are excluded. That gives the name list and the “Read in” link. Defaults and meanings are written by hand in site/src/components/docs/env-vars.json from those reads and the startup guards (runStartupGuards in the control plane, authz.rs/tls.rs in the manager); the script keeps them and adds any new variable with an empty meaning, so a gap shows up as “Not documented yet” instead of going missing.
Limits
Section titled “Limits”- Every service is listed, but about a third of the rows (mostly chat-bridge tuning knobs and benchmark scripts) have no written meaning yet; the source link is the reference for those.
- Rows whose default says set at spawn or from spawn.json are written by the manager. Setting them yourself on the harness is overridden or ignored.
- Duration values are Go durations (
30s,1h) unless the name ends in_SECS,_MS,_MINor_DAYS. - Defaults for the model-tier variables change with releases; check
services/control-plane/internal/handlers/llm_proxy.go.